Stay updated with the latest cybersecurity news! This roundup highlights critical vulnerabilities, emerging threats, ransomware incidents, data breaches, and key patches to help you navigate the rapidly evolving digital threat landscape.
1. WordPress Core wp2shell Flaw Allows Unauthenticated RCE
Published: July 17, 2026
WordPress released urgent updates (6.9.5 and 7.0.2) fixing a pre-authentication remote code execution vulnerability in core that attackers can trigger with a single anonymous HTTP request—even on default installs with no plugins. Affects versions 6.9.0–6.9.4 and 7.0.0–7.0.1.
2. Microsoft July 2026 Patch Tuesday Fixes Record 570 Vulnerabilities
Published: July 14, 2026
Microsoft addressed a record-breaking 570 flaws (including 3 zero-days, with 2 actively exploited) across Windows, SharePoint, AD FS, Exchange, and more. Prioritize AD FS (CVE-2026-56155) and SharePoint (CVE-2026-56164) patches immediately.
3. CISA Adds Exploited SharePoint RCE Zero-Day to KEV Catalog
Published: July 17, 2026
CVE-2026-58644 (critical deserialization flaw) in Microsoft SharePoint Server added to Known Exploited Vulnerabilities list. Federal agencies must patch by July 19. Network-based attacks possible for authenticated Site Owners.
4. Danone (Evian, Silk) Hit by Qilin Ransomware; Coca-Cola Fairlife Production Halted
Published: July 17, 2026
Qilin ransomware impacted Danone. Separately, a ransomware attack disrupted Coca-Cola’s Fairlife subsidiary, suspending U.S. production. Ongoing wave of manufacturing and consumer goods targeting.
5. OpenSSL HollowByte Flaw Could Freeze Server Memory
Published: July 17, 2026
An 11-byte TLS request can cause unpatched OpenSSL servers to allocate up to 131 KB of irrecoverable memory (on glibc systems) until restart—creating potential DoS vectors.
6. Russian Spies Hunt Targets via 87,000 Exposed European Cameras
Published: July 17, 2026
Vulnerable cameras across Europe are being scanned and exploited by Russian actors for surveillance and targeting. Heightened risks to physical security and OT environments.
7. Malicious npm Packages Target Vite Ecosystem with Blockchain C2 RATs
Published: July 17, 2026
Seven malicious Vite-related npm packages discovered in a supply chain attack using blockchain for command-and-control to deliver remote access trojans. Developers urged to audit dependencies.
8. Ernst & Young Vendor Exposes Sensitive Client Tax Records; Italy Fines WINDTRE
Published: July 17, 2026
An EY vendor breach exposed client tax data. Meanwhile, Italy fined telecom WINDTRE €1.7M over data breaches involving payment and user information. Supply chain and third-party risks remain high.
Stay Vigilant
Cyber threats continue to accelerate with AI-assisted attacks, supply chain compromises, and record patching volumes. Patch promptly, monitor third-party vendors, enforce MFA, and audit dependencies. Subscribe to our newsletter for daily/weekly updates, and consider tools like vulnerability scanners and endpoint detection for proactive defense. Stay safe online!