Trusted access and trusted infrastructure — developer accounts, package registries, VPN and CDN services, and enterprise identity systems — were common vectors across many of the week's most damaging incidents, from Fairlife to AsyncAPI and RubyGems.

Perimeter-focused defences proved less effective against attacks entering through legitimate credentials, compromised dependencies, or third-party infrastructure, highlighting the need for detection across CI/CD pipelines and identity workflows. Multiple unrelated npm, NuGet, and RubyGems compromises suggest maintainer-account takeover and CI token theft are becoming repeatable, low-cost initial-access techniques.

Patch cadence alone is also proving insufficient as the gap between vulnerability disclosure and exploitation continues to shrink, as seen with the SharePoint, FortiSandbox, and WordPress flaws.

On the defensive side, law-enforcement action — including Treasury sanctions, the Spanish takedown, and the TfL sentencing — offers a counterpoint to the technical trends, showing that disruption and prosecution remain possible even as attack methods continue to evolve.

Coca-Cola disclosed that its Fairlife subsidiary detected unauthorised access to production-related systems connected to a ransomware attack. The company suspended US manufacturing, notified law enforcement, and confirmed Canadian operations were unaffected. No group has claimed responsibility, and data theft has not been confirmed.

Microsoft's July 2026 Patch Tuesday addressed 622 vulnerabilities, including 59 critical flaws and three publicly disclosed zero-days. Two zero-days, in Active Directory Federation Services and SharePoint Server, were under active exploitation. Microsoft also paused rollout for some Dell Intel-based devices over shutdown issues.

Searchlight Cyber disclosed a pre-authentication remote code execution flaw in WordPress Core exploitable by an anonymous user with no plugins installed. The bug affects versions 6.9.0–6.9.4 and 7.0.0–7.0.1, spanning an estimated 500 million sites. Fixes shipped in versions 7.0.2 and 6.9.5.

SonicWall disclosed CVE-2026-15409, a maximum-severity SSRF flaw, and CVE-2026-15410, a privilege escalation bug, in SMA1000 appliances. Rapid7 observed attackers chaining both to gain root, harvest credentials and TOTP seeds, then move laterally into Active Directory. Fixes are available in hotfix versions 12.4.3-03453 and 12.5.0-02835.

Thalha Jubair, 20, and Owen Flowers, 18, were sentenced to five years and six months each for the 2024 Transport for London cyberattack. The intrusion cost TfL £29 million and disrupted 148 internal systems, forcing 27,000 employees into in-person password resets. The National Crime Agency named both as leading Scattered Spider members.

Proofpoint identified two campaigns spoofing OAuth client IDs against Microsoft Entra ID to enumerate accounts without generating sign-in events. UNK_pyreq2323 used over 700,000 spoofed IDs from AWS infrastructure, triggering lockouts for 28% of one million targeted users. UNK_OutFlareAZ separately targeted more than 2 million users via Cloudflare infrastructure.

CISA confirmed active exploitation of three SharePoint Server vulnerabilities enabling remote code execution and theft of IIS machine keys via deserialization. All three were added to the Known Exploited Vulnerabilities catalogue, with CVE-2026-56164 added on 14 July. CISA published detection signatures for post-exploitation activity.

Symantec found the kernel-mode rootkit Daxin active on a Taiwan-based manufacturing subsidiary alongside a previously undocumented backdoor, Stupig, which executes commands as SYSTEM from the Windows logon screen. Both samples carry 2013 compile timestamps. Initial access likely came through an outdated Digiwin single sign-on portal.

Group-IB discovered ClickLock Stealer, a modular macOS malware likely distributed via ClickFix phishing pages using compromised WordPress domains. The malware kills system processes to force victims into entering their password, then targets eight browsers, 31 crypto wallet extensions and macOS Keychain. At least 100 victims across 33 countries have been affected since May 2026.

SAP released 20 security notes led by CVE-2026-44747, a memory corruption bug in NetWeaver Application Server ABAP rated 9.9. CVE-2026-27690, an HTTP request smuggling flaw in Approuter, and CVE-2026-44761, hardcoded OAuth2 credentials in Commerce Cloud, were both rated 9.1.

Unit 42, working with Siemens, disclosed a three-vulnerability exploit chain in ROX II operational technology switches. The chain begins with an arbitrary file disclosure flaw, escalates through command injection, and achieves persistent root-level code execution via the device's task scheduler. Siemens recommends updating to firmware version V2.17.1.

Researcher Stan Shaw disclosed CVE-2026-42533, a missing state-restore bug in nginx's script engine allowing an unauthenticated attacker to trigger a heap overflow or ASLR-defeating information leak. The flaw spans thirteen call sites across versions 0.9.6 through 1.30.3. F5 released fixes on 15 July 2026.

Progress Software confirmed a path traversal vulnerability in ShareFile Storage Zone Controller prompted an emergency shutdown, affecting all 5.x and 6.x versions. The flaw let authenticated administrators read and write arbitrary files and enumerate the file system. Fixes shipped in versions 5.12.5 and 6.0.2.

Attackers stole a privileged GitHub Actions bot token to publish five compromised AsyncAPI npm package versions carrying an import-time loader. The loader fetches an encrypted Miasma runtime via IPFS for command-and-control and persistence. Credential-harvesting and propagation modules were present but disabled, with active C2 infrastructure identified.

Attackers compromised dormant RubyGems maintainer accounts to publish malicious versions of git_credential_manager and other packages. The loader, SleeperGem, evades roughly thirty CI environment checks and installs a daemon with systemd and cron persistence on developer machines. Systems with passwordless sudo have privileges escalated and a disguised root shell planted.

Kaspersky identified OkoBot, a framework of more than 20 malicious payloads delivered via the TookPS downloader over an SSH tunnel, targeting cryptocurrency users since early 2025. Infection spreads through ClickFix attacks and fake GitHub repositories, deploying plugins that phish hardware wallet seed phrases and record keystrokes. Hundreds of victims were reported across more than 25 countries.

Socket identified 11 malicious NuGet packages posing as game utilities and bots that fetch a second-stage Windows payload from GitHub Releases and Hugging Face. The packages resolve download hosts via DNS-over-HTTPS to bypass local resolvers and sinkholes. Recovered payloads authenticate to Google Sheets and bind activations to hardware.

The US Treasury designated First VPN Service, its administrator, and a cryptor seller for supporting ransomware operations against American businesses and hospitals. First VPN Service supplied infrastructure used to hide attack origins and manage stolen data. The action follows a May 2026 takedown of the service's infrastructure by European law enforcement with FBI support.

Spanish Police, with Interpol and Europol, dismantled a network that generated €140 million through investment fraud and business email compromise, arresting four suspects. The network used more than 800 bank accounts and 67 money mules to launder €94 million. Authorities raided six premises and froze €3 million in crime proceeds.

The EU and UK jointly sanctioned dozens of Russian individuals and entities and formally attributed the December 2025 attack on Poland's power grid to FSB Centre 16. A joint advisory from the NCSC and agencies across 12 countries detailed how Centre 16 exploits routers using weak SNMP credentials. The UK separately charged five people linked to the Russian Coms call-spoofing platform.

A former DigitalMint ransomware negotiator was sentenced to 70 months in prison for leaking client data to the BlackCat ransomware group. Separately, an Armenian man extradited from Ukraine pleaded guilty to charges tied to the Ryuk ransomware operation.