Major Incidents or Breaches

  • Hugging Face disclosed a breach of its production infrastructure by an autonomous AI agent, resulting in the compromise of internal datasets and service credentials [19][39].
  • Estée Lauder reported a data breach after attackers exploited a flaw in Oracle E-Business Suite used for HR operations [12].
  • Ernst & Young suffered a data breach via a third-party management platform, leading to the theft of names, addresses, Social Security numbers, credit/debit card numbers, and other sensitive information [36][40].
  • Healthcare company Abbott is investigating two cyber incidents following extortion claims by groups ShinyHunters and ShadowByt3$ involving alleged theft of large volumes of patient data, though the claims have not been independently verified [42].
  • The Ostium trading platform lost $23.75 million in cryptocurrency after an attacker compromised off-chain infrastructure responsible for price feeds [14].

Newly Discovered Vulnerabilities

  • A critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform is being actively exploited for unauthenticated code execution [2][22].
  • Two zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) in SonicWall SMA1000 devices were exploited for weeks to deploy custom malware before patches were released [13][33].
  • A new heap-based buffer overflow vulnerability (CVE-2026-14266) in 7-Zip allows attackers to execute code via crafted XZ archives during extraction [9].
  • The “WP2Shell” vulnerability (CVE-2026-63030), in combination with CVE-2026-60137, is being widely exploited for remote takeover of WordPress sites [23][31].
  • Researchers have demonstrated sandbox escapes in AI developer tools Cursor, Codex, Gemini CLI, and Antigravity, allowing malicious code execution by tricking trusted host tools [15].
  • A zero-day privilege escalation flaw in Windows “LegacyHive” has been addressed with free unofficial patches [11].
  • OpenSSL fixed a denial-of-service vulnerability (“HollowByte”) that allowed attackers to exhaust server memory via malicious payloads [34].

Notable Threat Actor Activity

  • Russian intelligence services have hijacked internet-connected security cameras across NATO states and Ukraine to monitor military logistics [7].
  • The JadePuffer autonomous AI agent has upgraded to deploy the EncForge ransomware, which targets AI assets such as training datasets and model checkpoints in Langflow environments [1][16].
  • A Russian-speaking hacker used Google Gemini CLI to control a botnet of eight dental clinic PCs, leveraging AI-driven automation [10].
  • The FakeGit campaign has established nearly 7,600 malicious GitHub repositories, with over 800 masquerading as AI-related projects to distribute SmartLoader malware [3].
  • New malware dubbed HollowGraph uses Microsoft 365 calendar events dated far in the future as a covert command-and-control channel and for exfiltrating stolen files [5][17].
  • An exposed server revealed a comprehensive AI-assisted phishing toolkit used in a WebDAV malware campaign, including lure templates, filename spoofing, and builder tools [4].
  • Attackers are combining multiple evasion tactics in BEC phishing, including fileless techniques and loaders with low detection rates to deploy RATs and stealers [26].
  • Fake games are being used to spread stealers via the Ren’Py loader, MSBuild, and EtherHiding techniques, ultimately delivering Amatera Stealer [43].
  • Scams related to the recent release of “The Odyssey” movie are distributing malware disguised as movie files and fake browser errors [41].

Trends, Tools, or Tactics of Interest

  • There is an increasing trend of threat actors targeting AI infrastructure, including the use of autonomous AI agents for attacks and ransomware targeting AI datasets and models [1][16][19][39].
  • Attackers are exploiting vulnerabilities in widely used AI developer tools and platforms, with sandbox escapes and supply chain attacks observed [15][3].
  • Use of legitimate cloud and productivity services for stealthy command-and-control, as seen in HollowGraph’s abuse of Microsoft 365 calendar features [5][17].
  • Open-source security tools powered by AI are being developed, such as Capital One’s VulnHunter, which identifies exploitable code flaws and recommends remediations [38].
  • The adoption of AI in security operations is rising, with new platforms and evaluation frameworks emerging for AI-driven SOCs [18][32][24].
  • BEC phishing campaigns are increasingly leveraging fileless malware and low-detection loaders to bypass traditional defences [26].

Regulatory or Policy Developments Affecting the Security Industry

  • The American Civil Liberties Union (ACLU) released a toolkit for attorneys in Massachusetts to uncover and challenge state surveillance technologies, including facial recognition and AI-generated police reports [28].

[1]: https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html
[2]: https://thehackernews.com/2026/07/critical-servicenow-ai-platform-flaw.html
[3]: https://thehackernews.com/2026/07/fakegit-campaign-uses-7600-github.html
[4]: https://thehackernews.com/2026/07/exposed-server-reveals-ai-assisted.html
[5]: https://thehackernews.com/2026/07/hollowgraph-malware-hides-c2-and-stolen.html
[7]: https://thehackernews.com/2026/07/russian-intelligence-hacks-ip-cameras.html
[9]: https://thehackernews.com/2026/07/new-7-zip-vulnerability-could-let.html
[10]: https://thehackernews.com/2026/07/russian-speaking-hacker-uses-google.html
[11]: https://www.bleepingcomputer.com/news/security/windows-legacyhive-zero-day-flaw-gets-free-unofficial-patches/
[12]: https://www.bleepingcomputer.com/news/security/est-e-lauder-discloses-data-breach-via-oracle-e-business-flaw/
[13]: https://www.bleepingcomputer.com/news/security/sonicwall-sma1000-flaws-exploited-as-zero-days-to-push-custom-malware/
[14]: https://www.bleepingcomputer.com/news/security/hackers-steal-237-million-in-crypto-from-ostium-in-off-chain-attack/
[15]: https://www.bleepingcomputer.com/news/security/cursor-codex-gemini-cli-antigravity-hit-by-sandbox-escapes/
[16]: https://www.bleepingcomputer.com/news/security/jadepuffer-agentic-attacks-now-target-ai-model-data-with-ransomware/
[17]: https://www.bleepingcomputer.com/news/security/new-hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2-comms/
[19]: https://www.bleepingcomputer.com/news/security/hugging-face-breach-autonomous-ai-agent-system-internal-datasets-credentials/
[22]: https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/
[23]: https://www.darkreading.com/cyberattacks-data-breaches/wp2shell-millions-wordpress-sites-remote-takeover
[26]: https://www.darkreading.com/endpoint-security/attackers-combo-evasion-tactics-bec-phishing
[28]: https://www.wired.com/story/the-aclu-is-arming-lawyers-to-expose-state-surveillance-secrets/
[31]: https://isc.sans.edu/diary/rss/33168
[33]: https://www.securityweek.com/sonicwall-zero-days-exploited-to-deliver-custom-malware-for-weeks-before-patch
[34]: https://www.securityweek.com/openssl-silently-fixes-hollowbyte-dos-vulnerability/
[36]: https://www.securityweek.com/ernst-young-data-breach-affects-personal-financial-information/
[38]: https://www.securityweek.com/capital-one-open-sources-ai-powered-vulnhunter-security-tool/
[39]: https://www.securityweek.com/hugging-face-hacked-in-autonomous-ai-attack/
[40]: https://research.checkpoint.com/2026/20th-july-threat-intelligence-report/
[41]: https://www.malwarebytes.com/blog/threat-intel/2026/07/the-odyssey-piracy-scams-appear-within-hours-of-the-movies-release
[42]: https://www.malwarebytes.com/blog/data-breaches/2026/07/healthcare-giant-abbott-probes-two-cyber-incidents-amid-extortion-claims
[43]: https://www.malwarebytes.com/blog/threat-intel/2026/07/fake-games-spread-stealers-with-renpy-loader-msbuild-and-etherhiding

Sources#

  1. Hugging Face warns an autonomous AI agent hacked its network - bleepingcomputer.com
  2. Hugging Face Hacked in Autonomous AI Attack - securityweek.com
  3. Estée Lauder discloses data breach via Oracle E-Business flaw - bleepingcomputer.com
  4. Ernst & Young Data Breach Affects Personal, Financial Information - securityweek.com
  5. 20th July – Threat Intelligence Report - research.checkpoint.com
  6. Healthcare giant Abbott probes two cyber incidents amid extortion claims - malwarebytes.com
  7. Hackers steal $23.7 million in crypto from Ostium in off-chain attack - bleepingcomputer.com
  8. Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution - thehackernews.com
  9. Critical ServiceNow code execution flaw now exploited in attacks - bleepingcomputer.com
  10. SonicWall SMA1000 flaws exploited as zero-days to push custom malware - bleepingcomputer.com
  11. SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch - securityweek.com
  12. New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction - thehackernews.com
  13. 'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover - darkreading.com
  14. WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th) - isc.sans.edu
  15. Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes - bleepingcomputer.com
  16. Windows LegacyHive zero-day flaw gets free, unofficial patches - bleepingcomputer.com
  17. OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability - securityweek.com
  18. Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine - thehackernews.com
  19. New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack - thehackernews.com
  20. JadePuffer agentic attacks now target AI model data with ransomware - bleepingcomputer.com
  21. Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs - thehackernews.com
  22. FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware - thehackernews.com
  23. HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050 - thehackernews.com
  24. New HollowGraph malware uses Microsoft Graph for stealthy C2 comms - bleepingcomputer.com
  25. Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign - thehackernews.com
  26. Attackers Combo Up Evasion Tactics for BEC Phishing - darkreading.com
  27. Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding - malwarebytes.com
  28. The Odyssey piracy scams appear within hours of the movie’s release - malwarebytes.com
  29. Capital One Open Sources AI-Powered ‘VulnHunter’ Security Tool - securityweek.com
  30. An AI SOC Evaluation Guide for Security Leaders - bleepingcomputer.com
  31. Neo Emerges From Stealth With $100M to Control and Secure Enterprise AI Software - securityweek.com
  32. Remediating Vulnerabilities With LLMs: Inside Ivanti's Automation Push - darkreading.com
  33. The ACLU Is Arming Lawyers to Expose State Surveillance Secrets - wired.com