Dental benefits administrator DentaQuest, part of Sun Life, is notifying more than 23 million people that their personal and health information was stolen in a May 2026 network intrusion. The company found unauthorized access on May 20 and determined attackers were in its network between May 17 and 20. Exposed data includes names, addresses, Social Security numbers, member, Medicaid, and Medicare identifiers, and dental and vision health details such as diagnoses, treatments, and billing. The extortion group ShinyHunters claimed responsibility and leaked roughly 234GB. DentaQuest has confirmed at least 15 million affected, with independent analysis putting the figure above 23 million, and is offering two years of monitoring.
An IoT botnet tracked as Dysphoria has adopted blockchain-based name services and relays built from its own victims after a March law enforcement operation disrupted related botnet infrastructure. Rather than hardcoding servers, it resolves command-and-control details through Ethereum and Solana naming systems, with addresses hidden inside fake IPv6 strings and recovered by a custom algorithm, which makes conventional server seizure harder. A separate relay build drops the attack modules and instead shuttles traffic between outside connections and remote servers through compromised devices. It spreads mainly through weak Telnet and SSH passwords and known device flaws. Researchers put its size above 200,000 bots, though that count is not independently verified.
Researchers detailed Cruciferra, a crypter service that packages Windows malware to evade detection using two notable techniques. It brings a vulnerable signed driver to disable security tooling, an approach known as bring-your-own-vulnerable-driver, and it uses process ghosting, where a malicious file is deleted before its code is mapped into a running process, so the running program has no backing file for tools to inspect. Together these let common payloads run while sidestepping many endpoint defenses. Crypter services matter because they lower the skill needed to deploy malware stealthily, letting many separate actors wrap their payloads in the same evasion layer rather than building it themselves.
Security firms ThreatBook and Imperva report attackers targeting a critical flaw in Fastjson, Alibaba's widely used JSON library for Java. On affected Spring Boot applications, a malicious JSON request can execute code without authentication, running with the privileges of the Java process. Tracked as CVE-2026-16723 with an Alibaba-assigned score of 9.0, the confirmed chain needs Fastjson 1.2.68 through 1.2.83, a Spring Boot executable fat-JAR, a network-reachable path that feeds attacker-controlled JSON to the parser, and SafeMode left at its disabled default. Notably, the AutoType feature can stay off and no classpath gadget is required. As of July 25, Alibaba had not shipped a fixed 1.x version.
A researcher at depthfirst published a working exploit on July 24 for a GitLab flaw patched on June 10, running commands as the git user on any self-managed 18.11.3 server that has not updated. Any authenticated user who can push to a project can trigger it: the attacker commits a crafted Jupyter notebook and opens its commit diff to leak a heap pointer, repeats until an automated probe locates libraries in memory, then fires the payload with two more notebooks. No administrator rights, runner access, or victim interaction are needed. The bug sits in the notebook renderer, which passes repository-controlled data to a parser inside a long-lived worker.
Researchers published a working exploit on July 24 for Certighost, an Active Directory Certificate Services flaw that lets a low-privileged domain user obtain a certificate for a domain controller and authenticate as that machine. Because domain controller accounts hold directory replication rights, the resulting credential can extract the krbtgt secret through DCSync, effectively handing over the whole domain. Microsoft patched it in the July 14 updates as CVE-2026-54121, an improper authorization issue scored 8.8. Exploitation needs only network access and an ordinary domain account, with no administrator rights or user interaction, and it was tested against a default enterprise certificate authority setup.
Cl0p affiliates are exploiting internet-exposed PTC Windchill and FlexPLM product lifecycle platforms through an unauthenticated remote code execution flaw, in a data theft extortion campaign. Product lifecycle management systems track a product from design to retirement and hold computer-aided design files, bills of materials, engineering data, and workflows, making them a concentrated store of intellectual property for manufacturers in automotive, aerospace, defense, medical, and electronics. Cl0p's established pattern is mass exploitation of one enterprise product followed by extortion over stolen data rather than encryption. PTC patched a critical deserialization flaw in the Windchill data management component earlier this year that has already seen exploitation.
Researchers found that an official Vatican prayer app exposed the personal information of more than 700,000 users worldwide through an insecure configuration. The exposed data included details that can identify individuals and tie them to their use of the app. Faith and health apps are sensitive because the mere fact of using them can be revealing, and religious affiliation is a protected category in many jurisdictions, so even a modest data set carries outsized risk for the people in it. The exposure stemmed from the way the app's backend was set up rather than a sophisticated intrusion, a recurring pattern in mobile app data leaks where access controls are misconfigured.
GitHub is adding a default three-day cooldown before Dependabot opens pull requests for new package versions, aimed at supply chain attacks where a poisoned release spreads through automated updates before anyone catches it. Security updates that answer a known advisory still ship immediately; only routine version updates wait. GitHub points to the September 2025 compromise of chalk, debug, and other packages, whose crypto-stealing versions were live for roughly two hours, and notes its advisory database logged more than 6,500 npm malware advisories in the year to May 2026, around eighteen a day. Most malicious releases are caught within hours, so a short delay filters out the majority.
CISA, the FBI, NSA, EPA, and Department of Energy updated a joint advisory warning that Iran-affiliated actors are exploiting internet-facing operational technology across US critical infrastructure, and in some cases disrupting it. Since at least March 2026 the group has targeted programmable logic controllers, the small industrial computers that run automation processes, extracting device project files and then modifying or deleting the control logic. Water, wastewater, energy, and government facilities are among the affected sectors, and some victims experienced operational disruption and financial loss. The July update broadened the range of affected device makers, added detection guidance, and refreshed the published indicators of compromise.
TrustStrike Labs