Tuesday 28 July 2026

Major Incidents or Breaches

• The Coca-Cola Company confirmed data theft from its Fairlife dairy subsidiary following a ransomware attack earlier this month. The Anubis cybercrime group has claimed responsibility and is threatening to leak the stolen data ^[18][40].
• Ernst & Young suffered a data breach attributed to the ShinyHunters extortion gang, who claim to have obtained credentials for some of the firm’s systems via a supply-chain attack ^[19].
• Origin Energy reported a data breach affecting approximately 900,000 customers, with attackers claiming to have stolen data for up to 2 million customers ^[34].
• Private conversations with Claude AI chatbots were indexed and exposed in Google and Bing search results due to misconfigured web crawler controls ^[27].

Newly Discovered Vulnerabilities

• A maximum-severity command injection vulnerability (CVE-2026-16812) in on-premises Arista VeloCloud Orchestrator is under active exploitation. Arista has released patches for affected systems ^[4][14][33].
• A critical remote code execution zero-day in the FastJson Java library is being actively exploited in the wild, allowing attackers to execute code without authentication or elevated privileges ^[13][32].
• A public exploit has been released for a patched pre-authentication code execution vulnerability in vBulletin, enabling attackers to execute code via unauthenticated requests to PHP’s eval() function on unpatched forums ^[7].
• n8n automation platform patched a high-severity sandbox escape bug allowing authenticated workflow editors to execute OS commands as the n8n process ^[9].
• A proof-of-concept exploit for the “Certighost” Windows Active Directory Certificate Services vulnerability has been published, allowing authenticated attackers to potentially hijack Windows domains ^[16].
• A critical unsafe deserialization flaw in PTC Windchill is being exploited in ransomware campaigns, enabling unauthenticated remote code execution ^[37].
• Persistent “confused deputy” vulnerabilities remain in Google Cloud and Microsoft Azure, allowing attackers to gain administrative permissions and bypass cloud access controls ^[22].

Notable Threat Actor Activity

• Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore) has deployed new malware, including NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools, targeting the Middle East and Africa ^[1].
• The Dysphoria IoT botnet has compromised around 200,000 devices globally, adopting blockchain-based C2 and infected-device relays after law enforcement disruption of JackSkid. The botnet is being used for DDoS attacks and traffic relay operations ^[6][15].
• TELESHIM, an East Asia-linked threat actor, is abusing Telegram for command and control in attacks on Middle Eastern government entities, resulting in data exfiltration ^[12].
• The ShinyHunters gang is not only conducting extortion but their leaked data is being leveraged in sextortion scams, with scammers posing as ShinyHunters to make their emails more credible ^[19][44].
• An espionage attack on Thailand’s Ministry of Finance used Hermes, an autonomous open source AI agent, operating in “YOLO mode” to conduct its campaign ^[21].

Trends, Tools, or Tactics of Interest

• Attackers are actively exploiting legitimate remote monitoring and management (RMM) tools such as Level RMM and ScreenConnect via phishing lures themed as Microsoft Teams updates in “Operation BlueDash” ^[10].
• AI agents are proliferating in enterprise environments, often without security oversight, posing new governance and risk challenges ^[20].
• The Cruciferra crypter, used by a China-linked group targeting Indian tax professionals, employs bring-your-own-vulnerable-driver (BYOVD) and process ghosting techniques to evade detection on Windows systems ^[11].
• MedusaHVNC, a malware-as-a-service operation, uses hidden Windows desktops to launch legitimate browsers for persistent, covert remote access ^[38].
• AutoIT remains a common tool for malware payload injection due to its ease of use and powerful capabilities ^[28].
• There is a decline in confidence in autonomous security tools, as adversaries increasingly leverage defenders’ own rulebooks instead of relying on zero-day exploits ^[24].
• Java Spring Boot heapdump endpoints are being scanned, as exposed endpoints can leak sensitive memory data ^[30].
• Aftercall ad fraud campaigns are spreading Android apps that display full-screen ads after phone calls, impacting user experience ^[43].

Regulatory or Policy Developments Affecting the Security Industry

• NVIDIA and 36 other organizations have formed the Open Secure AI Alliance to develop and share open technologies, techniques, and tools for securing software and AI agents ^[5][39].
• GitHub and PyPI announced new supply chain security policies: Dependabot will now have a three-day cooldown before opening pull requests, and PyPI will reject file uploads to releases older than 14 days ^[36].

Sources

1. Coca-Cola confirms data theft in Fairlife ransomware attack - bleepingcomputer.com
2. Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack - securityweek.com
3. Ernst & Young data breach claimed by ShinyHunters extortion gang - bleepingcomputer.com
4. Origin Energy Data Breach Affects 900,000 Australians - securityweek.com
5. Private Claude Chats Exposed in Google and Bing Search Results - wired.com
6. Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw - thehackernews.com
7. Arista patches VeloCloud Orchestrator zero-day exploited in attacks - bleepingcomputer.com
8. Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day - securityweek.com
9. Hackers target US firms in FastJson RCE zero-day attacks - bleepingcomputer.com
10. Unpatched Fastjson Vulnerability Exploited in Attacks - securityweek.com
11. Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw - thehackernews.com
12. n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process - thehackernews.com
13. New Certighost PoC exploit lets attackers hijack Windows domains - bleepingcomputer.com
14. PTC Windchill Vulnerability Exploited in Ransomware Campaign - securityweek.com
15. 'Confused Deputy' Flaws Persist in Google Cloud, Microsoft Azure - darkreading.com
16. Mirage Kitten targets Middle East and Africa region with new malware - securelist.com
17. Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption - thehackernews.com
18. New Dysphoria DDoS botnet spreads to 200k devices worldwide - bleepingcomputer.com
19. TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments - thehackernews.com
20. Sextortion scammers are exploiting ShinyHunters data leaks - malwarebytes.com
21. AI Agent Drives Espionage Attack on Thai Ministry of Finance - darkreading.com
22. Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update - thehackernews.com
23. Shadow AI agents are multiplying. Here's how to find and secure them. - bleepingcomputer.com
24. Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware - thehackernews.com
25. MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection - securityweek.com
26. AutoIT Payload Injector , (Tue, Jul 28th) - isc.sans.edu
27. Adversaries Don't Need a Zero-Day — They Read Your Rulebook - darkreading.com
28. Java Spring Boot "heapdump" scans, (Mon, Jul 27th) - isc.sans.edu
29. Aftercall ads are driving Android users crazy - malwarebytes.com
30. NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework - thehackernews.com
31. Nvidia and Tech Giants Launch AI Security Alliance - securityweek.com
32. New GitHub, PyPI Policies Boost Supply Chain Security - securityweek.com