The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
Cl0p exploits PTC Windchill and FlexPLM zero-day for mass data theft (CVE-2026-12569)
Cl0p affiliates are exploiting a critical deserialization zero-day (CVSS 9.8) in internet-exposed PTC Windchill PDMLink and FlexPLM instances to gain unauthenticated remote code execution, drop JSP webshells, and exfiltrate engineering and product design data. Exploitation is believed to trace…
-
Dolphin X: Windows stealer/RAT with an AI profiler to rank victims
Varonis Threat Labs detailed a new stealer/RAT sold by an actor using the alias "Kontraktnik" that targets 300-plus applications for crypto wallets, .env files, SSH keys, cloud tokens, and DevOps credentials. Its standout feature is an "AI Profiler" that scores infected hosts by app usage…
-
AgentForger: single ChatGPT link could stand up an attacker-controlled AI insider
Zenity Labs found a flaw in OpenAI ChatGPT Workspace Agents where one crafted link could build, authorize, and deploy an autonomous agent inside a victim organization, inheriting the employee's access to Outlook, Gmail, Slack, SharePoint, and Teams. The forged agent polled an attacker inbox every…
-
Upbound Group breach turned into $13M in fraudulent Acima leases
Fintech firm Upbound Group disclosed that attackers who stole data from its systems used it to create roughly $13 million in fraudulent Acima leases. The case shows stolen data being monetized directly through the victim's own lending product, not just resold.
-
SharePoint RCE CVE-2026-50522 under active exploitation after public PoC; added to CISA KEV
A critical (CVSS 9.8) on-premises SharePoint remote code execution flaw is being actively exploited after proof-of-concept code went public. Attackers are stealing SharePoint machine keys in a single request, which gives persistent access that survives patching. CISA added CVE-2026-50522 to the…
-
Check Point patches actively exploited SmartConsole auth-bypass zero-day (CVE-2026-16232)
Check Point disclosed and patched CVE-2026-16232, a critical (CVSS 9.1) authentication bypass in SmartConsole that lets an unauthenticated attacker obtain an admin login token and take over Security Management and Multi-Domain Management servers. Exploitation is confirmed in the wild against a…
Also covered by Help Net Security
-
Healthcare ransomware exposes 245,000+ patients (Bell Ambulance, Alabama Ophthalmology Associates)
Ransomware attacks on Bell Ambulance and Alabama Ophthalmology Associates compromised protected health information for more than 245,000 patients combined. Both are the type of mid-size healthcare provider that carries HIPAA exposure and thin security staffing.
-
Sandworm sub-cluster UAC-0145 runs ClickFix fake CAPTCHAs against Ukrainian targets
CERT-UA attributed a ClickFix campaign to UAC-0145, a sub-cluster of Sandworm, the GRU-affiliated unit. Compromised websites display fake CAPTCHA checks instructing visitors to paste and run a PowerShell command, which drops a VBS file into the Startup folder; one variant is tracked as GHETTOVIBE…
-
SonicWall SMA 1000 zero-days exploited since June 22, attributed to UTA0533
Volexity attributed exploitation of CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2) to a previously undocumented actor tracked as UTA0533, active against SonicWall SMA 1000 VPN appliances since June 22, ahead of public disclosure. Chaining the two gives arbitrary command execution and…
-
Critical nginx flaw lets unauthenticated attackers overflow the worker process
F5 shipped fixes for CVE-2026-42533, a pre-auth heap buffer overflow in nginx's script engine reachable with crafted HTTP requests. The bug has been latent since March 2011, when the map directive gained regex support, and comes from a missing save/restore of PCRE capture state between nginx's two…
-
Daxin rootkit found still active on a manufacturer's network after 13 years
Symantec found the China-linked Daxin rootkit plus a previously undocumented backdoor named Stupig running on a Taiwanese manufacturer's network, with evidence the intrusion traces back to 2013. Daxin is a kernel-level implant built for stealth and long-dwell espionage, including relaying commands…
-
Abbott Laboratories investigates two cyber incidents; ShinyHunters claims Exact Sciences breach
Abbott confirmed unauthorized access to legacy Exact Sciences systems in its Cancer Diagnostics business and is separately probing a claimed breach of its LabCentral portal. ShinyHunters says it got in via a mid-June vishing attack that compromised a corporate Microsoft Entra SSO account, then…
-
WordPress "wp2shell" pre-auth RCE chain gets a public PoC (CVE-2026-63030 + CVE-2026-60137)
Two WordPress core flaws now carry CVEs and a working proof-of-concept is public on GitHub. CVE-2026-63030 is a REST API batch-route confusion and CVE-2026-60137 is a SQL injection in the authornotin parameter of WPQuery. Chained, an anonymous HTTP request reaches code execution, and because the…
-
CISA adds three actively exploited flaws to KEV: two FortiSandbox, one SharePoint
CISA added two Fortinet FortiSandbox OS command injection flaws (CVE-2026-39808 and CVE-2026-25089) and a Microsoft SharePoint deserialization flaw to the Known Exploited Vulnerabilities catalog on July 16, confirming active exploitation. CVE-2026-25089 hits on-prem, Cloud, and PaaS FortiSandbox…
-
SharePoint zero-day CVE-2026-58644 in CISA KEV; federal remediation deadline July 19
CVE-2026-58644 is a critical (CVSS 9.8) deserialization-of-untrusted-data flaw in Microsoft SharePoint Server allowing unauthenticated remote code execution, exploited as a zero-day before patches. CISA set a Federal Civilian Executive Branch fix deadline of today, July 19. Guidance is to deploy…
Also covered by Security Affairs
-
Cyber insurance coverage gaps: reading between the lines of the policy
Analysis published July 16 details how cyber policies increasingly deny or reduce payouts when insureds misrepresent controls at underwriting or cannot prove required controls were in place at incident time. Reported denial rates now run 40 percent or higher on some 2024 to 2025 claims. Carriers…
-
CISA releases batch of ICS advisories, including Rockwell Automation Logix controllers
CISA published its July 16 batch of industrial control system advisories, among them Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix (ICSA-26-197-06) and the Rockwell Flex 5000 adapter (ICSA-26-197-08), plus SALTO ProAccess Space access control and a NASA cFS…
-
ClickLock macOS stealer coerces users into surrendering their password
ClickLock is a new macOS infostealer delivered as a command pasted into Terminal (ClickFix style) behind a fake Cloudflare verification screen. If the victim resists, it kills Finder, Dock, Spotlight, Terminal, Activity Monitor, and browsers every 210 milliseconds for up to 83 hours until they…
-
Scattered Spider duo jailed over Transport for London attack in UK's largest cybercrime prosecution
Owen Flowers (18) and Thalha Jubair (20) were each sentenced to five years and six months at Woolwich Crown Court on July 16 for the 2024 vishing attack that disabled 148 TfL systems and exposed data on roughly 10 million passengers, costing about 29 million pounds to remediate. They bought…
-
Ernst & Young discloses breach of third-party IT support system exposing client tax data
EY filed breach notifications with the California Attorney General on July 15 after an unauthorized party accessed a third-party support-ticket platform used by its IT staff between March 28 and April 12, 2026, and downloaded documents tied to a number of clients. Exposed data includes client tax…
-
Microsoft's biggest Patch Tuesday ever: 570+ CVEs, two zero-days already under attack
Microsoft's July 2026 Patch Tuesday fixed a record 570 to 622 CVEs (source counts vary by methodology), roughly triple June's volume, including 416 Windows flaws and 59 rated Critical. Two vulnerabilities were already being exploited before the patch: CVE-2026-56155, an AD FS…
-
ESET flags 11 old Microsoft-signed UEFI shims that still bypass Secure Boot
ESET researcher Martin Smolár found 11 old UEFI shim bootloaders, signed by Microsoft's now-expired "Microsoft Corporation UEFI CA 2011" certificate, that can be used to bypass Secure Boot on any machine still trusting that CA, regardless of OS. Microsoft revoked the specific shim hashes on its…
-
White House launches "Gold Eagle," an AI-driven clearinghouse for coordinating vulnerability fixes across critical infrastructure
The White House, Treasury, DHS/CISA and the Department of War announced Gold Eagle, a system that consolidates vulnerability findings from government and industry, prioritizes the most consequential flaws, and coordinates remediation across critical infrastructure sectors. It builds on a June 2…
-
Siemens, Schneider Electric and Rockwell Automation post July advisories, including a CVSS 10 flaw
Siemens published nine advisories (six critical), including a CVSS 10 token-invalidation authentication bypass in OpenCenter X; other critical fixes touch Mendix, Sidis Secured SmartPlug, Simatic S7-1500, Cadra, and Desigo CC. Schneider Electric issued two advisories: a high-severity…
-
SAP patches CVSS 9.9 NetWeaver flaw that requires downtime to fix
SAP's July Patch Day included CVE-2026-44747, a memory corruption bug in NetWeaver Application Server ABAP scoring CVSS 9.9. A low-privileged attacker can send crafted requests to corrupt memory, with a path to arbitrary code execution and full system compromise. Because it's a kernel-level flaw…