A critical flaw in the ServiceNow AI Platform is now being exploited in attacks. ServiceNow disclosed CVE-2026-6875 on July 13 in advisory KB3137947, describing it as a sandbox escape that lets an attacker bypass intended platform restrictions and execute code, and noting that exploitation does not require authentication. The AI Platform underpins much of the company's IT service management and workflow tooling, and the flaw affects both hosted and self-hosted deployments. ServiceNow deployed fixes to its hosted instances and released updates for self-hosted customers. Because these instances commonly connect to identity systems, cloud services, and endpoint management tools, a compromised one is a strong pivot point.
7-Zip has released version 26.02 to fix a remote code execution vulnerability that can be triggered when a user opens a specially crafted compressed file. The archiving tool is installed on a very large number of Windows systems and is routinely used to open attachments and downloads, so a flaw that fires on opening an archive is attractive to attackers who rely on phishing. There are no reports of active exploitation so far. Similar archiving tool flaws have been weaponized quickly in the past: a WinRAR vulnerability was used last year by a Russian group in phishing attacks to install malware, so patching early matters.
Hugging Face, the largest public repository of AI models and datasets, disclosed an intrusion into its production infrastructure that it says was driven end to end by an autonomous AI agent system. The attacker used code execution paths in the dataset processing pipeline for initial access, then harvested credentials and reached internal clusters, though the company found no evidence that public models or datasets were tampered with. The campaign ran thousands of actions across short lived sandboxes, with self migrating command and control staged on public services. Hugging Face's own AI assisted anomaly detection flagged it, and it has rotated affected credentials and rebuilt compromised nodes.
Ernst & Young is notifying clients of a breach at a third-party IT service management platform used by staff supporting its tax practice. Support tickets submitted through the platform could include attached documents containing client tax information, and the firm says an unauthorized third party accessed the platform between March 28 and April 12 and downloaded documents belonging to a number of clients. EY detected the activity on April 23, roughly two weeks after it stopped, and filed breach notifications with the California Attorney General in July. The exposed data includes personal and financial information used to prepare tax filings.
Researchers at XLab detailed NadMesh, a Go based botnet spreading since early July that hunts exposed AI and automation services rather than raw computing power. A reconnaissance module queries a public device search engine for internet facing instances of tools like Ollama, ComfyUI, n8n, Open WebUI, Langflow, and Gradio, then works through more than twenty exploitation paths. What it ships home is credentials: cloud access keys pulled from environment variables, Kubernetes service account tokens, and the contents of files like .env and Docker configuration. Callable tool endpoints on AI integration servers sit at the top of the operator's priority list, above Kubernetes and exposed Docker APIs.
Researchers at StepSecurity documented SleeperGem, a supply chain attack in which malicious versions of three RubyGems packages were published over two days, including one impersonating Microsoft's Git Credential Manager. Each release is a loader that fetches a second stage from an attacker controlled server, then checks around thirty environment variables that continuous integration platforms set. If it finds any, it exits and does nothing; on a developer machine it drops a native daemon and installs persistence. The accounts behind the packages were ordinary ones that had gone dormant for years, which is what made them attractive to hijack, and the releases had no matching source repository tags.
CISA has added two critical Fortinet FortiSandbox vulnerabilities to its exploited-vulnerabilities catalog and ordered federal agencies to patch them by July 19. Tracked as CVE-2026-39808 and CVE-2026-25089, both are operating-system command injection flaws that let an unauthenticated attacker run commands remotely with low complexity and no user interaction. Fortinet disclosed and fixed them in April and June, and threat intelligence firm Defused reported in-the-wild abuse of FortiSandbox flaws in June. FortiSandbox is a threat-detection appliance, and Fortinet gear sits at many network edges, so these devices are a recurring target in espionage and ransomware campaigns, making prompt patching important.
A vulnerability in the workflow automation platform n8n could let an attacker log in as another user without their password. Tracked as CVE-2026-59208, the flaw sits in n8n's Enterprise token exchange feature, which lets embedded deployments avoid a second login by accepting tokens from partner identity providers. Because the code did not properly bind an identity to its issuer, a valid token from one issuer that carried the identifier of a user under a different issuer would log the attacker in as that user. n8n shipped a fix on June 24, and there is no evidence of exploitation. The bug was found by an AI penetration-testing agent.
A researcher disclosed an unpatched flaw in internet-connected Shark robot vacuums that lets an attacker take control of other owners' units across the same cloud region. The certificate a vacuum uses to authenticate to its maker's Amazon cloud broker was never restricted to that one device, so a certificate pulled from a vacuum's flash memory can send root commands to any Shark vacuum the broker serves. That means watching the camera, driving the robot, reading the stored map of a home, and taking the Wi-Fi password in plaintext. No memory corruption or password guessing is needed. The researcher says the maker has had the report since March with no fix.
Coca-Cola disclosed in a securities filing that a ransomware attack on its Fairlife dairy subsidiary has disrupted operations and temporarily suspended production across the United States. The company said Fairlife detected unauthorized access to some systems, including production-related systems, and that it activated incident response and business continuity plans, brought in outside experts, and notified law enforcement. It says product quality and safety were not affected, and Canadian operations continue. The full impact is still being investigated, and no ransomware group has been named. Ransomware at food and beverage producers has caused weeks-long shutdowns and empty shelves in past incidents.
TrustStrike Labs