Major Incidents or Breaches

  • Progress Software has instructed ShareFile customers to immediately shut down Windows Storage Zone Controllers due to a “credible external security threat” targeting these servers. The company is actively responding to the incident and has communicated directly with affected customers [5][20].
  • Researchers uncovered that a cybercrime group left one of its servers exposed, revealing details about the WP-SHELLSTORM campaign, which has backdoored thousands of WordPress sites. The exposure included hacking tools, logs, and target lists [13].
  • The Dutch National Police reported strong indications that Dutch hackers were involved in the February breach at telecommunications provider Odido [19].
  • A data breach at AssuranceAmerica has affected 7 million individuals, as disclosed in a roundup of recent incidents [33].
  • The US Department of Homeland Security (DHS) database was reportedly hacked, according to recent reports [33].

Newly Discovered Vulnerabilities

  • Zimbra has issued an urgent advisory to patch a critical vulnerability in its Classic Web Client that could allow attackers to execute arbitrary code via crafted emails. The flaw is actively being addressed and users are urged to update [4][24].
  • Six new vulnerabilities have been identified in the U-Boot bootloader, used across a wide range of hardware, which could allow malicious images to crash devices or execute code at boot, enabling stealthy firmware attacks [7][17].
  • A critical authentication bypass vulnerability is being actively exploited in the official Docker image for the Gitea self-hosted Git service. Attackers can impersonate any user, including administrators [21].
  • A flaw in Alibaba’s XQUIC (XRING) QUIC and HTTP/3 library allows any remote client to crash the server with legal traffic. There is currently no patch available [11].
  • A newly disclosed flaw called “Ill Bloom” in certain cryptocurrency wallet software’s recovery phrase generation has been exploited to drain over $5 million from wallets [16].
  • Researchers have demonstrated that a laser attack can reset passwords on Tangem wallet cards by targeting the chip, and affected cards cannot be patched [8].
  • Three now-patched vulnerabilities in the OpenClaw AI assistant allowed for credential theft, privilege escalation, and remote code execution through a WhatsApp-to-host attack chain [9].
  • Security issues in Microsoft BitLocker security wrappers have exposed ATMs and organizations to potential compromise [28].
  • Two critical vulnerabilities in Google Chrome were patched in rapid succession, prompting users to update for protection [41].

Notable Threat Actor Activity

  • An initial access broker associated with the Payouts King ransomware group is using Microsoft Teams phishing to deploy a malicious Microsoft Edge browser extension, facilitating ransomware attacks [3].
  • Hackers are exploiting the Gitea Docker image authentication bypass vulnerability to gain admin access to self-hosted Git instances [21].
  • Attackers are targeting Microsoft 365 users with vishing campaigns, using fake Microsoft Entra passkey enrollment requests and voice-based social engineering to gain access. Okta has issued a warning regarding these tactics [15][36].
  • Unknown threat actors compromised Injective Labs’ GitHub repository for its SDK project, publishing malicious npm packages designed to steal cryptocurrency wallet keys and credentials [6].
  • A China-linked group known as Silver Fox has been attributed to the new MODBEACON remote access trojan, which uses gRPC streaming for encrypted command and control traffic [10].
  • Both China and India-linked hacking groups have been documented targeting the Balochistan Police force in Pakistan over the past two years [35].
  • Researchers demonstrated “HalluSquatting,” using adversarial AI hallucinations to deliver botnet malware via popular AI assistants [38].

Trends, Tools, or Tactics of Interest

  • Cyberattacks against healthcare service providers more than doubled in the first half of 2026, with attackers increasingly targeting service providers and other healthcare businesses beyond hospitals and clinics [27].
  • GigaWiper, a new remote access Trojan, combines standalone wiper, ransomware encryption, and multi-pass wiping commands for system-level sabotage [37][39].
  • AI agents are driving rapid growth in non-human identities within organizations, complicating identity management and access visibility [23].
  • Researchers identified that many free Android VPN apps leak traffic, transmit unencrypted data, and engage in tracking, undermining user privacy and security expectations [14].
  • Comment stuffing in HTML phishing attachments is being used as a mechanism to evade AI-based detection systems [32].
  • AI coding tools are prompting debate over whether their security risks outweigh productivity gains, with concerns about scanning, remediation, and false positives [30].

Regulatory or Policy Developments Affecting the Security Industry

  • Multiple countries are increasing social media restrictions, particularly age-based account controls, though compliance by major platforms is reportedly lacking [29].
  • Adobe has increased its patch release cadence in response to growing security concerns [33].
  • The NSA has reinstated its Tailored Access Operations (TAO) unit, signaling renewed emphasis on offensive cyber capabilities [33].

Legal and Law Enforcement Actions

  • A member of the Ryuk ransomware group has pleaded guilty in the US and faces up to 15 years in prison for attacks on US companies [18].
  • A former ransomware negotiator for DigitalMint was sentenced to 70 months in prison for assisting the BlackCat (ALPHV) ransomware group [25][34].
  • A Bulgarian national has been charged with stealing $290,000 in government-seized cryptocurrency while serving a prison sentence for money laundering [22].
  • Canadian authorities have disrupted ransomware operations, as noted in a recent incident roundup [33].

Sources#

  1. URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat - thehackernews.com
  2. Progress urges ShareFile admins to shut down servers over “credible” threat - bleepingcomputer.com
  3. Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites - thehackernews.com
  4. Police suspects Dutch hackers were involved in Odido breach - bleepingcomputer.com
  5. In Other News: DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops - securityweek.com
  6. Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions - thehackernews.com
  7. Zimbra urges customers to patch critical web client XSS flaw - bleepingcomputer.com
  8. Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot - thehackernews.com
  9. New U-Boot flaws could enable stealthy firmware attacks - bleepingcomputer.com
  10. Hackers exploit critical auth bypass in Gitea Docker image - bleepingcomputer.com
  11. Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers - thehackernews.com
  12. Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets - thehackernews.com
  13. Laser Attack Resets Tangem Wallet Passwords on Cards That Can't Be Patched - thehackernews.com
  14. Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws - thehackernews.com
  15. Fresh ATM Crypto Software Bugs: Jackpot or Bust? - darkreading.com
  16. Two Chrome updates in two days fix critical vulnerabilities - malwarebytes.com
  17. Threat Actor Uses Phishing to Breach Orgs for Ransomware Gangs - blog.knowbe4.com
  18. Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access - thehackernews.com
  19. Okta Warns of Vishing Attacks Targeting Microsoft 365 Customers - securityweek.com
  20. Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages - thehackernews.com
  21. New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic - thehackernews.com
  22. China, India-Linked Hackers Both Targeted Same Pakistani Police Force - securityweek.com
  23. ‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism - securityweek.com
  24. Cybercriminals Flock to Healthcare Businesses as Attacks Surge - darkreading.com
  25. GigaWiper Combines Multiple Malware for System-Level Sabotage - securityweek.com
  26. This new Windows malware can take over your PC and wipe it clean - malwarebytes.com
  27. The Replicant in Your Directory: AI Agents and the Identity Security Gap - bleepingcomputer.com
  28. Study of 281 Free Android VPN Apps Finds Traffic Leaks, Unencrypted Data, and Tracking - thehackernews.com
  29. "Comment stuffing" in an HTML phishing attachment as a mechanism for evading AI-based detection?, (Fri, Jul 10th) - isc.sans.edu
  30. AI Coding: Do Security Risks Outweigh Productivity Gains? - darkreading.com
  31. More Countries Jump on the Social Media 'Ban Wagon' - darkreading.com
  32. Ryuk ransomware member pleads guilty in the US, faces 15 years in prison - bleepingcomputer.com
  33. Former ransomware negotiator gets 4 years for BlackCat attacks - bleepingcomputer.com
  34. Third US Security Expert Sentenced to Prison for Helping Ransomware Gang - securityweek.com
  35. Money launderer accused of stealing seized crypto while in prison - bleepingcomputer.com