July 13, 2026
Russian intelligence used compromised IP cameras and routers near NATO bases to monitor weapons shipments to Ukraine, prompting the EU and UK to issue their first joint cyber sanctions against the GRU. CISA added two maximum-severity Joomla extension flaws (CVE-2026-48939 and CVE-2026-56291) to its known-exploited catalog after active zero-day exploitation enabled web shells. US Navy researchers demonstrated prompt-injection attacks embedded in binaries that weaponize AI reverse-engineering agents like Cline to misreport program functionality. DeadLock ransomware and a new crew called D1R remain active, with Lazarus reportedly weaponizing CVE-2024-21338 as a zero-day without requiring driver deployment.
July 11, 2026
Progress Software is urging ShareFile customers to physically power down Storage Zone Controllers due to active zero-day exploitation tracked by watchTowr. Gitea Docker images are under active exploitation via a critical authentication bypass allowing attacker impersonation. CVE-2026-47291 in Windows HTTP.sys enables kernel code execution through TLS header parsing flaws, and CVE-2026-31431 ("Copy Fail") is a Linux kernel privilege escalation affecting all major distributions since 2017 with no fixed kernels shipped yet. Okta warns of vishing attacks enrolling rogue Entra ID passkeys to hijack Microsoft 365 accounts, while GigaWiper is a modular Golang backdoor bundling wiper, ransomware, and persistence functionality. Qilin leads 2026 ransomware volume with 708 tracked attacks, and Anthropic published the Jacobian lens, an interpretability technique revealing how Claude internally reasons through concepts.
June 20, 2026
FortiBleed has compromised ~86,644 internet-facing FortiGate devices in a credential-harvesting campaign, while a leaked GitHub token gave FulcrumSec access to Novo Nordisk, exfiltrating 1.3TB including unreleased drug formulas and internal AI models. Mastra npm packages were trojanized by Sapphire Sleet (North Korea–nexus), and multiple AI infrastructure flaws emerged: SearchLeak (CVE-2026-42824) in Microsoft 365 Copilot, Pickle in the Middle in Google Vertex AI, and vulnerabilities in LiteLLM. Ransomware gangs including Qilin, Gentlemen, and DragonForce continue dominating the threat landscape with EDR-killing tradecraft and cloud-based C2 abuse.