⚡ Weekly Cybersecurity News

Manual run date: July 27, 2026
Coverage window: July 20, 2026, 00:00 to the manual run time on July 27, 2026 (UTC+8)
Audience: CISOs, SOC teams, IT/security leaders, and APAC defence teams
Selection criteria: Only events first disclosed within the coverage window, or developments that received major new exploitation, attribution, victim-scope, or technical updates during the week, are included.

Official vendor advisories, government alerts, and original research were prioritised. Vendor confirmation, CISA KEV listings, third-party exploitation observations, researcher assessments, and attacker claims are presented separately according to their respective evidence levels.

---

Executive Summary — 10-Second Read

• 🔴 Network and collaboration control planes are under active exploitation. A Check Point SmartConsole authentication bypass can give an unauthenticated attacker full administrative control; Microsoft SharePoint CVE-2026-50522 has been added to CISA KEV and is being used to steal IIS/SharePoint machine keys; and the WordPress wp2shell vulnerability chain has seen widespread third-party exploitation activity.

• 🔴 Perimeter vulnerabilities are rapidly turning into ransomware intrusions. Arctic Wolf traced multiple Qilin incidents to PAN-OS GlobalProtect CVE-2026-0257, with attackers progressing from unauthorised VPN sessions to credential theft, lateral movement, data exfiltration, and domain-wide encryption.

• 🔴 State-backed email espionage continues. Russian state-supported LAUNDRY BEAR is exploiting a Zimbra “view-to-trigger” flaw to steal the previous 90 days of email, address-book data, 2FA scratch codes, application passwords, and OAuth information.

• 🟠 Development, AI, and engineering data are becoming high-value attack surfaces. Cl0p-linked extortion activity is targeting Windchill/FlexPLM; FakeGit created thousands of malicious repositories designed to deceive both humans and AI agents; and the ServiceNow AI Platform has seen third-party activity consistent with the public proof of concept.

• 🟠 APAC customer-data exposure risk is rising. Australia’s Origin Energy confirmed unauthorised access to and disclosure of some customer data, which could support targeted phishing, customer-service impersonation, and account-recovery fraud.

---

🔍 Major Incidents This Week

1. 🔴 Check Point SmartConsole Authentication Bypass Actively Exploited

CVE: CVE-2026-16232
Check Point CVSS: 9.3 — Critical
CISA-ADP CVSS v3.1: 9.1 — Critical
Analyst operational priority: 🔴 Critical
Exploitation status: Check Point confirmed in-the-wild exploitation; added to CISA KEV
Core risk: Full control of Security Management/Multi-Domain Management

CVE-2026-16232 affects Check Point Quantum Security Management and Multi-Domain Security Management.

An unauthenticated remote attacker can obtain an application login token and use it to establish a SmartConsole session with full administrative privileges.

Required Exposure Conditions

The main exploitation conditions described by the vendor include:

• The attacker can reach the Management Server IP over the network.
• Trusted Clients/GUI Clients are not restricted to trusted sources.

The following configurations further increase the risk:

• The Management Server is directly exposed to the Internet.
• There is no additional firewall, VPN, jump-host, or dedicated management-network protection.

Check Point states that known exploitation affected a small number of customers using a specific high-risk configuration. Smart-1 Cloud customers were already protected by the vendor.

Technical and Operational Impact

The Management Server sits at the top of the Check Point security trust chain. After a successful compromise, an attacker may be able to:

• Modify firewall policies and network objects.
• Alter VPN, logging, and threat-prevention settings.
• Create or modify administrators.
• Push malicious policies to multiple gateways.
• Establish new external or lateral access paths.
• Make subsequent malicious activity appear authorised by legitimate security policy.

CISA has added the vulnerability to KEV. CISA-ADP SSVC metadata also labels it as:

• Exploitation: Active
• Automatable: Yes
• Technical impact: Total

Immediate Actions

1. Install the latest Jumbo Hotfix released by Check Point on July 22.
2. Restrict Trusted Clients to approved management IP addresses and subnets.
3. Protect the Management Server through a management network, VPN, identity-aware access, or bastion host.
4. Hunt for unknown application tokens, abnormal management sessions, new administrators, and policy changes outside approved change windows.
5. Compare current policies against a known-good backup.
6. If compromise is suspected, inspect every managed gateway rather than addressing only the Management Server.

Primary Sources

• Check Point Security Advisory
• Check Point Support — sk185169
• NVD — CVE-2026-16232
• CISA Known Exploited Vulnerabilities Catalogue

---

2. 🔴 Microsoft SharePoint RCE Remains Under Exploitation; Compromised Trust Must Still Be Revoked After Patching

CVE: CVE-2026-50522
Microsoft CVSS v3.1: 9.8 — Critical
ZDI assessment: 8.1 — High attack complexity
Analyst operational priority: 🔴 Critical
Exploitation status: Confirmed exploitation; added to CISA KEV on July 22
Affected scope: On-premises SharePoint Server

Microsoft classifies CVE-2026-50522 as an unsafe deserialisation vulnerability.

ZDI published two advisories mapped to the same CVE, describing:

• Unsafe deserialisation in SessionSecurityTokenHandler.
• Insufficient session-token cryptographic-signature verification.

The public exploitation chain appears to combine forged-token handling with a deserialisation primitive, ultimately executing attacker-controlled code in the SharePoint server context.

Machine-Key Theft Creates Post-Patch Risk

After the public proof of concept appeared, researchers observed attackers extracting SharePoint/IIS machine keys.

These keys can be used to protect or validate:

• Application state.
• Authentication-related artefacts.
• Signed data.
• Encrypted tokens.
• Other trust-sensitive application values.

If the attacker has already obtained the relevant keys, installing the patch alone does not automatically invalidate the exposed cryptographic material.

Patch installed ≠ prior compromise removed

Public reporting previously contained inconsistent descriptions of whether exploitation required existing Site Owner privileges; Microsoft’s current CNA vector is PR:N. Defenders should therefore not reduce the priority on the assumption that authentication is required.

Correct Incident-Response Sequence

1. Patch every SharePoint farm node.
2. Complete the required PSConfig/configuration upgrade.
3. Investigate exploitation, web shells, and persistence.
4. Isolate and remove confirmed intrusion artefacts.
5. Rotate IIS/SharePoint machine keys.
6. Revoke affected sessions, service-account credentials, and application secrets.
7. Monitor for continued use of forged or previously issued application artefacts.

Hunting Priorities

• Abnormal requests to /_trust/default.aspx.
• Suspicious WS-Federation payloads.
• w3wp.exe launching PowerShell or cmd.exe.
• New or abnormal .aspx files.
• Web shells and unknown assemblies.
• Abnormal access to machine-key configuration.
• Unexpected sessions that continue after patching.

Primary Sources

• Microsoft MSRC — CVE-2026-50522
• Microsoft SharePoint Security Update — KB5002882
• CISA Known Exploited Vulnerabilities Catalogue
• Zero Day Initiative — ZDI-26-412
• Zero Day Initiative — ZDI-26-413

---

3. 🔴 Widespread Exploitation Observed for the WordPress Core “wp2shell” Vulnerability Chain

CVEs: CVE-2026-60137, CVE-2026-63030
Analyst operational priority: 🔴 Critical for Internet-facing WordPress installations
Vendor status: WordPress has released emergency security updates
Exploitation status: Active exploitation reported by third-party research and telemetry

Two WordPress Core vulnerabilities can be chained:

• CVE-2026-60137: SQL injection in the WP_Query author__not_in parameter.
• CVE-2026-63030: REST API batch-endpoint route confusion.

When combined, they form an unauthenticated remote-code-execution chain.

WordPress has officially released:

• WordPress 7.0.2.
• WordPress 6.9.5.
• WordPress 6.8.6.

Of these:

• Version 6.9 is affected by both vulnerabilities.
• Version 6.8 is affected only by CVE-2026-60137.
• Earlier branches should be assessed separately against the official support status and security advisories.

The official WordPress release post confirms the vulnerabilities and security versions but does not directly confirm in-the-wild exploitation. Active exploitation reporting comes from watchTowr, KEVIntel, and other third-party telemetry.

Observed Risks

Public reporting indicates that shortly after the fixes were released, activity included:

• Credential-hash theft.
• Abuse of REST API batch requests.
• Unauthenticated RCE.
• Creation of new administrators.
• Deployment of PHP web shells.
• Scanning and attacks from source IP addresses across multiple countries.

Immediate Actions

1. Do not update only plugins; WordPress Core itself must be updated.
2. Verify the actual running version rather than checking only automatic-update settings.
3. Hunt for newly created administrator accounts.
4. Review abnormal requests to the REST API batch endpoint.
5. Search for PHP or executable files in wp-content/uploads and other user-writable paths.
6. Check whether database credentials, password hashes, or configuration files were accessed.
7. Conduct a compromise assessment for sites that were publicly exposed and not patched promptly.

Primary Sources

• WordPress 7.0.2 Security Release
• NVD — CVE-2026-60137
• NVD — CVE-2026-63030
• The Hacker News — wp2shell Exploitation Reporting

---

4. 🔴 LAUNDRY BEAR Exploits Zimbra “View-to-Trigger” Vulnerability for Espionage

CVE: CVE-2025-66376
MITRE CNA CVSS v3.1: 7.2 — High
NVD CVSS v3.1: 6.1 — Medium
Analyst operational priority: 🔴 Critical for exposed, unpatched environments
Exploitation status: Exploited since at least July 2025; listed in CISA KEV
Threat actor: LAUNDRY BEAR/Void Blizzard/CL-STA-1114/TA488

The NSA and multiple international partners disclosed that Russian state-supported LAUNDRY BEAR is exploiting CVE-2025-66376 against Zimbra Collaboration Suite.

The victim does not need to:

• Click a link.
• Download an attachment.
• Enable macros.
• Enter an account password.

Simply viewing the malicious message in the vulnerable Classic webmail interface allows JavaScript to execute within the authenticated Zimbra origin.

Collection Targets

The Ulej capability described in the joint advisory attempts to collect:

• The previous 90 days of non-junk email.
• Global Address List data.
• 2FA scratch codes.
• OAuth consumer and device-status information.
• Existing application-specific passwords.
• Saved passwords exposed through autocomplete.
• Mailbox identity and authentication data.

The attacker also attempts to:

• Create an application passcode named ZimbraWeb.
• Enable additional mail protocols.
• Exfiltrate data over HTTPS or Base32-encoded DNS.
• Preserve mailbox access after the initial browser session ends.

Immediate Actions

1. Upgrade to Zimbra 10.0.18, 10.1.13, or later.
2. If immediate patching is impossible, stop using the vulnerable Classic interface.
3. Search for CSS @import, SVG onload, Base64, and XOR-obfuscated JavaScript.
4. Review CreateAppSpecificPasswordRequest, GetScratchCodesRequest, and high-volume GAL searches.
5. Hunt for bulk mailbox access covering approximately 90 days.
6. Review changes to application passwords, OAuth grants, mail protocols, and forwarding settings.
7. If compromise is suspected, revoke sessions, application passwords, and OAuth grants, then reset passwords and MFA.

Primary Sources

• Multinational Joint Cybersecurity Advisory — NSA and International Partners
• NSA Press Release
• Zimbra Security Advisories
• CISA Known Exploited Vulnerabilities Catalogue

---

5. 🔴 PAN-OS GlobalProtect Vulnerability Used in Qilin Ransomware Intrusions

CVE: CVE-2026-0257
Research publication date: July 20
Vendor severity: High — CVSS v4.0 7.8
Vendor urgency: Highest
Analyst operational priority: 🔴 Critical for exposed configurations
Exploitation status: Palo Alto Networks marks it as ATTACKED; confirmed use in Qilin ransomware intrusions

CVE-2026-0257 affects GlobalProtect portals and gateways that have Authentication Override cookies enabled and use a specific certificate configuration.

In affected configurations, an attacker can forge an Authentication Override cookie accepted by the device, thereby establishing an unauthorised VPN session.

Multiple intrusions investigated by Arctic Wolf used CVE-2026-0257 as the initial-access vector and ultimately led to Qilin ransomware deployment.

Follow-on activity varied from rapid encryption to full double extortion. This may reflect different playbooks or affiliates, but public evidence is insufficient to confirm that each incident was operated by a separate affiliate.

Observed Attack Chain

• LSASS dumping.
• ntdsutil/NTDS extraction.
• PsExec, PSEXESVC.exe, and administrative shares.
• Remote-access tools such as AnyDesk, Ngrok, and LogMeIn.
• Ransomware staging at C:\PerfLogs\win.exe.
• Clearing of Windows and PowerShell logs.
• Data exfiltration using Rclone, MEGA, Proton Drive, or FileZilla.
• Targeting of Veeam backup infrastructure.
• Domain-wide encryption and double extortion.

Immediate Actions

1. Upgrade every portal/gateway that generates or accepts Authentication Override cookies.
2. After patching, terminate existing GlobalProtect sessions and require users to reauthenticate.
3. If immediate patching is impossible, disable Authentication Override.
4. If the function must remain enabled, use a dedicated certificate that is not shared with other external services.
5. Hunt for successful VPN sessions without corresponding identity-provider authentication.
6. Search for source hostname kali, abnormal VPN geolocation, LSASS/NTDS access, and newly installed remote-management tools.
7. Treat any successful exploitation as a network compromise, not merely a firewall-patching issue.

Primary Sources

• Palo Alto Networks — CVE-2026-0257
• Arctic Wolf — CVE-2026-0257 Leads to Qilin Ransomware

---

6. 🔴 Cl0p-Linked Activity Targets Windchill/FlexPLM to Steal Engineering Data

CVE: CVE-2026-12569
Original security advisory: June 18
Patch update: July 14
Major intelligence development this week: Cl0p-linked data-theft/extortion reporting on July 24
Threat level: Critical
Exploitation status: Added to CISA KEV; Cl0p-linked extortion activity reported this week

PTC confirmed that CVE-2026-12569 allows an unauthorised attacker to remotely execute code on Windchill/FlexPLM and released patches, indicators of compromise, and web-shell hunting guidance.

The new intelligence this week is that multiple Windchill/FlexPLM data-theft and extortion incidents were found to have links to Cl0p infrastructure or its extortion workflow.

Observed activity included:

• JSP web shells.
• Remote command execution.
• Bulk downloads of product and engineering data.
• Cl0p extortion emails sent to victim organisations.

The identity of the initial exploit operator has not been fully established. The more accurate current description is therefore:

Cl0p-linked data-theft and extortion campaign

rather than attributing all initial-access activity directly to Cl0p.

High-Value Data Risk

Windchill/FlexPLM commonly contains:

• CAD and engineering documents.
• Bills of Materials.
• Product designs and manufacturing processes.
• Supplier, quality, and supply-chain data.
• Aerospace, defence, automotive, retail, and medtech intellectual property.

Immediate Actions

1. Apply the PTC patches and remove unnecessary public exposure.
2. Hunt for unknown JSP files, hexadecimal-named web shells, and abnormal Java subprocesses.
3. Review bulk engineering-document downloads and data exports.
4. If compromise is suspected, isolate the system and preserve forensic evidence.
5. Rotate credentials accessible to the server, database, suppliers, and downstream integrations.
6. Assess the downstream impact of engineering-data loss on product security, supply chains, and regulatory obligations.

Primary Sources

• PTC Trust Center — Windchill/FlexPLM Advisory
• CISA Known Exploited Vulnerabilities Catalogue
• BleepingComputer — Cl0p-Linked Extortion Reporting

---

7. 🟠 Origin Energy Confirms Unauthorised Access to and Disclosure of Customer Data

Confirmation date: July 23
Analyst-assessed impact: 🟠 Medium to High for confirmed affected customers
Incident status: Under investigation
APAC relevance: High

Australia’s Origin Energy confirmed that some customer data was accessed and disclosed without authorisation.

Potentially affected data includes:

• Names.
• Addresses.
• Dates of birth.
• Telephone numbers.
• Account information.
• The last four digits of credit cards.
• The last three digits of bank accounts.

Origin states that the incomplete credit-card and bank-account information cannot independently be used to conduct transactions. The company is working with the Australian Cyber Security Centre, Australian Federal Police, and privacy regulators.

The company has not confirmed the final number of affected individuals. External claims suggest approximately two million customer records were accessed, but this figure should not be treated as a confirmed breach count.

Defensive Priorities

• Increase monitoring for targeted phishing, customer-service impersonation, and refund scams.
• Do not treat names, addresses, dates of birth, or account-number suffixes as sufficient identity verification.
• Require out-of-band verification for changes to payment methods, contact information, credential resets, and MFA enrolment.
• Monitor account-recovery abuse, SIM swaps, and abnormal sign-ins.
• Remind customers that possession of real account information does not prove the caller or sender represents Origin, a bank, or a government agency.

Primary Sources

• Origin Energy — Data Security Incident Update
• Origin Energy — Customer Incident Update
• Reuters — Origin Energy Confirms Customer-Data Breach

---

8. 🟠 FakeGit Creates Malicious Repositories Designed to Deceive Both Humans and AI Agents

Research disclosure date: July 2026
Observed scale: Approximately 7,600 malicious repositories and 6,600 profiles
AI-themed repositories: More than 800 impersonating AI Skills or MCP servers
Primary payload: SmartLoader, followed by StealC

Researchers reported that the FakeGit campaign created large numbers of GitHub repositories impersonating popular software, AI Skills, MCP servers, game-modification tools, and development packages.

Attackers increased the credibility and search visibility of the malicious repositories through:

• SEO manipulation.
• Large networks of interlinked repositories.
• Fabricated stars, forks, and commit activity.
• Detailed README installation instructions.
• GitHub Releases and password-protected archives.

GitHub Release assets from approximately 200 campaign repositories accumulated more than 14 million downloads. This is a repository-asset download count, not a confirmed number of infected devices.

AgentBaiting Risk

In controlled testing, researchers found that some AI assistants could:

1. Independently search for a relevant tool.
2. Discover FakeGit repositories.
3. Treat malicious README content as trustworthy installation documentation.
4. Repeat or recommend attacker-prepared installation steps.

This demonstrates that AgentBaiting is a viable attack risk, but it does not mean that large-scale real-world infections have already been confirmed as being autonomously triggered by AI agents.

Immediate Actions

1. Create an approved allowlist for MCP servers, AI Skills, and developer tools.
2. Prevent agents from automatically downloading or executing unapproved software.
3. Test new tools in a sandbox or isolated environment.
4. Verify publisher identity, repository age, commit history, release artefacts, and package identity.
5. Do not treat stars, forks, README quality, or search ranking as sufficient evidence of trust.
6. Monitor shell, PowerShell, package-manager, and archive-extraction activity initiated by AI tools or developer assistants.
7. Hunt for SmartLoader, StealC, and related campaign artefacts.

Primary Source

• The Hacker News — FakeGit Campaign

---

⚠️ Exploitation and Exposure Watch

ServiceNow AI Platform CVE-2026-6875

Evidence status: Third-party telemetry captured activity matching the public proof of concept
Vendor status: ServiceNow has not identified related activity involving instances it hosts
Operator intent: Unconfirmed

Under specific conditions, CVE-2026-6875 allows an unauthenticated attacker to escape the ServiceNow sandbox and execute code within the ServiceNow AI Platform.

Defused initially stated that the captured payload used a sandbox-escape path different from the public proof of concept, but later corrected its assessment and confirmed that the payload matched the proof of concept published by Searchlight Cyber.

The operator and intent remain unconfirmed, so the activity cannot currently be distinguished among:

• Malicious exploitation.
• Security research.
• Opportunistic scanning.

This event should not be assigned the same evidence level as vendor-confirmed exploitation or a CISA KEV listing. Nevertheless, publicly exposed self-hosted or partner-managed instances should still be prioritised.

Immediate Actions

• Confirm that ServiceNow-hosted instances have received the applicable updates.
• Immediately update self-hosted and partner-managed instances.
• Verify the actual running build.
• Search for /assessment_thanks.do, sysparm_assessable_type, and javascript: query expressions.
• Review new administrators, Script Includes, OAuth applications, workflow changes, and MID Server jobs.
• If compromise is suspected, rotate API tokens, integration credentials, and downstream secrets.

Primary Sources

• ServiceNow Security Advisory — KB3137947
• Searchlight Cyber — Technical Research
• SecurityWeek — Defused Correction and ServiceNow Response

---

📊 Weekly Trend: Identity and Email Are Becoming Primary Ransomware Entry Points

Sophos commissioned a survey of 2,158 IT/security leaders whose organisations had experienced a ransomware attack during the previous year. The findings included:

• 79% of attacks began through identity-related methods.
• Malicious email and phishing together accounted for half of incidents.
• 56% of attacks successfully encrypted data.
• Average recovery cost rose to US$1.7 million.
• Median ransom demands and actual payments declined.

These figures come from a multinational respondent survey rather than complete market-wide incident telemetry. They are more suitable for identifying trends and should not be interpreted as the precise distribution of all ransomware incidents.

For defence teams, the signal remains clear:

• Email security.
• Session protection.
• Phishing-resistant MFA.
• Service-account governance.
• OAuth/application-password monitoring.
• Token revocation.

These have become ransomware controls that are just as important as vulnerability patching.

Primary Source

• Sophos — State of Ransomware 2026

---

🛡️ Weekly Priority Action List

P0｜Next 24 Hours

1. Patch Check Point Management, SharePoint, WordPress Core, Zimbra, PAN-OS GlobalProtect, and Windchill/FlexPLM.
2. Verify the update status of ServiceNow-hosted instances and update self-hosted/partner-managed instances.
3. Remove unnecessary Internet exposure from management planes, VPNs, CMS platforms, PLM systems, and email-management interfaces.
4. Start compromise assessments for systems that were publicly exposed rather than merely confirming that versions have been updated.
5. For SharePoint, conduct hunting and cleanup before rotating machine keys, sessions, and related secrets.

P1｜Next 72 Hours

1. Hunt for SmartConsole tokens, policy changes, SharePoint web shells, and abnormal WordPress PHP files.
2. Hunt for abnormal GlobalProtect sessions, LSASS/NTDS extraction, PsExec, and newly installed remote-management tools.
3. Hunt for Zimbra SOAP abuse, ZimbraWeb application passcodes, OAuth changes, and bulk mailbox access.
4. Hunt for Windchill JSP web shells and bulk engineering-document downloads.
5. Review unapproved MCP servers, AI Skills, and developer tools recommended or executed by agents.
6. Monitor for targeted phishing, customer-service impersonation, and payment-change fraud arising from the Origin Energy incident.

P2｜Within This Week

1. Build a control-plane asset inventory covering product, version, public exposure, MFA, source restrictions, owner, and downstream privileges.
2. Make “patching + compromise investigation + secret rotation + session revocation” the standard procedure for all perimeter vulnerabilities.
3. Apply branch protection, code review, and secret controls to every branch and workflow capable of triggering a release.
4. Establish an MCP/AI Skill/developer-tool allowlist.
5. Validate playbooks for domain recovery, offline backups, email exfiltration, product-IP leakage, and SaaS control-plane compromise.

---

Analytical Limitations

• WordPress active-exploitation assessment is based on third-party research/telemetry rather than official WordPress confirmation.
• ServiceNow activity matched the public proof of concept, but the operator and intent are unconfirmed, and the vendor has not confirmed related activity in hosted instances.
• Cl0p-linked extortion activity has been observed against Windchill/FlexPLM, but full attribution of the initial exploitation remains unresolved.
• FakeGit’s AgentBaiting risk has been demonstrated in controlled testing, but this does not establish that large numbers of real-world infections were autonomously triggered by AI agents.
• Origin Energy has not published the final number of affected individuals.
• Sophos figures are based on a respondent survey and are suitable for trend analysis, not as complete incident telemetry.

---

📌 Final Assessment

This week’s events reveal three clear trends:

1. Control planes are becoming primary targets. Check Point, SharePoint, ServiceNow, and WordPress can each allow an attacker to use a single entry point to influence broader policies, identities, content, or automation workflows.

2. Perimeter access is being converted directly into ransomware operations. The PAN-OS/Qilin cases show how one unauthorised VPN session can rapidly escalate into domain-credential theft, lateral movement, data exfiltration, and full-scale encryption.

3. Trust signals themselves are being weaponised. Legitimate email sessions, GitHub repositories, WordPress APIs, signed tokens, MCP/AI Skill descriptions, and genuine customer information can all be used to make malicious activity appear trustworthy.

The defensive conclusion this week is not merely “patch faster”:

After patching the vulnerability, organisations must also revoke the trust attackers may already have obtained—including tokens, sessions, machine keys, credentials, workflow privileges, management policies, and supply-chain release permissions.