🚨 ACTIVE EXPLOITATION
-
Hacked Public Wi-Fi Gateways Used to Steal Microsoft 365 Corporate Credentials Threat actors hacked public Wi-Fi gateways to harvest Microsoft 365 credentials of traveling employees.
- Targets traveling corporate employees using public Wi-Fi at hotels, conference centers, and shared venues
- Compromises small office/home office (SOHO) Wi-Fi gateway appliances running captive portal networks
- Attackers modify DNS settings to redirect users to attacker-controlled infrastructure for credential theft
- Uses adversary-in-the-middle (AitM) technique to intercept traffic and harvest credentials
- Observed in US, India, and Saudi Arabia since at least June 2026, targeting multiple industries 📎 Coverage: securityweek.com · 👁 via SecurityWeek
-
Windows WalletService Flaw Lets Standard Users Escalate to SYSTEM Privileges A local privilege escalation vulnerability in Windows WalletService allows standard users to gain SYSTEM-level control.
- Affects Windows WalletService component used by the public Windows Wallet WinRT API
- Vulnerability arises from WalletService processing Wallet API requests using user-controlled Documents folder paths
- Attackers place a malicious wallet.db ESE database with persisted callbacks to load attacker-controlled DLLs
- Exploit grants code execution as NT AUTHORITY\SYSTEM without needing admin rights or memory corruption
- Microsoft patched the issue in July 2026 with update CVE-2026-49176 disabling legacy WalletService database path 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
💥 BREACHES & INCIDENTS
- Anubis Ransomware Hits Coca-Cola's Fairlife, Causing Data Breach and Production Halt
Anubis ransomware group breached Coca-Cola's Fairlife, stealing data and disrupting production.
- Targets Coca-Cola's dairy subsidiary Fairlife in the United States
- Anubis ransomware group encrypted systems and exfiltrated 1 TB of confidential data
- Attack led to suspension of Fairlife production at four US facilities
- Anubis uses double-extortion: encrypting files and threatening data leaks
- Coca-Cola resumed most production; data breach details remain undisclosed 📎 Coverage: securityweek.com · 👁 via SecurityWeek
🕵️ RESEARCH & DEEP DIVES
-
Critical RCE Vulnerability in Fastjson Java Library Actively Exploited Since July 2026 A remote code execution bug in Fastjson 1.x is being actively exploited in the wild.
- Affects Java projects using Alibaba's Fastjson library, specifically the older 1.x branch
- Vulnerability CVE-2026-16723 enables unauthenticated remote code execution
- Exploitation targets multiple sectors including finance, healthcare, computing, and retail
- Attackers exploit default Fastjson configurations and Spring Boot deployments
- Most observed attacks target organizations in the United States 📎 Coverage: news.risky.biz · 👁 via @campuscodi@mastodon.social (+1)
-
Claude Code Symlink Import Flaw Lets Malicious Repos Exfiltrate Local Files Claude Code's symlink import feature allows malicious repos to exfiltrate local files.
- Applies to Claude Code versions 2.1.207 and 2.1.215
- Vulnerability in memory import feature allows loading files outside repository via symlinks
- Malicious repos can import local readable files like /etc/passwd without user consent
- Imported file content is included in model's first outbound request, sent to Anthropic or attacker-controlled endpoints
- Issue arises from path checks using visible paths but following symlinks at read time, bypassing external import warnings 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
-
Top 10 Malware Families Used in Cyberattacks July 20-26, 2026, Led by Vidar, AsyncRAT, XWorm Vidar, AsyncRAT, and XWorm were the most uploaded malware samples in the week of July 20-26, 2026.
- Applies to Windows systems targeted by info-stealers and RATs in sectors like aerospace, finance, and education
- Vidar steals browser credentials, 2FA data, and crypto wallets; delivered via malvertising and trojanized GitHub repos
- AsyncRAT uses phishing emails with LNK files and multi-stage loaders; persists via startup scripts and code injection
- XWorm spreads through phishing ZIP attachments; uses fileless execution via process hollowing and exploits WinRAR and Excel flaws
- Other notable malware includes Remcos, Stealc, Lumma, Formbook, Quasar, AgentTesla, and DonutLoader, mostly spread by phishing 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
🔓 CVEs & KEV
- CVE-2026-49176 — Windows WalletService — CVSS 7.8 — local privilege escalation via malicious wallet.db loading [KEV]
- CVE-2026-16723 — Alibaba Fastjson 1.x — CVSS 9.0 — unauthenticated remote code execution [KEV]
ONE-LINERS
- java-spring-boot-heapdump-exposure — SANS ISC