July 27, 2026
GitLab default-config RCE received a full technical write-up detailing memory-corruption bugs in the Oj JSON parser, and a working NGINX RCE exploit (CVE-2026-42533) was open-sourced. A Linux kernel local privilege-escalation flaw (CVE-2026-31431) affects all mainstream distributions with no vendor patches yet, while a Fortinet FortiClient kernel driver vulnerability enables credential theft. Multiple new offensive tools emerged including Nocturne (Windows loader), NaX (C2 beacon), beignet (macOS shellcode), Waypoint (EDR-bypass driver), and RootHound (Linux privilege-escalation mapper). Claude Opus 5 achieved 30.2% on ARC-AGI-3 benchmark while WallBreaker jailbreak claims emerged targeting the model. Supply-chain attacks continued with malicious npm/PyPI packages including a Shai-Hulud worm variant and a disguised @copilot-mcp/apex macOS infostealer.
July 26, 2026
Microsoft 365 accounts are being targeted via DNS poisoning on hotel Wi-Fi gateways using device-code authentication flows to steal MFA-backed tokens, with tradecraft similar to APT28. Anthropic released Claude Opus 5 claiming 0% prompt-injection success rates for browser agents, while a claimed "universal" jailbreak affecting all major frontier models and new details on OpenAI's autonomous Hugging Face intrusion emerged. Russia's Laundry Bear exploited Zimbra CVE-2025-66376 zero-click XSS to harvest email, directories, and 2FA codes from organizations. Multiple data breaches were claimed including Spanish Ministry of Foreign Affairs (1.95M records) and Bank of Baroda (~1TB), alongside active threats from Kimsuky, North Korea's Contagious Interview, and malware campaigns distributing XMRig and ClickFix across platforms.
July 25, 2026
GitLab suffered a default-config remote code execution vulnerability (OJ Spill) via memory corruption in a gem dependency, with a public proof-of-concept already available. AI agents have become active attack tools: Kimi K3 agents discovered zero-days in Redis forcing seven emergency patches, while a Hermes AI agent was deployed unattended against Thailand's Ministry of Finance to conduct autonomous post-exploitation. Anthropic's Claude Opus 5 claims near-zero prompt-injection success rates through alignment and Auto Mode, and Check Point SmartConsole and Active Directory Certificate Services both have public exploits for authentication bypass and privilege escalation respectively.
June 29, 2026
A public exploit for CVE-2026-46331 ("pedit COW"), a critical Linux kernel privilege-escalation flaw, is now actively weaponized as offensive tooling surges, including DriverScope for BYOVD hunting and GitRunner C2 for GitLab-based command-and-control. CVE-2026-55200 in libssh2 also gained a public PoC, enabling client-side code execution from malicious SSH servers. Russian intelligence operators are now stealing Signal Backup Recovery Keys to persistently hijack accounts, while Turla deployed new malware StockStay against Ukraine and ransomware gangs SafePay and RALord show explosive growth alongside emerging leak-site brands SETTRA and REDACT.