CTI Report — July 2026: A Month of Collapsing Patch Windows

Section 01Executive Intelligence Assessment

July 2026 was defined less by any single breach than by a structural shift: the interval between public technical disclosure and mass exploitation collapsed to days or hours. Adobe ColdFusion CVE-2026-48282 saw exploitation attempts within minutes of a watchTowr technical write-up.^[12] SharePoint CVE-2026-50522 was successfully exploited in watchTowr honeypots hours after a public proof-of-concept appeared.^[8] ServiceNow CVE-2026-6875 went from patch to in-the-wild payloads in five days.^[15] For defenders, "patch within 30 days" is no longer a defensible posture for internet-facing management planes.

Three developments carry strategic weight beyond their immediate technical impact. First, the SharePoint machine-key theft pattern matured into a repeatable playbook: four distinct SharePoint CVEs were confirmed exploited within roughly one month, with at least three used to extract ASP.NET ValidationKey/DecryptionKey material that lets an attacker forge authentication tokens after the patch is applied.^[8][9] Patching without key rotation leaves the intruder in place.

Second, Hugging Face disclosed what appears to be the first publicly documented end-to-end intrusion of a major AI platform conducted by an autonomous agent system, executing "thousands of individual actions across a swarm of short-lived sandboxes" over a weekend.^[2] This moves agentic AI from the "assists attackers" category into "conducts the operation."

Third, a multi-agency US advisory was updated on 22 July to expand the scope of Iranian-affiliated targeting of internet-exposed programmable logic controllers, with victim organizations reporting manipulated PLC project files, deceptive HMI/SCADA displays, operational disruption and direct financial loss across Water and Wastewater, Energy, and Government Facilities sectors.^[16][17] This is confirmed physical-process interference, not espionage positioning.

Section 02Key Judgments

Section 03Collection Scope & Methodology

Reporting window. 1 July 2026 – 23 July 2026. The originally requested window extended to 26 July; as of the publication date those dates had not yet occurred, and this report does not speculate about them. The window will be extended by update if warranted (see §20).

Collection method. Structured keyword sweeps across vulnerability, ransomware, nation-state, breach, supply-chain, OT/ICS, AI-threat, law-enforcement and regional domains, followed by targeted full-text retrieval of primary and high-value secondary sources. Every claim in this report traces to a numbered entry in the Evidence Register.

Verification standard applied. Government/CERT publications and vendor advisories were treated as primary. Security-vendor original research was treated as primary for its own telemetry and secondary for claims about third parties. Where sources conflicted, the conflict is reported at the point of use rather than resolved silently, and the competing figures are shown so the reader can judge.

Distinctions maintained throughout. This report separates: vulnerability exists → public PoC exists → scanning observed → exploitation attempted → compromise confirmed → exploitation attributed. These are not interchangeable, and conflating them is the most common failure mode in vulnerability reporting.

Section 04Priority Intelligence Matrix

Section 05Strategic Threat Developments

5.1 — The SharePoint machine-key playbook

Between mid-June and 22 July, four distinct on-premises SharePoint vulnerabilities were confirmed exploited in the wild.^[9] The technical details differ, but the post-exploitation objective converged: extract the ASP.NET machine keys (ValidationKey and DecryptionKey) that SharePoint uses to sign and validate __VIEWSTATE and authentication material.

The operational consequence is what makes this strategic rather than routine. An attacker holding valid machine keys can mint authentication tokens that the patched server will still accept. Remediation therefore requires a sequence — hunt, evict, then rotate — because rotating keys while an attacker retains code execution simply hands them the replacement.^[10]

5.2 — Microsoft's record Patch Tuesday

Microsoft's 14 July release addressed 570 vulnerabilities — including 59 rated Critical — and three zero-days: CVE-2026-56155 (AD FS elevation of privilege, exploited), CVE-2026-56164 (SharePoint elevation of privilege, exploited), and CVE-2026-50661 (BitLocker security feature bypass, publicly disclosed but not observed exploited).^[1] Microsoft attributed the volume increase to an internal AI-powered vulnerability discovery system.^[1]

5.3 — Agentic AI as the operator, not the tool

Hugging Face disclosed that an autonomous AI agent system carried out a complete intrusion of its production infrastructure over a weekend, executing thousands of individual actions across ephemeral sandboxes.^[2] Initial access came through two code-execution paths in the dataset-processing pipeline — a remote-code dataset loader and a template injection in a dataset configuration — which allowed execution on processing workers and escalation to node-level access. Credentials for cloud and cluster services were harvested; limited internal datasets were accessed.

Hugging Face states there is no evidence of tampering with public models, datasets, Spaces, or the software supply chain.^[2] The most instructive detail in the disclosure is a defensive asymmetry the company describes candidly: safety guardrails on frontier models impeded Hugging Face's own forensic analysis of the attack logs, while the attacker's system operated without such constraints.

Section 06State-Sponsored Activity

Section 07Cybercrime & Ransomware

7.1 — Ecosystem shape

As of June 2026, 146 ransomware groups had publicly claimed at least one victim.^[22] Qilin and The Gentlemen traded the top position repeatedly through July, each claiming approximately 300 victims in Q2 alone.^[23] Over the March 2025 – March 2026 span, the top five operations accounted for roughly 44% of 7,551 publicly disclosed victims: Qilin (1,358), Akira (749), INC Ransom (436), Play (422), SafePay (324).^[22]

7.2 — Anubis / Coca-Cola Fairlife

7.3 — Speed: the Spirals case

A previously unseen Rust-based ransomware family, Spirals, was deployed in a double-extortion attack against a South Asian IT services company. The intrusion began 16 June at 22:21 local time via an internet-facing IIS server, where attackers uploaded an ASP.NET web shell. In a roughly three-hour interactive session they dumped the SAM hive, uninstalled endpoint security, disrupted backups and established covert remote access; full network encryption followed in under 24 hours from initial access.^[34][35] The ransom note threatened publication after six days, with negotiation via a Tor portal.

7.4 — BlueHammer enters ransomware chains

CISA updated its KEV entry for CVE-2026-33825 ("BlueHammer") to record that the flaw is now leveraged in ransomware campaigns.^[36][37] BlueHammer is a time-of-check-to-time-of-use race condition in Microsoft Defender permitting local privilege escalation to SYSTEM. Reported attack chains pair it with a Defender bypass tool ("UnDefend") and a Go-based C2 tunneling agent ("BeigeBurrow") to escalate, degrade antimalware coverage, dump credentials and stage ransomware.

Timeline note: the vulnerability was publicly disclosed 2 April by a researcher dissatisfied with Microsoft's handling of reports, patched 14 April, and KEV-listed 22 April. The July development is the ransomware-usage annotation, not the vulnerability itself.^[37]

7.5 — Law enforcement and sanctions

Section 08Malware & Delivery Operations

Delivery-side note. A Microsoft 365 device-code phishing campaign using collaboration-themed lures was observed from the last week of June into early July, enabling full account takeover, BEC and lateral movement.^[45] This aligns with the broader identity-attack pattern in which session-token theft — rather than credential theft — is the primary MFA-bypass mechanism.^[46]

Section 09Vulnerability & Exploitation Radar

9.1 — CISA KEV additions, 1–23 July 2026

Sources for the KEV table: CISA alerts of 7, 13, 14, 15, 16, 21 and 22 July, corroborated by vendor advisories and reporting.^{[3][4][5][6][7][8][11][12][13][14]} Dashes indicate no CVSS score was disclosed in the sources reviewed — an absent score is not evidence of low severity.

9.2 — Significant exploited flaws beyond the KEV list

9.3 — Oracle PeopleSoft: a material update, not a new event

Oracle's July Critical Patch Update closed the vulnerability chain that the extortion group ShinyHunters (tracked by Mandiant as UNC6240) used to compromise more than 300 PeopleSoft servers across 100+ organizations.^[48][49] The core flaw, CVE-2026-35273 (CVSS 9.8), is a PeopleTools privilege-escalation issue remotely exploitable by an unauthenticated attacker over HTTP.

Correct dating matters here. The exploitation window ran 27 May – 9 June 2026; Oracle issued a rare out-of-band alert on 10 June. The education sector, particularly universities, bore the brunt. The July event is the permanent fix, not the breach. Reporting that presents this as a July compromise is misdating a June campaign.

Section 10Cloud, Identity, Supply Chain & AI Threats

10.1 — Open-source ecosystem: four waves in five weeks

Four distinct npm/PyPI compromise campaigns ran from early June through 14 July, escalating in sophistication:^[21]

10.2 — Identity and cloud

• Cloud Accounts ranked as the most prevalent ATT&CK technique for the second consecutive year in Red Canary's telemetry.^[42]
• Session-token theft is the dominant MFA-bypass mechanism, with Microsoft's 2025 Digital Defense Report attributing 80% of recent MFA-bypass breaches to token theft via adversary-in-the-middle kits.^[46]
• NadMesh botnet scans specifically for exposed AI services to harvest cloud keys and Kubernetes service-account tokens^[44] — a supply of credentials feeding directly into the container-to-cloud escalation path.

10.3 — AI systems as targets

Beyond the Hugging Face intrusion (§5.3), the reporting window shows AI infrastructure emerging as a first-class target rather than a novelty: two Langflow CVEs entered KEV within the month (CVE-2026-55255, CVE-2026-0770), the ServiceNow flaw sits in an AI Platform component, and NadMesh hunts AI service exposure. The pattern is consistent — AI-adjacent components are being deployed internet-facing faster than they are being hardened.

Section 11OT / ICS & Critical Infrastructure

The Iranian-affiliated PLC campaign (§6) is the dominant OT story and is covered there. Two additional signals belong here:

• CVE-2023-4346 (KNX protocol) entering KEV on 15 July is noteworthy out of proportion to its profile. KNX is a building-automation standard; an account-lockout weakness being actively exploited indicates attacker interest in building-management systems, a historically under-monitored estate that frequently sits outside both IT and OT security programmes.
• Armored Likho's targeting of electric power operators across three countries (§6) reinforces that grid operators outside the traditional NATO/US threat picture — Kazakhstan, Brazil — are within scope for capable actors.^[24]

Latvia's state-owned forestry company Latvijas Valsts Meži also disclosed a ransomware incident in which attackers exploited an unpatched system reportedly present for two years, with approximately 44 GB of internal documents, credentials, cryptographic keys, source code and email correspondence leaked.^[50] Confidence: Moderate — leak volume and dwell-time figures derive from reporting rather than victim confirmation.

Section 12Confirmed Incident Ledger

Section 13Regional Intelligence

13.1 — Morocco

13.2 — Europe

Europe saw the month's most substantial law-enforcement activity (§7.5), with Operation Eastwood dismantling NoName057(16) infrastructure across 14–17 July. On the victim side, Spanish defence contractor Indra Group and Latvia's state forestry company were both affected by ransomware, and the KNX building-automation KEV entry has particular relevance for European commercial real estate where KNX deployment is widespread.

13.3 — Asia-Pacific

Japanese telecom KDDI disclosed a breach affecting an email system shared across five ISPs; Japanese manufacturer Nidec's Taiwanese subsidiary was hit by ransomware; the Spirals ransomware victim was a South Asian IT services provider; and TriBack Loader activity concentrated on Asian government, healthcare and education targets.

Section 14MITRE ATT&CK Coverage

Section 15Defensive Priorities

• 01Treat SharePoint as an IR matter, not a patch matter. Patch all four CVEs, then hunt, then evict, then rotate ASP.NET machine keys — in that order. Rotating before eviction hands the attacker the new keys.
• 02Inventory internet-exposed management planes. Check Point SmartConsole, ServiceNow self-hosted, Oracle EBS, ColdFusion and ShareFile were all exploited or emergency-patched this month. Management interfaces reachable from the internet are the month's common denominator.
• 03Remove PLCs from direct internet exposure and apply the refreshed AA26-097A detection guidance, including checks for malicious changes in reusable code modules within Rockwell PLC programs.
• 04Compress your emergency patch SLA for internet-facing software to 72 hours or less. Three independent July cases showed exploitation within hours-to-days of public technical detail.
• 05Add behavioural dependency screening. Sigstore/SLSA provenance did not stop wave 4. Watch for post-install network egress, credential-store access, and AI-assistant config file reads by build-time dependencies.
• 06Audit CI/CD trigger configuration, specifically pull_request_target usage and the scope of bot personal access tokens. The AsyncAPI pattern is directly reusable against any similarly configured repository.
• 07Prioritise session-token protections over additional MFA factors. With 80% of MFA-bypass breaches attributed to token theft, token binding and conditional access carry more marginal value than another factor.
• 08Do not neglect legacy estate. Three KEV additions this month were CVEs from 2008, 2021 and 2023. Attackers are still finding unpatched old systems and monetising them.

Section 16Detection & Threat-Hunting Opportunities

16.1 — Vendor detections available

Microsoft Defender ships signatures relevant to the SharePoint exploitation cluster, including Exploit:Script/ToolPaneAuthBypass.A, Exploit:Script/ToolPaneAuthBypass and Exploit:Script/SuspSignoutReqBody.A.^[10] Confirm AMSI integration is enabled for every SharePoint web application — without it, script-level visibility is substantially reduced.

16.2 — Hunt hypotheses

• IIS worker spawning interpreters. w3wp.exe spawning cmd.exe, PowerShell or script engines is the highest-yield single hunt this month — it fires on both the SharePoint cluster and the Spirals entry point.
• Unexpected .aspx writes into SharePoint or IIS web-accessible directories outside deployment windows.
• Post-patch anomalous authentication. Valid sessions with no corresponding interactive logon are the signature of forged-token access. This is the hunt that catches machine-key theft after patching.
• Check Point management plane. Review administrator, SmartConsole, API and application-token activity, particularly where the Management Server has been internet-reachable and Trusted Clients is unrestricted.
• Build-time egress. Outbound connections initiated during npm install/pip install, and any dependency process reading ~/.aws, ~/.ssh, or AI-assistant configuration directories.
• OT. Baseline PLC project files and alert on modification; compare HMI-rendered values against independent process telemetry where available — the Iranian campaign specifically manipulated displayed data.

16.3 — Sample detection logic

Generic Sigma rule for the IIS-webshell-to-interpreter pattern common to this month's SharePoint and Spirals activity. This targets the technique, not any specific actor's indicators:

title: IIS Worker Process Spawning Command Interpreter
id: 7c1e2f3a-0000-4e1a-9c2d-b1a2c3d4e5f6
status: experimental
description: Detects w3wp.exe spawning a command interpreter, a common
    signal of interactive web shell use. Observed in the July 2026
    SharePoint exploitation cluster and the Spirals ransomware intrusion.
author: Omar Babba
date: 2026-07-23
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\w3wp.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\powershell_ise.exe'
    condition: selection
falsepositives:
    - IIS management extensions that legitimately shell out
    - Some application deployment tooling
level: high

Tune against your own baseline before enabling in production. Pair with a second rule watching for PSEXESVC service creation on the same host within a short window — that two-step sequence is what Spirals used to spread prior to encryption.

Section 17Outlook & Intelligence Requirements

17.1 — Forecasts

The following are analytical judgments about future events, explicitly marked as forecast, not fact.

• Likely (high confidence). Additional SharePoint CVEs will surface in the next 60 days. The cluster's pattern — patch, bypass, patch — mirrors the 2025 "ToolShell" chain, where fixes were repeatedly circumvented. The underlying deserialization attack surface appears not to be exhausted.
• Likely (moderate confidence). GhostLock will see in-the-wild exploitation. A public PoC granting root in seconds against a widely deployed container substrate, in a month where three other PoCs were weaponised within days, is unlikely to remain theoretical.
• Possible (low confidence). Further agentic-AI intrusions will be disclosed. The Hugging Face case may be the first disclosure rather than the first occurrence — but a single data point cannot establish a rate, and disclosure incentives are weak.
• Watch item. The Anubis/Fairlife deadline of 27 July falls outside this reporting window. Whether data is published will indicate whether negotiation occurred.

17.2 — Open collection requirements

1. Morocco / JabaRoot DZ dating. Establish definitively whether the Tawtik/ANCFCC leak reported around 17 July belongs to 2026 or 2025 (§13.1). Primary Moroccan government or CERT sourcing needed.
2. Armored Likho corroboration. Independent confirmation of Kaspersky's findings, and clarification of the evidentiary basis for the "AI-generated malware" characterisation.
3. SharePoint compromise scale. No reliable figure exists for how many servers were compromised before patching — only exposure counts. Post-patch forged-token access would be largely invisible in current public telemetry.
4. GhostLock exploitation status. Active monitoring for first confirmed in-the-wild use.
5. Conduent breach. The 62.2M figure requires confirmation against regulatory filings rather than aggregated reporting.

Section 18Evidence Register

• [1]BleepingComputer — "Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days"
  S · 14 Jul 2026 · retrieved in full 23 Jul
• [3]CISA — Known Exploited Vulnerabilities Catalog
  P · continuously updated
• [4]CISA — "Adds Three Known Exploited Vulnerabilities to Catalog"
  P · 7 Jul 2026
• [5]CISA — "Adds One Known Exploited Vulnerability to Catalog"
  P · 13 Jul 2026
• [6]CISA — "Adds Two Known Exploited Vulnerabilities to Catalog"
  P · 15 Jul 2026
• [7]CISA — "Adds Three Known Exploited Vulnerabilities to Catalog"
  P · 16 Jul 2026
• [8]BleepingComputer — "Critical SharePoint RCE flaw exploited to steal machine keys" (CVE-2026-50522)
  S · Jul 2026
• [9]SecurityWeek — "Fourth SharePoint Vulnerability Exploited in Past Month's Wave of Attacks"
  S · Jul 2026
• [10]Help Net Security — "Another SharePoint RCE exploited: Patch, then rotate your machine keys"
  S · 22 Jul 2026
• [11]CISA — "CISA Urges SharePoint Hardening After New Exploitations"
  P · 14 Jul 2026
• [12]BleepingComputer — "Max severity Adobe ColdFusion flaw now exploited in attacks" (CVE-2026-48282)
  S · Jul 2026
• [13]The Hacker News — "CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV"
  S · Jul 2026
• [14]Rapid7 — "CVE-2026-16232: Critical Check Point SmartConsole Authentication Bypass Exploited in the Wild"
  P · Jul 2026 · vendor research
• [15]Help Net Security — "ServiceNow pre-auth RCE exploited in the wild (CVE-2026-6875)"
  S · 20 Jul 2026
• [18]BleepingComputer — "Progress confirms ShareFile zero-day flaw behind Storage Zone shutdown"
  S · Jul 2026 · contains vendor statement
• [19]The Hacker News — "URGENT: Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers"
  S · Jul 2026
• [20]TechTimes — "Public Exploit Turns 15-Year Linux Kernel Flaw Into 5-Second Root Attack" (GhostLock / CVE-2026-43499)
  S · 8 Jul 2026
• [47]SecurityWeek — "Google Patches 5th Chrome Zero-Day Exploited in 2026" (CVE-2026-11645)
  S · Jul 2026
• [48]The Hacker News — "ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities"
  S · Jun 2026
• [49]The Register — "ShinyHunters hacked 100+ orgs by exploiting an Oracle PeopleSoft 0-day"
  S · 11 Jun 2026
• [55]The Hacker News — "Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild"
  S · Jun–Jul 2026
• [56]Help Net Security — "Attackers exploit critical Adobe ColdFusion vulnerability (CVE-2026-48282)"
  S · 7 Jul 2026
• [57]The Hacker News — "Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access"
  S · Jul 2026
• [58]The Hacker News — "Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC"
  S · Jul 2026
• [59]SecurityWeek — "WP2Shell WordPress Vulnerabilities Exploited in the Wild"
  S · Jul 2026
• [60]Rapid7 — "CVE-2026-63030 wp2shell: Critical RCE in WordPress Core"
  P · Jul 2026 · vendor research
• [61]Wiz — "Exploitation in the Wild of wp2shell"
  P · Jul 2026 · vendor research
• [62]Rapid7 — "CVE-2026-58644: Microsoft SharePoint Server RCE Exploited in the Wild"
  P · Jul 2026 · vendor research
• [63]Tenable — "SharePoint CVEs FAQ: CVE-2026-56164, CVE-2026-32201, CVE-2026-45659"
  P · Jul 2026 · vendor research

• [16]CISA / FBI / NSA / EPA / DOE / CNMF / Treasury — Advisory AA26-097A, "Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure"
  P · issued 7 Apr 2026, updated 22 Jul 2026 · direct fetch returned HTTP 403; content verified via [17] and IC3 mirror
• [17]Industrial Cyber — "Ongoing cyberattacks targeting internet-connected PLCs disrupt US critical infrastructure, agencies warn"
  S · Jul 2026
• [64]IC3 / FBI — Joint Cybersecurity Advisory PDF (AA26-097A)
  P · 7 Apr 2026
• [24]Security Affairs — "AI-Generated Malware Powers New Armored Likho APT Campaign"
  S · Jul 2026 · reporting on Kaspersky research
• [25]GAT Report — "Malware campaign targets power grids in Russia, Brazil, and Kazakhstan"
  S · Jul 2026
• [26]The Hacker News — "GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft"
  S · 17 Jul 2026 · reporting on Expel research
• [27]SecNews — "DigiCert breach: theft of code-signing certificates (2026)"
  S · 2026
• [28]Unit 42 (Palo Alto Networks) — "Tracking Iranian APT Screening Serpens' 2026 Espionage Campaigns"
  P · 2026 · original research
• [29]The Hacker News — "China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks"
  S · Jul 2026
• [30]Infosecurity Magazine — APT coverage (ReliaQuest hospitality DNS poisoning)
  S · Jul 2026
• [65]SecurityWeek — "Industry Reactions to Iran Hacking ICS in Critical Infrastructure"
  S · 2026
• [66]GBHackers — "CISA Urges Organizations to Remove Rockwell PLCs From Direct Internet Exposure"
  S · 2026

• [22]Infosecurity Magazine — "A New Ransomware Threat Actor Emerges Every Week, Warns Report"
  S · Jul 2026
• [23]Bitdefender — "Threat Debrief, July 2026"
  P · Jul 2026 · vendor telemetry
• [31]US SEC EDGAR — The Coca-Cola Company, Form 8-K
  P · 16 Jul 2026 · regulatory filing
• [32]BleepingComputer — "Anubis ransomware claims Coca-Cola Fairlife attack, threatens data leak"
  S · Jul 2026
• [33]Atlanta Journal-Constitution — "Hackers claim attack on Coca-Cola's Fairlife, threaten to leak data"
  S · Jul 2026
• [34]BleepingComputer — "New Spirals ransomware encrypts victim network in under 24 hours"
  S · Jul 2026
• [35]Symantec / Security.com — "Spirals: New Stealthy Ransomware Deployed Against Asian IT Company"
  P · Jul 2026 · original research
• [36]BleepingComputer — "CISA: Windows BlueHammer flaw now exploited by ransomware gangs"
  S · Jul 2026
• [37]SecurityWeek — "BlueHammer Vulnerability Exploited in Ransomware Attacks" (CVE-2026-33825)
  S · Jul 2026
• [38]Europol — "Global operation targets NoName057(16) pro-Russian cybercrime network" (Operation Eastwood)
  P · Jul 2026 · law enforcement
• [39]BleepingComputer — "US charges alleged operators of Russian bulletproof hosting service"
  S · 14 Jul 2026 · reporting on DOJ indictment
• [40]US Department of the Treasury — Sanctions press release (bulletproof hosting / ransomware enablers)
  P · Jul 2026 · government
• [41]BleepingComputer — "Europol flags 4,340 URLs for removal in 'The Com' crackdown"
  S · Jul 2026
• [67]GlobalSecurity.org — "Treasury Sanctions Malware and Infrastructure Providers Supporting Ransomware Attacks Against Americans"
  S · 13 Jul 2026
• [50]Check Point Research — "13th July Threat Intelligence Report" (Latvijas Valsts Meži and others)
  P · 13 Jul 2026 · vendor research
• [68]Check Point Research — "20th July Threat Intelligence Report"
  P · 20 Jul 2026 · vendor research · retrieved in full

• [2]Hugging Face — "Security incident disclosure — July 2026"
  P · Jul 2026 · first-party disclosure · retrieved in full 23 Jul
• [21]GitGuardian — "Four More Supply Chain Attacks Hit npm and PyPI"
  P · Jul 2026 · original research · retrieved in full
• [42]Red Canary — "Intelligence Insights: July 2026"
  P · Jul 2026 · vendor telemetry
• [43]Malwarebytes — "Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding"
  P · Jul 2026 · original research
• [44]The Hacker News — "New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens"
  S · Jul 2026
• [45]The Hacker News — "DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts"
  S · Jul 2026
• [46]Microsoft Security Blog — "Resurgence of a multi-stage AiTM phishing and BEC campaign abusing SharePoint"
  P · Jan 2026 · vendor research (context for token-theft statistics)
• [69]Unit 42 (Palo Alto Networks) — "The npm Threat Landscape: Attack Surface and Mitigations"
  P · updated Jul 2026 · original research
• [70]Unit 42 (Palo Alto Networks) — "Understanding Current Threats to Kubernetes Environments"
  P · 2026 · original research

• [71]Cybernews — "Data breach at Suno affects over 55 million users"
  S · Jul 2026
• [72]Malwarebytes — "Paidwork breach exposes data of 23 million users"
  S · Jul 2026
• [73]SecurityWeek — "Data Breach Confirmed After Australian Energy Giant Origin Is Hacked"
  S · Jul 2026
• [74]TechRepublic — "The Biggest Data Breaches of 2026 So Far, Ranked by Impact"
  S · 2026 · used for Conduent figure

• [51]Maghrebi — "Cyberattack targets key government ministers in Morocco"
  S · URL path indicates 2025 — this is the specific date ambiguity flagged in §13.1
• [52]The Record (Recorded Future News) — "Morocco investigates major data breach allegedly by Algerian hackers"
  S · established campaign context
• [53]Dark Reading — "Morocco Investigates Social Security Agency Data Leak"
  S · CNSS incident context
• [54]Ecofin Agency — "Morocco launches new cybersecurity strategy as attacks on state systems rise"
  S · national policy response
• [75]CYFIRMA — "Decoding Cyberattacks on Morocco"
  P · vendor research
• [76]The Hacker News — "Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE" (CVE-2026-12569)
  S · Jul 2026
• [77]BleepingComputer — "SonicWall SMA1000 flaws exploited as zero-days to push custom malware" (ORANGETAIL)
  S · Jul 2026
• [78]The Register — "Millions of California-bought cars can be hijacked via Bluetooth" (KARR)
  S · 23 Jul 2026
• [79]US Department of Justice — "Three Russian Nationals and Two Companies Indicted for International Cybercrimes Resulting in More Than $62M in Victim Losses"
  P · 14 Jul 2026 · government primary
• [80]The Hacker News — "Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data" (CVE-2026-48294, "HermeticReader")
  S · Jul 2026
• [81]Cato Networks (Cato CTRL) — "How One Threat Actor Turned Frontier AI Into an Offensive Platform"
  P · Jul 2026 · vendor research
• [82]Huntress — "Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT"
  P · Jul 2026 · first-party telemetry
• [83]The Hacker News — "Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say"
  S · Jul 2026
• [84]GBHackers — "Iran-Linked APT42 Uses AI-Assisted Phishing and TAMECAT Backdoor to Target Defense Officials"
  S · Jul 2026
• [85]Google DeepMind — "Introducing CodeMender: an AI agent for code security"
  P · 21 Jul 2026 · first-party
• [86]Cyber Security News — "Foxit Updater Vulnerability Gives Standard Users SYSTEM-Level Control of Windows Devices" (CVE-2026-57239)
  S · Jul 2026
• [87]Cyberpress — "Critical FreePBX Flaws Let Unauthenticated Attackers Execute Commands and Hijack Admin Accounts"
  S · Jul 2026
• [88]Zimbra — "Patch Release Update: Zimbra 10.1.20"
  P · 20 Jul 2026 · vendor advisory
• [89]SecurityWeek — "Meta Paid $78,000 Bounty for Vulnerability Exposing Customer Support Data"
  S · Jul 2026
• [90]Group-IB — "HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels"
  P · Jul 2026 · vendor research
• [91]Elastic Security Labs — "Contagious Interview malware in SVG images: DPRK campaign" (OTTERCOOKIE)
  P · Jul 2026 · vendor research
• [92]BleepingComputer — "South Korea discloses data breach impacting diplomats worldwide"
  S · Jul 2026
• [93]Cybersecurity Dive — "Hackers steal customer data from major hospital software vendor" (Craneware)
  S · 20 Jul 2026
• [94]US DOJ, District of Massachusetts — "Illinois Man Sentenced to Over Six Years in Prison for Identity Theft and Wire Fraud" (Kyle Svara / Snapchat phishing)
  P · 21 Jul 2026 · government primary
• [95]Microsoft Security Blog — "Cross-tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook"
  P · Apr 2026 · first-party — predates this window, see §21
• [96]Axios — "Scoop: Trump AI security agency head resigns" (CAISI)
  S · 20 Jul 2026
• [97]Tom's Hardware — "LG monitor triggers automatic McAfee adware install via Windows Update"
  S · Jul 2026

Section 19Auditable Source-Coverage Summary

Section 20Correction & Update Policy

This report is a living document. Where new evidence contradicts a finding here, the finding will be corrected in place, with the correction logged and dated rather than silently edited — so readers can see what changed and when.

• Reporting window: 1–23 July 2026, core report. Verified as of 23 July 2026.
• Update applied: 26 July 2026 — §21 addendum extends coverage through 26 July with 22 additional sourced items.
• Corrections: email omarbabba27@gmail.com with the claim, the correcting source, and the URL. Substantive corrections are published with attribution to the person who reported them unless anonymity is requested.
• Confidence changes: if an item's confidence level changes, both the old and new level will be shown.

Section 21Addendum — 24–26 July 2026 Extension

22 stories below fall in the 24–26 July window (plus a small number dated slightly earlier that the original 1–23 July sweep missed) and meet this report's evidence threshold. Three items from the roundup were not added: three "top 10 vendor" listicles (ITDR platforms, physical-penetration-testing firms, 24/7 SOC monitoring providers) are vendor-comparison content, not discrete threat events, and fall outside this report's scope. Microsoft's Teams helpdesk-impersonation advisory (s95 below) is included for completeness but is dated March–April 2026, not July — it is an ongoing campaign pattern, not a new-this-window event.

21.1 — AI-related threats

• Claude Opus jailbroken into a commercial AI pentest platform. A Russian-speaking actor ("Trim") spent 2026 publishing jailbreak techniques against Claude Opus, then shipped "AI Pentest Checker," a commercial vulnerability-scanning product built on a $4 grey-market API key rather than any compromise of Anthropic's infrastructure. ^[81] High confidence
• SectopRAT delivered via fake Claude Desktop installer ("FakeAgent"). A malvertising campaign used a Bing-ads-promoted, claude.ai-hosted Artifact impersonating the Claude Desktop installer to compromise at least 29 organizations with an HVNC-capable info-stealer before Anthropic removed it on 22 July. ^[82] High confidence — first-party (Huntress) telemetry
• Kimi K3 autonomously found real Redis RCE flaws in 27 minutes. Moonshot AI's model cloned Redis, fuzzed it, and debugged crashes with GDB in an authorized test environment, surfacing RCE-class bugs across four Redis versions; Redis shipped seven fixes on 23 July. ^[83] Moderate confidence — vendor-reported, not independently reproduced by this report
• APT42 (Iran) pairs AI-generated phishing with an expanded TAMECAT backdoor. The modular PowerShell implant now harvests browser cookies — surviving a password reset — and researchers report the group using generative AI across target research, lure writing, and malware engineering, with family members of defense/diplomatic targets newly in scope. ^[84] High confidence
• Google's CodeMender agent entered public preview (21 Jul). Scans repositories, builds a proof-of-concept exploit in an isolated sandbox to confirm real exploitability, then generates a patch for developer review — first-party vendor disclosure. ^[85] High confidence — first-party
• CAISI (the US AI Safety Institute successor) lost its director after three months. Chris Fall's resignation was not explained by Commerce; NIST's director is acting head pending a permanent replacement. Relevant as a governance signal, not a technical threat. ^[96] Policy note, not a threat event

21.2 — Vulnerabilities & exploitation

• Cl0p exploiting PTC Windchill/FlexPLM (CVE-2026-12569, CVSS 9.8). A pre-auth deserialization chain across the FlexPLM WSDL endpoint and the Windchill login servlet deploys hex-named JSP webshells; targets manufacturing, automotive, and aerospace product-lifecycle data. Added to CISA KEV 25 June; campaign activity continued into the report's extension window. ^[76] High confidence
• SonicWall SMA 1000-series zero-days (root access, ORANGETAIL webshell). Threat actor UTA0533 chained an SSRF and a command-injection flaw against SMA 6210/7210/8200 appliances from ~22 June, three weeks before SonicWall's 14 July disclosure and hotfix. ORANGETAIL mimics the Behinder framework and only answers requests bearing a specific user-agent. ^[77] High confidence — vendor + Volexity telemetry
• Adobe Acrobat Chrome extension — "HermeticReader" (CVE-2026-48294, CVSS 7.4). A messaging-validation gap in Acrobat's new WhatsApp-Web integration ("Hermes") let any malicious page silently read WhatsApp Web chats/contacts across the extension's ~329M install base. Patched same-weekend as disclosure, in 26.5.2.3. ^[80] High confidence
• Foxit PDF Reader/Editor updater DLL sideloading (CVE-2026-57239). The SYSTEM-privileged update service loads DLLs from a user-writable ProgramData path, letting a local low-privileged attacker escalate to SYSTEM. Fixed in 2026.2. ^[86] Moderate confidence — local-privesc only, requires prior code execution
• FreePBX: unauthenticated RCE + hard-coded credentials. Two Sangoma advisories: a socket.io auth-stripping regression in the UCP Node server (FreePBX 17 < 17.0.9) enabling unauthenticated AMI command injection, and hard-coded creds in the userman module (CVE-2026-46376, CVSS 9.3) exposing the User Control Panel on installs using the generic template. ^[87] High confidence
• Zimbra 10.1.20 — critical SNMP command injection + 4× stored XSS. Command injection in the SNMP monitoring component (enabled by default in some configs) can lead to full server compromise; released 20 July. ^[88] High confidence — vendor advisory, primary
• Meta — IDOR in customer-support case handling ($78,000 bounty). Sequential, unauthorized support-case IDs allowed enumeration of support conversations, attachments, and PII; Meta patched in April 2026, found no evidence of exploitation, and disclosed/paid in July. Included for completeness though the underlying fix predates this window. ^[89] High confidence — vendor-confirmed, no evidence of exploitation

21.3 — Malware & campaigns

• HOLLOWGRAPH — Microsoft Graph/M365 calendar as covert two-way C2. A .NET NativeAOT DLL attributed with high confidence to the Cavern backdoor framework, using calendar-event attachments (dated far in the future — 13 May 2050 — to stay off any real schedule view) as an encrypted dead drop, with RSA-OAEP-wrapped AES-256-GCM payloads and a DNS-tunneling fallback for credential refresh. Group-IB assesses the ~12 identified victims as Israel-focused. ^[90] High confidence — first-party vendor research
• OTTERCOOKIE hidden in SVG "flag" images (Contagious Interview / DPRK). Fake coding-test lures ship an SVG containing Base64 fragments inside HTML comments; a bundled serverValidation.js reassembles and executes a four-stage payload (credential/wallet stealer, file stealer, Socket.IO RAT, clipboard stealer) with zero AV detections reported at time of analysis. ^[91] High confidence — first-party vendor research (Elastic Security Labs)

21.4 — Breaches & incidents

• South Korea — Korea National Diplomatic Academy breach, ~10 months undetected. Zero-day plus weak segmentation gave an attacker access from roughly April 2025 to February 2026 on a server excluded from routine security scrutiny because it sat inside MFA HQ; up to ~10,000 diplomat/staff records exposed. Discovered by a separate government authority, not MoFA itself. ^[92] High confidence — government-confirmed
• Craneware (healthcare billing/revenue-cycle vendor) — data exfiltration. Disclosed 20 July; a subset of employee, customer, and partner data was exfiltrated. Craneware serves billing systems for ~2,000 US hospitals and ~10,000 clinics/pharmacies; the company states most exfiltrated file names are non-sensitive or already-public regulatory content, and reports no service disruption. ^[93] Moderate confidence — vendor self-disclosure, scale not independently confirmed

21.5 — Law enforcement & other

• Three Russian nationals + 2 bulletproof-hosting companies indicted (>$62M in losses). DOJ indictment (returned Dec 2024, unsealed 14 July 2026) against Media Land LLC / ML.Cloud LLC operators for hosting infrastructure behind ransomware, malware, and phishing operations against 44 victims — banks, schools, hospitals — across 21 US states. ^[79] High confidence — DOJ primary source
• Kyle Svara (Illinois) sentenced — Snapchat phishing, 517 accounts compromised. Impersonated Snap support via text to harvest 2FA codes from over 4,500 targeted users; ~570 provided codes, 517 accounts were accessed and stripped of private images. Sentenced 21 July to 76 months. ^[94] High confidence — DOJ primary source
• KARR aftermarket alarm system — shared Bluetooth key affects 2.2M+ vehicles (dealer-installed, mainly Southern California Honda/Toyota/Mazda/Ford/Jeep). UCSD researchers reverse-engineered a key shared across all KARR units, enabling unlock/immobilize/horn-and-light commands from ~5 yards away; Acrisure knew since January 2025 but patched only 20 July 2026, ahead of DEF CON/USENIX disclosure. Physical/IoT risk, not a network intrusion. ^[78] High confidence
• Microsoft Teams helpdesk impersonation (UNC6692 / cross-tenant pattern). Attackers cold-message employees over Teams posing as IT support to get Quick Assist or remote-session approval, then run signed-vendor tooling alongside attacker modules. Dated March–April 2026 in Microsoft's own reporting — included here for the roundup cross-check, but it is not a new development inside this report's window. ^[95] Ongoing pattern, not a new-window event
• LG Monitor App Installer silently pushes McAfee adware via Windows Update. Connecting an LG UltraGear 34GX900A-B triggers an unprompted install requesting "all system resources," geolocation, and contact-data permissions, then surfaces McAfee trial pop-ups. Microsoft says LG has agreed to drop the pop-up; the underlying permission scope was not reported as resolved. ^[97] Moderate confidence — consumer-privacy issue, not an active-exploitation threat