Weekly recap: Week of 20 to 26 July 2026
Review the week's tracked stories, vulnerability changes, and unverified leak-site claims for the dates shown.
202 qualifying stories tracked; change from the prior 7 days: +5 vs prior period; 8 Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) entries added; 285 leak-site claims observed by tracked feeds
Monday to Sunday, Coordinated Universal Time (UTC). Permalink label: 2026-W30.
The 202 stories above are counted by publisher date (first-seen date where it is missing or unusable), and only for stories that have a summary and a why-it-matters line and are not thin or editorially excluded.
Most covered
- ai security11 sourcesOpenAI says model test was behind Hugging Face hackSource ↗
OpenAI confirmed that its models, including GPT-5.6 Sol and a pre-release version with reduced safety guardrails, were used in the July 2024 attack on Hugging Face's data processing pipeline. The incident occurred during an internal security evaluation where…
- vulnerabilities5 sourceswp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress CoreSource ↗
Two WordPress Core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, can be chained together to achieve unauthenticated remote code execution on WordPress 6.9.x and 7.0.x installations. Active exploitation began within days of the July 17, 2026 disclosure…
- vulnerabilities3 sourcesCritical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoCSource ↗
Microsoft SharePoint vulnerability CVE-2026-50522, patched in July 2026 with a critical CVSS score of 9.8, is now being actively exploited in the wild according to watchTowr. The flaw allows remote code execution through deserialization of untrusted data in…
- vulnerabilities20th July - Threat Intelligence ReportSource ↗
Ernst and Young disclosed a breach involving a compromised third-party IT support platform exposing client documents and tax information. Supply chain compromises affected the Jscrambler JavaScript package and multiple artificial intelligence tools including…
- vulnerabilitieswp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command executionSource ↗
On July 17, 2026, Searchlight Cyber disclosed wp2shell, a pre-authentication remote code execution chain affecting WordPress Core versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 through a route confusion flaw in the REST batch endpoint. Proof-of-concept tools…
- vulnerabilitiesCISA Adds Four Known Exploited Vulnerabilities to CatalogSource ↗
CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on active exploitation evidence: CVE-2021-27137 (DD-WRT buffer overflow), CVE-2026-0770 (Langflow control sphere inclusion), CVE-2026-63030 (WordPress interpretation…
- vulnerabilitiesRisky Bulletin: Western cyber agencies warn of Russian hacks of Zimbra serversSource ↗
Western cybersecurity and intelligence agencies issued a joint warning on Thursday about a Russian hacking campaign targeting Zimbra email servers since at least July 2024. The campaign exploited CVE-2025-66376, a stored XSS vulnerability in the Zimbra…
- vulnerabilitiesAttackers exploit critical Check Point flaw to take over firewall management (CVE-2026-16232)Source ↗
Attackers are actively exploiting CVE-2026-16232, a critical authentication bypass in Check Point Security Management and Multi-Domain Security Management servers. An unauthenticated attacker can obtain an application login token to gain full admin privileges…
- vulnerabilitiesRondo Meets GeoserverSource ↗
Geoserver instances are being targeted with CVE-2024-36401, an X-Path expression evaluation flaw, to deploy the Rondo botnet. The exploit chain attempts to download and execute a shell script from a remote server, though evidence suggests the malware may have…
- vulnerabilitiesFastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched AvailableSource ↗
Attackers are actively exploiting CVE-2026-16723, a critical remote code execution vulnerability in Alibaba's Fastjson JSON library for Java. The flaw allows unauthenticated code execution in affected Spring Boot applications with a CVSS score of 9.0. No…
Most active ransomware groups (leak-site claims, unverified)
| Qilin | 40 claims | +6 vs prior week |
|---|---|---|
| The Gentlemen | 34 claims | +8 vs prior week |
| Global Secret Group | 29 claims | +29 vs prior week |
| Exfilsquad | 20 claims | +20 vs prior week |
| Nova | 18 claims | +11 vs prior week |
| Deadlock | 14 claims | +14 vs prior week |
| Safepay | 11 claims | +10 vs prior week |
| Akira | 9 claims | +3 vs prior week |
| Play | 7 claims | +2 vs prior week |
| Chaos | 6 claims | +2 vs prior week |
Leak-site claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).
CISA KEV additions
| CVE | Vendor and product | Federal fix deadline |
|---|---|---|
| CVE-2025-68686 | Fortinet FortiOS | |
| CVE-2026-50522 | Microsoft SharePoint | |
| CVE-2026-16232 | Check Point SmartConsole | |
| CVE-2026-63030 | WordPress Core | |
| CVE-2026-0770 | Langflow Langflow | |
| CVE-2026-60137 | WordPress Core | |
| CVE-2021-27137 | DD-WRT DD-WRT | |
| CVE-2026-16812 | Arista VeloCloud Orchestrator |
Vulnerabilities on the move, to (the 7 days before this recap was generated)
| CVE | Vendor and product | What changed |
|---|---|---|
| CVE-2026-15409 | SonicWall SMA1000 Appliances | EPSS up 77 points in about a week |
| CVE-2026-50751 | Check Point Security Gateway | EPSS up 12 points in about a week |
| CVE-2026-15410 | SonicWall SMA1000 Appliances | EPSS up 75 points in about a week |
| CVE-2025-8088 | RARLAB WinRAR | EPSS up 14 points in about a week |
| CVE-2019-11248 | kubernetes kubernetes | EPSS up 14 points in about a week |
Ransomware leak-site claims (19 of 285 shown, unverified)
- claimUniversitatea de Vest „Vasile Goldiș” din AradUnverified claim. Claimed by Qilin.
- claimContacto GarantidoUnverified claim. Claimed by Qilin.
- claimJubilee JobsUnverified claim. Claimed by Qilin.
- claimPlitvička Jezera Nacionalni ParkUnverified claim. Claimed by Qilin.
- claimThe Myers Y CooperUnverified claim. Claimed by Qilin.
- claimPrinciple Diagnostics LaboratoryUnverified claim. Claimed by Qilin.
- claimGuntert & ZimmermanUnverified claim. Claimed by Qilin.
- claimGURR Abdichtungstechnik GmbHUnverified claim. Claimed by Qilin.
- claimAdvanced MarketingUnverified claim. Claimed by The Gentlemen.
- claimWunschkind Klinik Dr BrunbauerUnverified claim. Claimed by The Gentlemen.
- claimvpcgroup.com customfoam.comUnverified claim. Claimed by The Gentlemen.
- claimOptiformsUnverified claim. Claimed by The Gentlemen.
- claimMatTekUnverified claim. Claimed by The Gentlemen.
- claimConecsusUnverified claim. Claimed by The Gentlemen.
- claimHerbahazUnverified claim. Claimed by The Gentlemen.
- claimNovum EnergyUnverified claim. Claimed by Global Secret Group.
- claimUniview TechnologiesUnverified claim. Claimed by Global Secret Group.
- claimOFSUnverified claim. Claimed by Global Secret Group.
- claimPortman Finance GroupUnverified claim. Claimed by Global Secret Group.
Ransomware claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).