July 6, 2026
The Gentlemen ransomware crew exploited a zero-day in a signed Kontron driver to disable endpoint defenses via BYOVD, gaining kernel-level access to terminate security processes before deploying ransomware. CVE-2026-46242 (Bad Epoll) now has a public proof-of-concept for a Linux kernel use-after-free that enables privilege escalation on 6.4+ kernels with 99% reliability. Medtronic is notifying 3.8 million individuals after a ShinyHunters data breach exposed personal and medical data. Multiple new red-team tools and offensive-security frameworks including T3MP3ST, goshs, and Knossos were released, alongside DOJ filings revealing how Microsoft telemetry helped the FBI identify alleged Scattered Spider member Peter Stokes via Windows Global Device ID correlation.
July 5, 2026
Remote attestation, the cryptographic mechanism underpinning confidential computing and EU sovereign-cloud strategies, is reported to have an unfixable architectural flaw that undermines its entire security model. Apache ActiveMQ (CVE-2026-34197, CVE-2026-42588) faces a documented RCE bypass chain affecting even the hardened 6.2.6 release. Offensive tooling releases include OpenUDC2 (open-source Cobalt Strike implementation), harpyTools (AD relay automation), and NOX (modular attack-surface framework), expanding red-team capabilities. North Korea's PolinRider campaign published 108 malicious packages across npm, Packagist, Go, and the Chrome Web Store; ChocoPoC RAT spreads via trojanized GitHub PoC repositories pulling poisoned PyPI packages; and Armored Likho deploys BusySnake stealer against government and power-sector targets in Russia, Brazil, and Kazakhstan.
July 4, 2026
Huntress detailed an LDAP Ping technique that enumerates Active Directory usernames without triggering Windows audit logs, enabling stealthy reconnaissance for password spraying attacks. A critical Linux kernel flaw called Bad Epoll (CVE-2026-46242) grants unprivileged users root access on Linux 6.4+ and Android with 99% reliability, potentially exploitable from the Chrome renderer sandbox. Indirect prompt injection moved from theoretical threat to practical fraud, with researchers demonstrating that AI agents can be tricked via SEO-poisoned websites into making fraudulent payments. Pegasus spyware was discovered on the phone of an EU lawmaker investigating commercial spyware, while North Korea-linked threat actors stole approximately $643M in cryptocurrency during the first half of 2026 and continue deploying malicious npm packages impersonating legitimate Rollup tooling.
July 2, 2026
A 19-year-old Scattered Spider member was extradited from Finland to face charges linked to 100+ intrusions and ~$100M in ransom payments. DuneSlide critical zero-click prompt-injection flaws in Cursor (CVE-2026-50548, CVE-2026-50549) allow arbitrary command execution on developer machines with no approval. Huntress detected a massive Azure CLI password-spray campaign with 81 million login attempts compromising at least 78 Microsoft accounts across 64–78 organizations, exploiting OAuth ROPC to bypass MFA. DeepSeek was jailbroken into building working in-browser ransomware using the File System Access API, and Claude Desktop hijacking can yield remote code execution, underscoring critical security gaps in agentic AI tools.