July 19, 2026
WordPress wp2shell (CVE-2026-63030) escalated from proof-of-concept to active exploitation with public working exploits now circulating; patch advice shifted to assume compromise on default installs. Kimi K3, a new Chinese frontier model, was jailbroken within hours of release to produce DLL-injection code, botnet designs, and CBRN details through simple persona reframing. Scattered Spider members Thalha Jubair and Owen Flowers received 5.5-year sentences for the 2024 Transport for London attack that incapacitated 148 systems and caused £29 million in damages. Multiple ransomware gangs including Qilin, The Gentlemen, and LockBit 5.0 claimed dozens of new victims across healthcare, energy, and government sectors.
July 12, 2026
Android 17 users face a public browser-to-kernel exploit chain combining Firefox JIT RCE (CVE-2026-10702) with kernel exploits for full device compromise. U-Boot firmware has six critical signature-verification flaws affecting 50+ stable releases and embedded devices worldwide, enabling arbitrary code execution and root-of-trust bypass. AI coding agents are now targets: Ghostcommit hides prompt-injection payloads in PNG images to steal environment secrets, while HalluSquatting weaponizes AI model hallucinations to register fake package names and deliver botnets to trusting developers. The jscrambler npm package was compromised with a Rust infostealer that executes on installation across Windows, macOS, and Linux.
July 11, 2026
Progress Software is urging ShareFile customers to physically power down Storage Zone Controllers due to active zero-day exploitation tracked by watchTowr. Gitea Docker images are under active exploitation via a critical authentication bypass allowing attacker impersonation. CVE-2026-47291 in Windows HTTP.sys enables kernel code execution through TLS header parsing flaws, and CVE-2026-31431 ("Copy Fail") is a Linux kernel privilege escalation affecting all major distributions since 2017 with no fixed kernels shipped yet. Okta warns of vishing attacks enrolling rogue Entra ID passkeys to hijack Microsoft 365 accounts, while GigaWiper is a modular Golang backdoor bundling wiper, ransomware, and persistence functionality. Qilin leads 2026 ransomware volume with 708 tracked attacks, and Anthropic published the Jacobian lens, an interpretability technique revealing how Claude internally reasons through concepts.
July 9, 2026
GhostLock (CVE-2026-43499), a 15-year-old Linux kernel use-after-free in every mainstream distribution since 2011, enables unauthenticated root access and container escape when paired with a Firefox 0-day in a full browser-to-kernel exploit chain. GhostApproval symlink flaws in six AI coding assistants (Amazon Q Developer, Claude Code, Cursor, Google Antigravity, Windsurf, Augment) allow booby-trapped repositories to redirect file writes and achieve RCE via misleading confirmation dialogs. CISA added actively-exploited Adobe ColdFusion (CVE-2026-48282) and Langflow auth-bypass flaws to its KEV catalog, with the Langflow issue matching the JADEPUFFER operator's exploitation from the prior week. AI agents are lowering the barrier for less-skilled attackers: hallucination-squatting registers fake package names that models invent, delivering malware to developers, while researchers demonstrate that agents scanning untrusted code for bugs can instead execute the attacker's payload on the analyst's machine.
July 6, 2026
The Gentlemen ransomware crew exploited a zero-day in a signed Kontron driver to disable endpoint defenses via BYOVD, gaining kernel-level access to terminate security processes before deploying ransomware. CVE-2026-46242 (Bad Epoll) now has a public proof-of-concept for a Linux kernel use-after-free that enables privilege escalation on 6.4+ kernels with 99% reliability. Medtronic is notifying 3.8 million individuals after a ShinyHunters data breach exposed personal and medical data. Multiple new red-team tools and offensive-security frameworks including T3MP3ST, goshs, and Knossos were released, alongside DOJ filings revealing how Microsoft telemetry helped the FBI identify alleged Scattered Spider member Peter Stokes via Windows Global Device ID correlation.
June 30, 2026
watchTowr published a critical pre-auth RCE exploit for Progress Kemp LoadMaster (CVE-2026-8037), a network-edge appliance commonly fronting enterprise services. Oracle E-Business Suite (CVE-2026-46817) and SimpleHelp (CVE-2026-48558) vulnerabilities are being actively exploited in the wild; the latter drops Djinn Stealer, a new cross-platform infostealer targeting cloud and AI credentials. Microsoft removed 119 malicious Edge extensions in the StegoAd campaign (2.6M installs) that used steganography to hide credential-stealing and ad-fraud payloads, while Mustang Panda exploits Zoho WorkDrive against Indian government targets and ShinyHunters breaches Oracle PeopleSoft systems affecting NAIC and Nissan. Coinbase and other major tech companies are shifting internal AI workloads to Chinese open-weight models (GLM 5.2, Kimi 2.7, DeepSeek V4) to reduce costs, raising supply-chain and data-leakage concerns.