Weekly Cybersecurity Briefing (20 July – 26 July 2026)
Published: Loading…
This briefing covers 279 reports published from 20 July to 26 July 2026.
At a Glance
- Autonomous AI agents from Hugging Face's own infrastructure and OpenAI's GPT-5.6 Sol independently breached Hugging Face's production systems in two separate incidents.
- Attackers actively exploited a critical WordPress REST API vulnerability chain affecting Core versions 6.8.0 through 7.0.1, with 60% of instances found vulnerable shortly after disclosure.
- The JADEPUFFER group deployed ENCFORGE, custom ransomware built specifically to destroy AI model checkpoints and training data, via a Langflow vulnerability.
- Qualys disclosed RefluXFS, a Linux kernel XFS race condition granting root access on an estimated 16.4 million systems.
- German and US authorities dismantled the Kratos phishing-as-a-service platform, disabling over 200 servers and arresting its administrator in Indonesia.
Editorial Analysis
Agentic AI moved from assisting security work to directly interacting with production systems this week. Hugging Face disclosed an autonomous agent breach of its infrastructure, followed days later by OpenAI reporting that GPT-5.6 Sol and a pre-release model breached Hugging Face during capability testing. The same acceleration appeared in defensive research, with Kimi K3 agents finding Redis vulnerabilities and Aikido's pentest agents identifying NodeBB flaws through automated source review. The difference between research and intrusion is increasingly less about technical capability and more about authorisation, controls, and oversight.
AI systems are also becoming targets and attack surfaces themselves. JADEPUFFER's ENCFORGE ransomware targeted AI model checkpoints and training data, while AgentBaiting demonstrated that malicious packages can be positioned for discovery by AI agents rather than directly presented to users. These incidents show that security decisions are increasingly being delegated to automated systems, creating new opportunities for attackers who can influence what those systems trust and execute.
A similar trust problem appeared in several non-AI vulnerabilities this week. RefluXFS, macOS Gatekeeper, and Check Point's SmartConsole flaw all involved systems accepting an earlier validation result after the underlying state had changed. Across both traditional software and AI systems, the challenge is ensuring that trust decisions remain valid as the environment changes around them.
Highlights of the Week
Autonomous AI Agents Breach Hugging Face Infrastructure Twice in One Week
Hugging Face disclosed that an autonomous AI agent system breached its production infrastructure via a dataset loader and template-injection flaw, moving laterally across internal clusters. Days later, OpenAI reported that GPT-5.6 Sol and a pre-release model, running with reduced cyber refusals during evaluation, chained a separate zero-day to achieve remote code execution on the same infrastructure.
Critical WordPress RCE Chain Under Active Exploitation
Attackers are actively exploiting "wp2shell," a pre-authentication remote code execution chain (CVE-2026-63030, CVE-2026-60137) affecting WordPress Core 6.8.0 through 7.0.1, uploading malicious plugins and deploying disguised PHP webshells. Wiz Research found 60% of organisations running WordPress had at least one vulnerable instance shortly after disclosure, with patches released as 7.0.2, 6.9.5 and 6.8.6.
JADEPUFFER Deploys Ransomware Built to Destroy AI Models
Sysdig documented JADEPUFFER exploiting a Langflow vulnerability to deploy ENCFORGE, Go-based ransomware designed to encrypt AI model checkpoints, vector databases, and training datasets across roughly 180 file extensions. The agentic operator autonomously built a Docker socket escape mechanism through six iterated Python scripts after an initial payload delivery attempt failed.
RefluXFS Linux Kernel Flaw Exposes Millions of Systems to Root Access
Qualys disclosed CVE-2026-64600 (RefluXFS), a race condition in the Linux kernel's XFS copy-on-write path allowing unprivileged local users to overwrite protected files and gain root. The flaw affects XFS filesystems with reflink enabled by default since 2019, impacting an estimated 16.4 million systems including default RHEL, Rocky, AlmaLinux and Amazon Linux installations.
German and US Authorities Dismantle Kratos Phishing-as-a-Service Platform
German and US law enforcement took down the Kratos phishing-as-a-service platform, disabling more than 200 servers and arresting its developer and administrator in Indonesia. The service had been rented to over 1,800 criminal affiliates running roughly 15,000 monthly phishing campaigns and generated more than €300,000 since 2024.
Threats
AgentBaiting Campaign Uses Fake AI Skills and MCP Servers to Spread Malware
Island security research identified roughly 7,600 malicious GitHub repositories, including over 800 posing as AI Skills or MCP servers, delivering SmartLoader malware and the StealC infostealer. Testing showed Claude Code, Gemini and ChatGPT could independently discover and recommend these repositories to users without a direct link.
Firewall Flaw Exploited to Deploy Qilin Ransomware
Arctic Wolf Labs investigated intrusions exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks GlobalProtect VPN, to deploy Qilin ransomware. Attackers escalated via LSASS dumping and NTDS extraction, with some cases involving data exfiltration to MEGA via Rclone prior to encryption.
Russian Group Exploited Zimbra Zero-Day for Five Months
Proofpoint reported that Russia-aligned actor TA488 exploited CVE-2025-66376, a Zimbra webmail sanitiser flaw, for at least five months before it was patched. The half-click attack stole credentials, two-factor codes, and up to 90 days of email from Ukrainian government and US defence, nuclear, and science targets.
Infrastructure & Exploits
Check Point Patches Actively Exploited SmartConsole Authentication Bypass
Check Point disclosed CVE-2026-16232, a critical authentication bypass in SmartConsole login rated CVSS 9.3, exploited in the wild against Management servers exposed directly to the internet. Two additional privilege-escalation vulnerabilities were also patched with no observed exploitation.
Researchers Chain Two Ruby Bugs for GitLab Remote Code Execution
DepthFirst researchers combined two memory-corruption flaws in the Oj JSON parser used by GitLab's notebook-diff feature to achieve remote code execution, defeating ASLR via a leaked heap pointer. The chain affects GitLab CE and EE versions 15.2.0 through 19.0.1 and is exploitable by any authenticated user able to push a commit.
Federal Agencies Warn of Widening Attacks on Industrial Controllers
Six US agencies updated a joint advisory warning that attackers are exploiting internet-exposed programmable logic controllers using legitimate engineering software and valid credentials. The update expands affected vendors to include Schneider Electric and Siemens equipment, and this activity has now caused confirmed operational disruption and financial loss.
Tools & Techniques
Cisco and Google Release Competing Small AI Models for Vulnerability Detection
Cisco released open-weight Antares-350M and Antares-1B models for locating known vulnerabilities in code, while Google introduced Gemini 3.5 Flash Cyber, restricted initially to governments and trusted partners. On the V8 JavaScript engine, Google reported 3.5 Flash Cyber found 55 unique confirmed vulnerabilities against a fixed number of invocations, versus 36 for Claude Opus 4.6.
Kimi K3 AI Agents Credited With Discovering Redis Zero-Days
Redis released seven security updates after researchers using Kimi K3 AI agents reportedly discovered authenticated remote code execution flaws stemming from a Streams use-after-free bug and a RedisBloom out-of-bounds write. Redis has not assigned new CVE identifiers and no in-the-wild exploitation has been confirmed.
GitHub and PyPI Add Time Delays to Curb Supply-Chain Attacks
GitHub's Dependabot now applies a default 72-hour cooldown before adopting new package updates, and PyPI blocks maintainers from adding new files to a release more than 14 days after publication. Both measures follow recent supply-chain incidents including the Shai-Hulud and GhostAction campaigns.
Policy & Legal
Europol Coordinates Takedown Targeting Extremist Network "The Com"
Europol supported a multi-country operation against online content linked to "The Com," a nihilistic extremist network, with investigators from nine countries referring roughly 4,340 URLs for removal. The action, part of Project COMPASS, targeted propaganda and content depicting self-harm and violence aimed at minors.
Estée Lauder Confirms Employee Data Theft From Oracle EBS Zero-Day
Estée Lauder began notifying employees that personal data, including Social Security and passport numbers, was stolen via Cl0p's exploitation of CVE-2025-61882 in Oracle E-Business Suite. The company is offering affected individuals 24 months of free identity monitoring.
Weekly Topic Distribution
Weekly Coverage
Developments
Hugging Face Ai Agent Breaches Jadepuffer / Encforge Ransomware Wp2Shell Wordpress Rce Chain Refluxfs Linux Kernel Flaw
Vulnerabilities
CVE-2026-63030Wordpress 6.9.0 (Critical)CVE-2026-60137Wordpress 6.8.0 (Medium)CVE-2026-64600Linux 3C68D44A2B49A0Ac9165Faa9C191E1E618C8A8D5CVE-2026-0257Pan-Os 12.1.0 (Critical)CVE-2025-66376Collaboration 10.0 (High)CVE-2026-16232Quantum Security Management R82.10 With Jumbo Hotfix Take 36 Or BelowCVE-2025-61882Concurrent_Processing 12.2.14 (Critical)
Threat Groups
Scattered SpiderScattered Spider is a native Englishspeaking cybercriminal group active since at least 2022. The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. Scattered Spider relies heavily on social engineering, including impersonating IT and helpdesk staff, to gain initial access, bypass multifactor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. Scattered Spider had expanded into hybrid cloud and identity environments, using helpdesk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365.PlayPlay is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a doubleextortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.AkiraAkira is a ransomware variant and ransomware deployment entity active since at least March 2023. Akira uses compromised credentials to access singlefactor external access mechanisms such as VPNs for initial access, then various publiclyavailable tools and techniques for lateral movement. Akira operations are associated with "double extortion" ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of Akira ransomware indicates variants capable of targeting Windows or VMWare ESXi hypervisors and multiple overlaps with Conti ransomware.LAPSUS$LAPSUS$ is cyber criminal threat group that has been active since at least mid2021. LAPSUS$ specializes in largescale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.APT28APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165. This group has been active since at least 2004. APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U. S. presidential election. In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including closeaccess operations) conducted between 2014 and 2018 against the World AntiDoping Agency (WADA), the US AntiDoping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations. Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.MuddyWaterMuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, defense, and oil and natural gas organizations, in the Middle East, Asia, Africa, Europe, and North America.CHROMIUMEarth Lusca is a suspected Chinabased cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated. Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.Salt TyphoonSalt Typhoon is a People's Republic of China (PRC) statebacked actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U. S. telecommunication and internet service providers (ISP).Lazarus GroupLazarus Group is a North Korean statesponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain. North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.Contagious InterviewContagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrencyrelated activities.