A critical python.org vulnerability in the release management API allowed forged admin-level requests using a valid admin username and arbitrary API key. Python patched the flaw quickly, found no evidence of exploitation, and added URL validation, HTTPS enforcement, negative authentication tests, and longer log retention.

Russia-linked Turla uses compromised infrastructure to deliver STOCKSTAY, a .NET backdoor targeting Ukrainian government and military organizations and entities linked to Italian foreign policy interests. The campaign uses malicious RDP files, archive exploits, modular malware, WordPress staging, and encrypted WebSocket communication.

Multiple wolfSSL vulnerabilities expose billions of devices to certificate validation risk. The most serious flaw, CVE-2026-5194, affects hash digest and OID checks in wolfSSL certificate verification. Update to wolfSSL 5.9.1 now.

Windows drivers kill AV and EDR through BYOVD attacks before ransomware hits. Attackers load signed vulnerable drivers, terminate security processes from kernel mode, and deploy ransomware into a blind environment. Defenders need driver blocklists, HVCI, WDAC, and network-layer detection.

JADEPUFFER agentic ransomware used an LLM agent to breach Langflow, harvest credentials, and destroy Nacos data in minutes. Full attack chain and defense guide.

TeamPCP hackers are hijacking developer tools and CI/CD pipelines to steal cloud tokens, SSH keys, Kubernetes secrets, and package credentials. The FBI TeamPCP alert confirms the group’s TTPs and IOCs, while public research shows repeated compromise across Trivy, KICS, LiteLLM, Bitwarden CLI, and related developer tooling.

A Microsoft Edge flaw chain involving CVE-2026-45492, CVE-2026-45494, and CVE-2026-45495 creates remote code execution risk through crafted web content.

Chrome update fixes 27 security flaws, including five Critical vulnerabilities across Core, DigitalCredentials, Accessibility, GPU, and WebMIDI.

Cavern Manticore targets Israeli IT and government sectors with a modular .NET C2 framework and trusted provider supply chain access.

An AI PowerShell script mapped Active Directory in a real June 2026 attack using RDP access, stolen credentials, and custom enumeration logic.

Russian FSB attacks critical infrastructure by exploiting weak router hygiene, legacy SNMP, Cisco Smart Install exposure, and TFTP configuration theft. UK, US, and allied agencies warn that FSB Centre 16 continues to target critical networks. Fix router security now.

Microsoft patches record 622 flaws in July 2026, including exploited zero-days in SharePoint and AD FS. Security teams should patch the exploited flaws first, prepare for Kerberos RC4 hardening, and use threat-informed triage.