A researcher at depthfirst published a working exploit on July 24 for a GitLab flaw patched on June 10, running commands as the git user on any self-managed 18.11.3 server that has not updated. Any authenticated user who can push to a project can trigger it: the attacker commits a crafted Jupyter notebook and opens its commit diff to leak a heap pointer, repeats until an automated probe locates libraries in memory, then fires the payload with two more notebooks. No administrator rights, runner access, or victim interaction are needed. The bug sits in the notebook renderer, which passes repository-controlled data to a parser inside a long-lived worker.
Researchers published a working exploit on July 24 for Certighost, an Active Directory Certificate Services flaw that lets a low-privileged domain user obtain a certificate for a domain controller and authenticate as that machine. Because domain controller accounts hold directory replication rights, the resulting credential can extract the krbtgt secret through DCSync, effectively handing over the whole domain. Microsoft patched it in the July 14 updates as CVE-2026-54121, an improper authorization issue scored 8.8. Exploitation needs only network access and an ordinary domain account, with no administrator rights or user interaction, and it was tested against a default enterprise certificate authority setup.
Cl0p affiliates are exploiting internet-exposed PTC Windchill and FlexPLM product lifecycle platforms through an unauthenticated remote code execution flaw, in a data theft extortion campaign. Product lifecycle management systems track a product from design to retirement and hold computer-aided design files, bills of materials, engineering data, and workflows, making them a concentrated store of intellectual property for manufacturers in automotive, aerospace, defense, medical, and electronics. Cl0p's established pattern is mass exploitation of one enterprise product followed by extortion over stolen data rather than encryption. PTC patched a critical deserialization flaw in the Windchill data management component earlier this year that has already seen exploitation.
Researchers found that an official Vatican prayer app exposed the personal information of more than 700,000 users worldwide through an insecure configuration. The exposed data included details that can identify individuals and tie them to their use of the app. Faith and health apps are sensitive because the mere fact of using them can be revealing, and religious affiliation is a protected category in many jurisdictions, so even a modest data set carries outsized risk for the people in it. The exposure stemmed from the way the app's backend was set up rather than a sophisticated intrusion, a recurring pattern in mobile app data leaks where access controls are misconfigured.
GitHub is adding a default three-day cooldown before Dependabot opens pull requests for new package versions, aimed at supply chain attacks where a poisoned release spreads through automated updates before anyone catches it. Security updates that answer a known advisory still ship immediately; only routine version updates wait. GitHub points to the September 2025 compromise of chalk, debug, and other packages, whose crypto-stealing versions were live for roughly two hours, and notes its advisory database logged more than 6,500 npm malware advisories in the year to May 2026, around eighteen a day. Most malicious releases are caught within hours, so a short delay filters out the majority.
CISA, the FBI, NSA, EPA, and Department of Energy updated a joint advisory warning that Iran-affiliated actors are exploiting internet-facing operational technology across US critical infrastructure, and in some cases disrupting it. Since at least March 2026 the group has targeted programmable logic controllers, the small industrial computers that run automation processes, extracting device project files and then modifying or deleting the control logic. Water, wastewater, energy, and government facilities are among the affected sectors, and some victims experienced operational disruption and financial loss. The July update broadened the range of affected device makers, added detection guidance, and refreshed the published indicators of compromise.
Check Point has fixed an actively exploited flaw in SmartConsole, the graphical admin panel used to manage its security products. CVE-2026-16232, rated 9.3, is an authentication bypass letting an unauthenticated remote attacker obtain a login token and authenticate with administrator privileges, after which they can alter security configuration and policy on a Security Management or Multi-Domain Management server. Exploitation requires the management server to be reachable from the internet with no restrictions on trusted GUI clients. The same update fixes a second critical authentication bypass and a Gaia Portal issue letting read-only users run commands as root.
Qualys disclosed RefluXFS, a race condition in the Linux kernel's XFS copy-on-write path that lets an ordinary local user overwrite protected files and take root. Tracked as CVE-2026-64600, it triggers when two concurrent direct writes target the same reflinked file: the kernel briefly drops its inode lock, and a second writer can make the first write land on a stale block. The overwrite happens at the block layer, so ownership, permissions, timestamps, and the setuid bit stay untouched and no kernel log entry appears. Qualys reports it works with SELinux enforcing and estimates over 16 million affected systems.
Qualys disclosed a privilege escalation flaw in snap-confine, the component that builds the sandbox for every snap application. CVE-2026-8933, rated 7.8, affects default installations of Ubuntu Desktop 24.04, 25.10, and 26.04, and stems from a 2025 hardening change that moved snap-confine from a setuid root binary to a capabilities model, introducing a race during sandbox setup. An attacker mounts a filesystem over the temporary scratch directory, plants a symlink so a privileged write lands on another file, then drops a udev rule that makes a system service run commands as root. Fixes shipped July 21.
VulnCheck reports active exploitation of a path traversal flaw in Windmill, an open source platform for building internal tools, jobs, and workflows. CVE-2026-29059 lets an unauthenticated attacker read arbitrary files through the log file endpoint, and while observed attempts included reading the password file, the higher value target is the superadmin secret. Where that is configured, an attacker can authenticate as a super administrator and run arbitrary code through the job preview API. VulnCheck counted roughly 170 exposed instances across 24 countries, including deployments reachable through a proxy path rather than directly.
TrustStrike Labs