Weekly recap: Week of 6 to 12 July 2026

Most covered

• vulnerabilities5 sources
  Max severity Adobe ColdFusion flaw now exploited in attacksSource ↗

  A critical Adobe ColdFusion vulnerability (CVE-2026-48282) is being actively exploited in the wild, according to KEVIntel. The flaw carries maximum severity rating and poses an immediate threat to organizations running affected ColdFusion instances.

• vulnerabilities3 sources
  Suspected China-Aligned Hackers Exploit Roundcube Flaws Against UniversitiesSource ↗

  A suspected China-aligned threat group is exploiting patched critical vulnerabilities in Roundcube webmail software at U.S. and Canadian university physics and engineering departments to steal credentials. The campaign leverages flaws including…

• threat intel3 sources
  UAT-7810 continues building ORB networks using new malwareSource ↗

  Cisco Talos is tracking UAT-7810, a China-nexus APT actor that builds and maintains Operational Relay Box (ORB) networks for use by secondary threat actors. UAT-7810 has developed and deployed new malware variants including LONGLEASH, DOGLEASH, JARLEASH, and…

• vulnerabilities3 sources
  CERT/CC Warns of Hidden Admin Backdoor in Tenda Router FirmwareSource ↗

  CERT/CC disclosed that multiple versions of Tenda router firmware contain an undocumented authentication backdoor allowing attackers to bypass password verification and gain administrative access to the web management interface. The vulnerability, tracked as…

• vulnerabilities2 sources
  Critical Gitea Flaw Under Active Exploitation, Researchers WarnSource ↗

  A critical vulnerability in Gitea (CVE-2026-20896) allows attackers to bypass authentication by manipulating a single HTTP header, granting access to repositories and secrets. Researchers have confirmed the flaw is under active exploitation in the wild.

• vulnerabilities
  6th July - Threat Intelligence ReportSource ↗

  A threat intelligence bulletin reports multiple significant incidents across sectors: ransomware attacks affecting financial, defense, manufacturing, and insurance organizations; artificial intelligence threats including LLM-generated ransomware, unsafe…

• vulnerabilities
  CISA Adds Two Known Exploited Vulnerabilities to CatalogSource ↗

  CISA added two file upload vulnerabilities (CVE-2026-48939 in iCagenda and CVE-2026-56291 in Balbooa Forms) to its Known Exploited Vulnerabilities Catalog based on active exploitation evidence. These vulnerabilities allow unrestricted uploads of dangerous…

• vulnerabilities
  Attackers using Langflow flaw for credential harvesting (CVE-2026-55255)Source ↗

  The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-55255 to its Known Exploited Vulnerabilities catalog after the Sysdig Threat Research Team observed active exploitation of a Langflow vulnerability. Langflow is an open-source…

• vulnerabilities
  Hitachi Energy e-mesh EMSSource ↗

  Hitachi Energy has disclosed a heap-based buffer overflow vulnerability (CVE-2026-42945) in its e-mesh EMS product versions 4.1.6, 4.4.2, and 4.7.0, caused by an NGINX module flaw. The vulnerability, with a CVSS 3.1 score of 8.1, could allow unauthenticated…

• vulnerabilities
  Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After DisclosureSource ↗

  Threat actors have begun probing a critical vulnerability in Gitea Docker images (CVE-2026-20896, CVSS 9.8) just 13 days after its disclosure. The flaw allows unauthenticated users to bypass authentication by spoofing the X-WEBAUTH-USER header, enabling…

Most active ransomware groups (leak-site claims, unverified)

Leak-site claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).

CISA KEV additions

Vulnerabilities on the move, 2026-08-10 to 2026-08-17 (the 7 days before this recap was generated)

Ransomware leak-site claims (19 of 255 shown, unverified)

• claimAldaco Avance 2022 S.L.Unverified claim. Claimed by Deadlock.
• claimWiBeats S.r.l.Unverified claim. Claimed by Deadlock.
• claimLa ville de OuanganiUnverified claim. Claimed by Deadlock.
• claimSchaad, Balass, Menzl and Partner AGUnverified claim. Claimed by Deadlock.
• claimHİDROMEKUnverified claim. Claimed by Deadlock.
• claimKEMEKUnverified claim. Claimed by Deadlock.
• claimKeNHAUnverified claim. Claimed by Deadlock.
• claimLopes LawUnverified claim. Claimed by The Gentlemen.
• claimCaritaUnverified claim. Claimed by The Gentlemen.
• claimBDO GreeceUnverified claim. Claimed by The Gentlemen.
• claimDash Door GlassUnverified claim. Claimed by The Gentlemen.
• claimFerretería ScopazzoUnverified claim. Claimed by The Gentlemen.
• claimFortrayUnverified claim. Claimed by The Gentlemen.
• claimMartin CavaUnverified claim. Claimed by The Gentlemen.
• claimAveiro Constructors LimitedUnverified claim. Claimed by The Gentlemen.
• claimCentury EquitiesUnverified claim. Claimed by Qilin.
• claimRetelit SpA PIVAUnverified claim. Claimed by Qilin.
• claimCarolina Agri-PowerUnverified claim. Claimed by Qilin.
• claimAllied Plumbing & HeatingUnverified claim. Claimed by Qilin.

Ransomware claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).

All leak-site claims and confirmed breaches