Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, AI-powered attacks, ransomware campaigns, data breaches, and significant defensive developments to keep you informed and secure in the ever-evolving digital landscape.
1. GitHub and PyPI Introduce Time-Based Defenses Against Supply Chain Attacks
Published: 2026-07-26
GitHub and the Python Package Index (PyPI) have rolled out a time-based mechanism in Dependabot to better protect against supply-chain attacks. The feature helps limit the impact of malicious package updates by introducing temporal controls that reduce the window for rapid, widespread compromise of dependencies.
2. SourTrade Malvertising Campaign Builds Malware Inside the Browser
Published: 2026-07-25
A long-running malvertising operation called SourTrade (active since late 2024) delivers malware components in pieces and instructs victims’ browsers to assemble a unique Windows executable in memory using a legitimate Bun runtime. The campaign cloaks pages, impersonates TradingView, Solana, and Luno, and targets retail traders and crypto investors across 12 countries and 25 languages, deliberately defeating hash-based detection.
3. Steam Forum ClickFix Attacks Deliver XMRig Cryptominers
Published: 2026-07-25
Attackers are abusing Steam discussion forums with ClickFix-style lures that pose as solutions to game or computer problems. Victims are tricked into running commands that infect their systems with XMRig cryptominers, turning gaming communities into a distribution channel for malware.
4. Cl0p Affiliates Target PTC Windchill and FlexPLM with Unauthenticated RCE
Published: 2026-07-24
The Cl0p (Clop) ransomware group is actively exploiting a critical unsafe deserialization vulnerability (CVE-2026-12569, CVSS ~9.3) in internet-exposed PTC Windchill and FlexPLM product lifecycle management platforms. Attackers deploy JSP webshells, exfiltrate sensitive engineering and product data, and launch data-theft extortion campaigns targeting manufacturing, automotive, aerospace, and related sectors.
5. Hermes AI Agent Used to Automate Post-Exploitation on Thai Finance Ministry
Published: 2026-07-24
A threat actor ran the open-source Hermes AI agent in unattended “YOLO” mode on a rented server to automate post-exploitation activity during an alleged breach of Thailand’s Ministry of Finance. The incident highlights how agentic AI tools can accelerate and scale network reconnaissance, file access, and lateral movement once initial access is obtained.
6. Hackers Hijack Hotel and Conference Wi-Fi DNS to Steal Microsoft 365 Accounts
Published: 2026-07-24
Threat actors (linked by researchers to APT28-style activity) are compromising hotel and conference Wi-Fi gateways to perform DNS poisoning. Victims are redirected to fake Microsoft 365 login pages, enabling token theft and account takeover without traditional phishing emails.
7. Russian APT “Laundry Bear” Conducts Zero-Click Phishing via Zimbra Flaw
Published: 2026-07-23 / 2026-07-24
Russian state-supported actors tracked as Laundry Bear (also associated with “beehive”/Ulej) are exploiting a previously zero-day XSS vulnerability in Zimbra Collaboration Suite (CVE-2025-66376, patched November 2025) for zero-click (or half-click) phishing. Simply viewing a malicious email in a vulnerable webmail client can lead to theft of emails, directories, passwords, and 2FA tokens. The campaign has targeted Western government, defense, education, energy, and other organizations after earlier testing against Ukrainian entities.
8. RefluXFS: Nine-Year-Old Linux XFS Race Condition Enables Local Root Privilege Escalation
Published: 2026-07-22 (disclosure) / ongoing coverage July 23–24
Qualys disclosed CVE-2026-64600 (RefluXFS), a race condition in the Linux kernel’s XFS filesystem copy-on-write/reflink path present since kernel 4.11 (2017). An unprivileged local user can overwrite protected files (including setuid binaries or /etc/passwd) at the block layer, gaining persistent root privileges with no kernel logs. It affects default configurations on RHEL, Oracle Linux, Amazon Linux, Fedora, and other XFS-based systems (potentially millions of hosts). Patches are available; immediate kernel updates and reboots are required.
Stay Vigilant
Cyber threats continue to evolve rapidly—driven by AI agents, browser-based assembly techniques, unauthenticated RCEs in enterprise software, zero-click exploits, and long-lived kernel flaws. Subscribe to our newsletter for ongoing updates. Prioritize patching (especially internet-exposed PLM platforms, Zimbra, and Linux kernels with XFS), restrict ad-driven downloads of trading/crypto tools, enforce strong MFA and Conditional Access policies, monitor for unusual DNS changes on guest networks, and maintain robust endpoint and supply-chain controls. Stay safe online!