Key Takeaways
- Microsoft’s July Patch Tuesday fixed ~570 flaws, including two actively exploited zero‑days in SharePoint Server and Active Directory Federation Services.
- A pre‑authentication RCE in WordPress (wp2shell) puts over 500 million sites at risk of unauthenticated takeover.
- Attackers are increasingly targeting AI‑enabled workflows, demonstrated by flaws in Claude for Chrome, the GhostCommit prompt‑injection technique, and a GPT‑5/6‑Chrome exploit chain.
- Beyond software, hardware‑level issues such as a Dell BIOS admin‑password leak and a macOS stealer masquerading as crash reports show the broadening attack surface.
- Supplying‑chain and extension risks remain high, exemplified by the malicious ModHeader Chrome extension and compromised TP‑Link cameras.
Overview of the Week’s Threat Landscape
This week’s cybersecurity news underscores that virtually every layer of modern technology—from identity services and productivity suites to AI‑assisted tools and endpoint firmware—can be weaponized. High‑volume patch releases, zero‑day exploits discovered in the wild, and novel attack techniques targeting AI integrations illustrate how quickly adversaries move from disclosure to active abuse. The convergence of traditional software vulnerabilities with emerging AI‑related risks forces organizations to broaden their defensive posture beyond classic vulnerability management.
Microsoft’s July Patch Tuesday: 570 Vulnerabilities Fixed
Microsoft addressed roughly 570 security issues in its July 2026 Patch Tuesday cycle. Two of these were zero‑days already being exploited: CVE‑2026-56164 affecting SharePoint Server and CVE‑2026-56155 impacting Active Directory Federation Services (AD FS). A publicly disclosed BitLocker bypass bug was also remedied. The sheer volume and the presence of actively used zero‑days signal that threat actors are accelerating weaponization, compelling enterprises to prioritize rapid patch testing and deployment.
wp2shell RCE Vulnerability Hits WordPress
Researchers uncovered a critical pre‑authentication remote‑code‑execution flaw dubbed “wp2shell,” tracked as CVE‑2026-60137 and CVE‑2026-63030. The vulnerability stems from a REST API batch‑route SQL injection chain that allows unauthenticated attackers to execute arbitrary code on over 500 million WordPress installations. Because the exploit requires no credentials, it poses a sweeping risk to blogs, e‑commerce sites, and enterprise intranets that rely on WordPress. Immediate updates to the core and any affected plugins are essential.
LegacyHive Windows Zero‑Day PoC Released
Security researcher Nightmare‑Eclipse published a proof‑of‑concept exploit named LegacyHive that abuses the Windows User Profile Service. By leveraging a flaw in how registry hives are loaded, a standard user can gain access to another account’s registry hive, even on systems that have received the July 2026 patches. The PoC demonstrates that privilege‑escalation pathways persist despite recent fixes, highlighting the need for deeper hardening of user‑profile mechanisms and vigilant monitoring for anomalous registry access.
macOS Stealer Mimics Apple Crash Reports
A new macOS information‑stealing campaign disguises its payload as legitimate Apple crash‑report dialogs. When users click to view details, the malware prompts for administrative credentials or executes code that harvests passwords, browser data, and cryptocurrency wallets. The social‑engineering tactic leverages users’ trust in native system alerts, making detection difficult. Educating users to verify the authenticity of prompts and employing endpoint detection that flags abnormal dialog behavior are recommended mitigations.
EY Data Breach Exposes Client Tax Data
Ernst & Young confirmed that an unauthorized third party accessed its IT support ticket platform between March 28 and April 12, 2026, exfiltrating client tax and investment‑holding documents. The breach remained undetected for nearly three weeks, underscoring gaps in monitoring privileged support environments. Organizations should enforce strict least‑privilege controls on ticketing systems, enable detailed logging, and deploy anomaly‑detection tools to spot unusual data‑access patterns promptly.
Malicious ModHeader Chrome Extension Removed
The popular ModHeader extension, boasting 1.6 million installs, was pulled from the Chrome and Edge stores after researchers discovered dormant code capable of encrypting and uploading users’ browsing history to an external server. Although the malicious functionality was not active at the time of discovery, its presence illustrates the risk posed by widely adopted browser add‑ons that can be silently repurposed. Regular audits of extension permissions and reliance on vetted, open‑source alternatives can reduce exposure.
Notepad++ Patches Command Injection and Four Other Flaws
Notepad++ version 8.9.7 resolves a high‑risk installer‑time PowerShell command injection bug, alongside a stack buffer overflow, a Zip Slip path‑traversal issue, a session‑validation bypass, and a macro integrity bypass. The installer flaw could allow an attacker with local file‑write access to execute arbitrary code with elevated privileges during updates. Users should upgrade immediately and enforce code‑signing verification for installer packages to mitigate similar supply‑chain risks.
Active Directory Zero‑Day Exploited in the Wild
Threat actors are actively exploiting a zero‑day vulnerability in Active Directory‑related services, posing a direct risk to enterprise identity infrastructure. Successful exploitation can lead to credential theft, privilege escalation, or lateral movement across domains. Organizations must monitor for anomalous Kerberos tickets, enforce strict AD FS hardening, and apply out‑of‑band patches or mitigations as soon as they become available.
Dell BIOS Flaw Exposes Admin Passwords
A vulnerability in Dell BIOS firmware reportedly allows the exposure or extraction of administrator passwords, potentially compromising entire device fleets. Attackers with physical or remote management access could retrieve BIOS‑stored credentials, facilitating persistent footholds. Enterprises should verify BIOS versions, disable unnecessary remote management features, and consider using BIOS passwords stored in hardware security modules or centralized vaults where possible.
7‑Zip Vulnerability Enables Code Execution
A flaw in the widely used 7‑Zip archiving utility enables attackers to achieve code execution via specially crafted archive files. Given the tool’s prevalence in both personal and corporate environments, malicious archives delivered through email or download sites could lead to compromise. Users are advised to update to the patched version, disable automatic opening of archives from untrusted sources, and employ sandboxing for handling unknown files.
F5 Patches Multiple Nginx Vulnerabilities
F5 issued patches addressing several vulnerabilities affecting Nginx components within its product line. The flaws could allow request smuggling, buffer overflows, or authentication bypasses, potentially leading to service disruption or data leakage. Administrators running F5‑based load balancers or web application firewalls should prioritize applying the updates and review Nginx‑specific configurations for hardening.
Claude for Chrome Vulnerability Disclosed
A security flaw was identified in the Claude for Chrome browser integration, which could be exploited to execute unauthorized actions within the browser context. The issue highlights the expanding attack surface of AI‑assistant extensions that interact with web content. Users should restrict extension permissions, keep the extension updated, and consider disabling AI add‑ons when not required for specific tasks.
GhostCommit Attack Hides Malicious Prompts
The “GhostCommit” technique demonstrates how malicious AI prompts can be concealed inside ordinary code commits, thereby manipulating AI coding assistants without developers’ awareness. By embedding subtle instructions that influence model outputs, attackers could inject vulnerable code or backdoors during automated development workflows. Mitigations include enforcing strict commit signing, reviewing AI‑generated suggestions, and employing anomaly detection on commit metadata.
GPT‑5/6 “Sol” Chrome Exploit Chain Uncovered
Researchers detailed an exploit chain that combines GPT‑5/6‑era AI models (nicknamed “Sol”) with Chrome browser vulnerabilities to achieve stealthy code execution. The chain leverages AI‑generated content to bypass security checks, then chains it with a browser flaw to gain execution. This illustrates a nascent class of AI‑augmented attacks where generative models act as force multipliers for traditional exploits. Defense strategies must include runtime monitoring for anomalous script behavior and stringent content‑security policies for AI‑generated web interactions.
Multiple Splunk Enterprise Vulnerabilities Patched
Splunk released fixes for several vulnerabilities in its Enterprise product that could affect data integrity and platform security. The issues range from authentication bypasses to insecure deserialization flaws that might allow remote code execution. Splunk administrators should apply the patches promptly, review access controls on search heads and indexers, and enable audit logging to detect abnormal query patterns.
Fortinet Patches Seven Vulnerabilities
Fortinet’s routine advisory cycle included patches for seven vulnerabilities across its security portfolio, covering issues in FortiOS, FortiGate, and related products. The flaws could permit denial‑of‑service, privilege escalation, or information disclosure. Customers are urged to consult the specific advisories, apply the relevant updates, and verify that intrusion‑prevention signatures are current.
Dell Laptops Shutting Down After July Update
A separate issue from Dell causes certain laptop models to unexpectedly shut down following the July 2026 update, distinct from the BIOS password flaw. The problem appears tied to a power‑management driver conflict, leading to abrupt system halts. Affected users should check Dell’s support site for model‑specific workarounds or rollback guidance until a permanent fix is released.
AWS Cost Explorer Bug Raises Security Concerns
A bug discovered in AWS Cost Explorer reportedly creates unintended security or data‑exposure risks for customers monitoring billing data. The flaw could allow unauthorized access to cost‑and‑usage reports, potentially revealing sensitive usage patterns that aid attackers in reconnaissance. AWS users should review IAM policies governing Cost Explorer access, enable detailed billing alerts, and consider segregating billing data into tightly controlled accounts.
TP‑Link Cameras Vulnerability Disclosed
A security flaw affecting TP‑Link IP camera devices could allow attackers to compromise device functionality or access live video feeds. The vulnerability stems from improper authentication in the camera’s web interface, enabling remote command injection. Users should update firmware to the latest version, change default credentials, and place cameras behind network segmentation or VPNs to limit exposure.