July 21, 2026
HOLLOWGRAPH malware exploits Microsoft 365 calendars as a covert command-and-control channel, using the Microsoft Graph API to evade detection while exfiltrating stolen data. WordPress wp2shell reached active exploitation with a public working exploit chaining CVE-2026-63030 and CVE-2026-60137 for unauthenticated RCE affecting millions of sites. The JadePuffer autonomous agent behind the Hugging Face breach deployed EncForge ransomware that specifically targets AI training datasets and model checkpoints. Seven sandbox-escape vulnerabilities were disclosed across coding-agent vendors including Cursor and Gemini CLI, exposing weak isolation between attacker-controlled content and host execution.
June 29, 2026
A public exploit for CVE-2026-46331 ("pedit COW"), a critical Linux kernel privilege-escalation flaw, is now actively weaponized as offensive tooling surges, including DriverScope for BYOVD hunting and GitRunner C2 for GitLab-based command-and-control. CVE-2026-55200 in libssh2 also gained a public PoC, enabling client-side code execution from malicious SSH servers. Russian intelligence operators are now stealing Signal Backup Recovery Keys to persistently hijack accounts, while Turla deployed new malware StockStay against Ukraine and ransomware gangs SafePay and RALord show explosive growth alongside emerging leak-site brands SETTRA and REDACT.
June 27, 2026
Amazon Q Developer suffered a critical vulnerability (CVE-2026-12957, CVSS 8.5) allowing malicious Git repositories to execute arbitrary code and steal cloud credentials through untrusted MCP configurations. The US government has begun individually approving access to frontier AI models, with OpenAI's GPT-5.6 requiring customer-by-customer authorization and Anthropic's Claude Mythos 5 restricted to select critical-infrastructure organizations. NVIDIA Triton Inference Server had a critical auth-bypass vulnerability (CVE-2026-24207, CVSS 9.8) with public exploits enabling pre-auth RCE. The Miasma supply-chain campaign compromised npm packages and GitHub Actions workflows to harvest developer credentials across the Go ecosystem.