Weekly recap: Week of 13 to 19 July 2026
Review the week's tracked stories, vulnerability changes, and unverified leak-site claims for the dates shown.
197 qualifying stories tracked; change from the prior 7 days: -38 vs prior period; 10 Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) entries added; 202 leak-site claims observed by tracked feeds
Monday to Sunday, Coordinated Universal Time (UTC). Permalink label: 2026-W29.
The 197 stories above are counted by publisher date (first-seen date where it is missing or unusable), and only for stories that have a summary and a why-it-matters line and are not thin or editorially excluded.
Most covered
- vulnerabilities8 sourcesSonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)Source ↗
SonicWall has released patches for two actively exploited zero-day vulnerabilities in its Secure Mobile Access (SMA) 1000 Series appliances. The company recommends affected organizations upgrade firmware, search for indicators of compromise, and if found…
- threat intel3 sourcesOfficials once again warn defenders that Russian hackers are targeting network devicesSource ↗
Russian FSB Center 16 (tracked under multiple names including Berserk Bear and Dragonfly) has conducted sustained targeting of critical infrastructure globally by exploiting poorly configured and outdated networking devices, particularly Cisco routers with…
- vulnerabilities2 sourcesCISA Urges SharePoint Hardening After New ExploitationsSource ↗
CISA has confirmed active exploitation of three SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164) affecting all supported on-premises versions, with attackers achieving remote code execution and stealing credentials for…
- vulnerabilities2 sourcesCVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server VulnerabilitiesSource ↗
CISA confirmed active exploitation of three Microsoft SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) affecting on-premises deployments across all supported versions. Two additional high-severity flaws (CVE-2026-55040 and…
- vulnerabilities2 sourcesNew wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run CodeSource ↗
A critical vulnerability in WordPress core versions 6.9 and 7.0 allowed unauthenticated attackers to execute arbitrary code on unpatched installations. WordPress released patches (6.9.5 and 7.0.2) on Friday and deployed forced updates through its auto-update…
- vulnerabilities2 sourcesTwo new high severity WordPress vulnerabilities, patch immediately!Source ↗
WordPress released version 7.0.2 to address one critical and one high severity vulnerability. The issues include CVE-2026-60137, a facilitated SQL injection flaw, and a separate REST API batch-route confusion vulnerability leading to remote code execution…
- vulnerabilities2 sourcesiCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-DaysSource ↗
The Cybersecurity and Infrastructure Security Agency (CISA) added two maximum-severity flaws affecting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities catalog after reports of active exploitation in the wild. Both…
- vulnerabilitiesProxying to Compromise: SonicWall Secure Mobile Access 0-day ExploitationSource ↗
In early July 2026, incident responders at Volexity discovered that threat actor UTA0533 had exploited multiple zero-day vulnerabilities in SonicWall Secure Mobile Access VPN appliances, including a server-side request forgery (SSRF) flaw and command…
- vulnerabilities13th July - Threat Intelligence ReportSource ↗
A weekly threat intelligence bulletin covering significant incidents from July 13 including data breaches at AssuranceAmerica (7 million people), Latvijas Valsts Meži (ransomware exploiting two-year-old vulnerability), Injective Labs (supply chain compromise…
- vulnerabilitiesABB Ability EdgeniusSource ↗
ABB has released an advisory for CVE-2026-31431, a Linux kernel vulnerability affecting ABB Ability Edgenius versions 3.2.0.0 through 3.2.4.0 installed on multiple gateway and server models. The flaw allows locally authenticated users or compromised container…
Most active ransomware groups (leak-site claims, unverified)
| Qilin | 34 claims | +3 vs prior week |
|---|---|---|
| Dragonforce | 29 claims | +22 vs prior week |
| The Gentlemen | 26 claims | -13 vs prior week |
| INC Ransom | 12 claims | +9 vs prior week |
| Nova | 7 claims | +6 vs prior week |
| Akira | 6 claims | 0 vs prior week |
| Arcus Media | 6 claims | +5 vs prior week |
| Arcusmedia | 6 claims | +6 vs prior week |
| KryBit | 5 claims | +2 vs prior week |
| Play | 5 claims | +2 vs prior week |
Leak-site claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).
CISA KEV additions
| CVE | Vendor and product | Federal fix deadline |
|---|---|---|
| CVE-2026-15409 | SonicWall SMA1000 Appliances | |
| CVE-2026-15410 | SonicWall SMA1000 Appliances | |
| CVE-2026-58644 | Microsoft SharePoint | |
| CVE-2026-39808 | Fortinet FortiSandbox | |
| CVE-2026-25089 | Fortinet FortiSandbox | |
| CVE-2026-46817 | Oracle E-Business Suite | |
| CVE-2026-56155 | Microsoft Active Directory Federation Services | |
| CVE-2026-56164 | Microsoft SharePoint Server | |
| CVE-2008-4128 | Cisco IOS | |
| CVE-2023-4346 | KNX Association KNX Protocol Connection Authorization Option 1 |
Vulnerabilities on the move, to (the 7 days before this recap was generated)
| CVE | Vendor and product | What changed |
|---|---|---|
| CVE-2026-15409 | SonicWall SMA1000 Appliances | Added to CISA KEV 2026-07-14Added to VulnCheck KEV 2026-07-14Added to ENISA EUVD 2026-07-14Exploitation active since 2026-07-14 |
| CVE-2026-15410 | SonicWall SMA1000 Appliances | Added to CISA KEV 2026-07-14Added to VulnCheck KEV 2026-07-14Added to ENISA EUVD 2026-07-14Exploitation active since 2026-07-14 |
| CVE-2025-33073 | Microsoft Windows | EPSS up 14 points in about a week |
| CVE-2026-8037 | Progress LoadMaster | EPSS up 14 points in about a week |
| CVE-2026-50522 | Microsoft SharePoint | Added to VulnCheck KEV 2026-07-20 |
Ransomware leak-site claims (19 of 202 shown, unverified)
- claimAssociated Theatrical ContractorsUnverified claim. Claimed by Qilin.
- claimDon Tortaco Mexican GrillUnverified claim. Claimed by Qilin.
- claimCity Ambulance ServiceUnverified claim. Claimed by Qilin.
- claimFamesaUnverified claim. Claimed by Qilin.
- claimPP+KUnverified claim. Claimed by Qilin.
- claimEanaUnverified claim. Claimed by Qilin.
- claimSynergy ProductsUnverified claim. Claimed by Qilin.
- claimThe Nueva SchoolUnverified claim. Claimed by Qilin.
- claimNewNetUnverified claim. Claimed by Dragonforce.
- claimKee Wah BakeryUnverified claim. Claimed by Dragonforce.
- claimPetrini ValoresUnverified claim. Claimed by Dragonforce.
- claimSinai Grand CasinoUnverified claim. Claimed by Dragonforce.
- claimSouthport Outdoor LivingUnverified claim. Claimed by Dragonforce.
- claimMetro Design CenteUnverified claim. Claimed by Dragonforce.
- claimNorth Atlantic Engineering ConsultantsUnverified claim. Claimed by Dragonforce.
- claimHeritage Mechanical LLCUnverified claim. Claimed by Dragonforce.
- claimEcopetrolUnverified claim. Claimed by The Gentlemen.
- claimSunway ScientificUnverified claim. Claimed by The Gentlemen.
- claimMilitary Sealift CommandUnverified claim. Claimed by The Gentlemen.
Ransomware claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).