These news items are automatically aggregated from industry sources and are not individually reviewed. Any inaccuracies are unintentional —
let us know and we'll correct or remove it.
CVE-2026-45659, a deserialization flaw in on-premises SharePoint Server patched in May with a CVSS score of 8.8, was tagged by Microsoft as unlikely to be exploited. CISA added it to its Known Exploited Vulnerabilities catalogue on July 1 after Storm-2603, the same actor behind 2025’s ToolShell campaign, was found deploying Warlock ransomware through it. The bar to trigger it is a low-privilege Site Member account, not an administrator.
July 14, 2026 is the final enforcement date in Microsoft’s multi-phase retirement of RC4 fallback in Kerberos authentication. The registry key that let administrators delay the change has been removed entirely, and domain controllers now expect explicit AES encryption types on every account. Organisations that never audited their legacy service accounts, network appliances, and older Unix integrations for RC4 dependency are about to find out about it through failed logons.
Black Kite’s first dedicated European Cyber Risk Report found ransomware incidents rose 55.1 percent year-over-year in the first four months of 2026, averaging 171 incidents a month. Germany, the UK, France, Italy, and Spain account for around 70 percent of activity, manufacturing is the most targeted sector, and supply chain compromise is becoming a primary route in, exactly the risk category NIS2 and DORA now hold organisations accountable for.
Researchers at Socket and Rescana have linked 108 malicious packages and browser extensions across npm, Packagist, Go modules, and the Chrome Web Store to a North Korean supply chain campaign called PolinRider, active since December 2025 and still expanding. The threat actors compromise maintainer accounts, hide payloads behind whitespace padding, and rewrite Git history so malicious commits look old and trustworthy. For any team pulling open source dependencies into a build pipeline, this is a live reminder that dependency trust is not a one-time check.
CVE-2026-61447, published on 11 July with a maximum CVSS score of 10.0, lets an attacker use prompt injection to make PraisonAI’s CodeAgent execute arbitrary Python on the host, because the code it generates runs with no AST validation, no import restrictions, and no sandbox. It is the latest in a run of critical PraisonAI vulnerabilities in 2026, following a May authentication bypass that was scanned within four hours of disclosure. For any business running agent frameworks in production, this is what the gap between AI agent hype and AI agent security engineering actually looks like.
The Gentlemen ransomware gang posted Spanish multinational and NATO contractor Indra Group to its dark web leak site on 30 June, giving the company roughly 236 hours before threatening to publish allegedly stolen data. Indra confirmed a ransomware incident limited to one subsidiary and says core services were never affected, but no data samples have surfaced publicly to confirm what, if anything, was taken. The Gentlemen have claimed more than 300 victims in the first half of 2026 alone, second only to Qilin, and remote access infrastructure keeps being the door they use to get in.
Zimbra shipped version 10.1.19 on July 7 to fix a stored cross-site scripting flaw in its Classic Web Client, one that lets a specially crafted email run malicious code the moment a recipient opens it, no click or attachment required. The bug was reported by Google’s Threat Analysis Group, the team that typically surfaces flaws already being used by well-resourced attackers. Zimbra remains a common self-hosted alternative to Microsoft 365 for European public bodies and SMEs on cost or sovereignty grounds, which makes patching this one a priority, not a backlog item.
AWS has expanded its DevOps Agent with two new preview capabilities, Release Readiness Review and Autonomous Release Testing, that move AI evaluation earlier in the pipeline: assessing every code change against organisational standards and generating change-specific test plans before it reaches production. AWS is explicit about the problem it is solving, AI coding assistants have made writing code fast while human review and release validation have become the bottleneck. For teams already drowning in AI-generated pull requests, this is a preview of what pipeline gatekeeping looks like next.
SP Page Builder, Page Builder CK, iCagenda, and Balbooa Forms were all added to CISA’s Known Exploited Vulnerabilities catalog between July 2 and July 10, and every single one shares the same root cause: an unauthenticated file upload endpoint that lets an attacker drop a PHP web shell and run it with no login at all. Three of the four carry a maximum CVSS score of 10.0. If your Joomla site runs any third-party extension you have not audited recently, this is the week to check.
The Unsafe ransomware group listed Deutsche Bank on its dark web leak site, publishing what it claims are employee database extracts, password hashes, and physical addresses. Deutsche Bank says its own network was never touched, the actual point of entry was a third-party company running a marketing and incentive platform for its sales partners. The distinction matters legally, but it matters far less to the employees whose data is now circulating, and it is precisely the scenario the EU’s DORA regulation was written to prevent.
This site uses cookies. By continuing to use this website, you agree to their use.
We’ll help you resolve your infrastructure challenges
Our team of experts is ready to help you with your infrastructure challenges. We’ll give you honest and personal treatment. Get in touch to learn more.
