Weekly recap: Week of 27 July to 2 August 2026
Review the week's tracked stories, vulnerability changes, and unverified leak-site claims for the dates shown.
227 qualifying stories tracked; change from the prior 7 days: +25 vs prior period; 4 Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) entries added; 315 leak-site claims observed by tracked feeds
Monday to Sunday, Coordinated Universal Time (UTC). Permalink label: 2026-W31.
The 227 stories above are counted by publisher date (first-seen date where it is missing or unusable), and only for stories that have a summary and a why-it-matters line and are not thin or editorially excluded.
Most covered
- ot ics5 sourcesCoordinated cyberattack hits more than 30 Minnesota water utilitiesSource ↗
A coordinated cyberattack targeted operational technology systems at more than 30 Minnesota water utilities on July 26 and 27. Minnesota IT Services confirmed the incident on July 28 and activated its incident response capabilities to contain the threat…
- vulnerabilities3 sourcesCVE-2026-63077: Critical unauthenticated remote code execution in JetBrains TeamCitySource ↗
JetBrains disclosed CVE-2026-63077, a critical unauthenticated remote code execution vulnerability in TeamCity On-Premises with a CVSS score of 9.8, affecting all versions. Attackers exploiting the deserialization flaw via the agent polling protocol can…
- vulnerabilities2 sourcesCheck Point SmartConsole Authentication Bypass Technical Analysis (CVE-2026-16232)Source ↗
Check Point released a security advisory on July 22, 2026 for CVE-2026-16232, an authentication bypass in SmartConsole that allows unauthenticated attackers to obtain administrator tokens and modify security policies on affected Security Management and…
- vulnerabilities2 sourcesCritical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging InSource ↗
JetBrains disclosed a critical vulnerability in TeamCity on-premises (CVE-2026-63077, CVSS 9.8) that permits unauthenticated arbitrary code execution. The flaw has been patched in versions 2025.11.7 and 2026.1.3, while TeamCity Cloud instances are unaffected.
- vulnerabilities2 sourcesThree Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM EscapeSource ↗
Broadcom released security updates for VMware ESX, vCenter, Workstation, and Fusion to address multiple flaws, including three rated critical. CVE-2026-59309, a critical authentication bypass in vCenter with a CVSS score of 9.8, allows network-accessible…
- vulnerabilities2 sourcesCritical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image UploadsSource ↗
Ruby on Rails released patches for a critical Active Storage vulnerability (CVE-2026-66066, CVSS 9.5) that allows unauthenticated attackers to read arbitrary server files through specially crafted image uploads. The flaw could expose sensitive data including…
- vulnerabilitiesCISA Adds Two Known Exploited Vulnerabilities to CatalogSource ↗
CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog: CVE-2025-68686 in Fortinet FortiOS and CVE-2026-16812 in Arista VeloCloud Orchestrator, both showing active exploitation in the wild. The additions underscore CISA's continued…
- vulnerabilities27th July - Threat Intelligence ReportSource ↗
A weekly threat intelligence bulletin covers major incidents including ransomware attacks on Nichirei (Japan) and Stadler Rail (Switzerland), unauthorized access at Origin Energy (Australia), and a cyberattack on Romania's land registry system. The report…
- vulnerabilitiesRisky Bulletin: A JSON RCE bug is about to rock the Java worldSource ↗
Threat actors are actively exploiting CVE-2026-16723, a remote code execution vulnerability in Alibaba's Fastjson library, a widely used JSON processing tool in Java applications. Exploitation began after security details were disclosed by FearsOff and…
- vulnerabilitiesAdobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User InteractionSource ↗
Adobe released security updates for Campaign Classic addressing CVE-2026-48449, a CVSS 10.0 vulnerability involving incorrect authorization that enables arbitrary code execution without user interaction. The flaw affects the enterprise marketing automation…
Most active ransomware groups (leak-site claims, unverified)
| The Gentlemen | 54 claims | +20 vs prior week |
|---|---|---|
| Qilin | 37 claims | -3 vs prior week |
| Crpxo | 31 claims | +31 vs prior week |
| Everest | 21 claims | +21 vs prior week |
| Booba Team | 16 claims | +16 vs prior week |
| INC Ransom | 13 claims | +9 vs prior week |
| Nightspire | 12 claims | +11 vs prior week |
| Genesis | 11 claims | +5 vs prior week |
| LockBit | 9 claims | +9 vs prior week |
| Safepay | 9 claims | -2 vs prior week |
Leak-site claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).
CISA KEV additions
| CVE | Vendor and product | Federal fix deadline |
|---|---|---|
| CVE-2025-68686 | Fortinet FortiOS | |
| CVE-2026-18577 | N-able N-central | |
| CVE-2026-16812 | Arista VeloCloud Orchestrator | |
| CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) |
Vulnerabilities on the move, to (the 7 days before this recap was generated)
| CVE | Vendor and product | What changed |
|---|---|---|
| CVE-2026-12569 | PTC Windchill and FlexPLM | EPSS up 28 points in about a week |
| CVE-2023-3824 | PHP PHP | EPSS up 13 points in about a week |
| CVE-2025-68686 | Fortinet FortiOS | Added to CISA KEV 2026-07-27Added to VulnCheck KEV 2026-07-27Added to ENISA EUVD 2026-07-27 |
| CVE-2026-50522 | Microsoft SharePoint | EPSS up 19 points in about a week |
| CVE-2026-16232 | Check Point SmartConsole | EPSS up 59 points in about a week |
Ransomware leak-site claims (20 of 315 shown, unverified)
- claimPhilippine Savings BankUnverified claim. Claimed by The Gentlemen.
- claimWorld Wide FittingsUnverified claim. Claimed by The Gentlemen.
- claimChemco SystemsUnverified claim. Claimed by The Gentlemen.
- claimTotal Auto Business SolutionsUnverified claim. Claimed by The Gentlemen.
- claimOkovolt SolartechnikUnverified claim. Claimed by The Gentlemen.
- claimAmicellUnverified claim. Claimed by The Gentlemen.
- claimPaula FishUnverified claim. Claimed by The Gentlemen.
- claimKnownUnverified claim. Claimed by The Gentlemen.
- claimINTERTRUST AUSTRALIA PTY LTDUnverified claim. Claimed by Qilin.
- claimAsset Flooring Group AustraliaUnverified claim. Claimed by Qilin.
- claimMairie de DrancyUnverified claim. Claimed by Qilin.
- claimThe Saturday Evening PostUnverified claim. Claimed by Qilin.
- claimCommercial Furniture InteriorsUnverified claim. Claimed by Qilin.
- claimDienst Pack SystemsUnverified claim. Claimed by Qilin.
- claimCeragresUnverified claim. Claimed by Qilin.
- claimPointe Property GroupUnverified claim. Claimed by Qilin.
- claimEncore Enterprises, Inc.Unverified claim. Claimed by Crpxo.
- claimKUVEYT TURKUnverified claim. Claimed by Crpxo.
- claimFINANSBANKUnverified claim. Claimed by Crpxo.
- claimANADOLUBANKUnverified claim. Claimed by Crpxo.
Ransomware claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).