Attackers began exploiting a critical Microsoft SharePoint flaw within days of a working proof-of-concept appearing publicly. CVE-2026-50522 is a deserialization of untrusted data issue rated 9.8 that lets a remote attacker run code on on-premises SharePoint without authentication, and Microsoft patched it in the July updates while marking exploitation as more likely rather than confirmed. Offensive security firm watchTowr reports active attacks against on-premises deployments, with attackers pulling SharePoint machine keys in a single request. Those keys let an attacker forge authentication tokens and impersonate users, so access survives patching. It is the third SharePoint flaw to see exploitation this month.
Arctic Wolf Labs investigated multiple intrusions in June that began by exploiting an authentication bypass in Palo Alto Networks PAN-OS and ended in Qilin ransomware. CVE-2026-0257 affects the portal and gateway components and lets an unauthenticated remote attacker establish a VPN session without valid credentials, but only where authentication override cookies are enabled alongside specific certificate configurations. That narrow precondition makes it easy to assume you are unaffected without checking. The flaw is patched. Because it grants VPN access rather than code execution, the intrusions look like ordinary remote logins at the start, which delays detection until ransomware is deployed.
Offensive security firm Manifold Security detailed a confused deputy flaw in Microsoft's official Azure DevOps MCP server, which lets AI agents read and operate Azure DevOps on a user's behalf across pull requests, pipelines, wikis, and work items, using that user's own permissions. One of the server's tools returns pull request descriptions without the prompt injection guardrail Microsoft had already applied to other tools. Because descriptions accept Markdown, an attacker can bury instructions in an HTML comment: the web interface renders it as nothing, so a reviewer sees an ordinary change, while the REST API returns the text verbatim and hands it straight to the agent.
Researchers at Intezer showed that a poisoned web page could take over AWS Kiro, an AI coding tool, by getting the agent to rewrite the file that governs what it is allowed to run. A prompt injection in fetched content drops custom code into the MCP settings file, which executes the moment the file is saved. The same write to execution path was demonstrated on Kiro's release day in July 2025 by another researcher, who also flagged writing to a Visual Studio Code settings file to allowlist shell commands. AWS added an approval prompt, but only in supervised mode, leaving the default autonomous mode writing the file unprompted.
Researchers at Pillar Security demonstrated sandbox escapes across four widely used AI coding agents: Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity. In nearly every case the agent never broke the sandbox directly; it only had to write a file that a trusted component outside the sandbox would later run, load, or scan. Failure modes included hook abuse, editing a virtual environment interpreter the editor then ran itself, planting Git metadata outside a .git folder to fire execution through fsmonitor, and a command allowlist that trusted a tool by name while the real invocation was not read only. Prompt injection in workspace content was the trigger.
Incident response firm Volexity detailed how attackers chained two SonicWall SMA1000 flaws as zero-days weeks before the vendor disclosed them, reaching root and installing malware built specifically for the appliances. A previously unknown actor it tracks as UTA0533 began exploiting on June 22, nearly three weeks before the July 14 advisory. The chain starts with CVE-2026-15409 against the /wsproxy endpoint, letting an unauthenticated attacker open WebSocket tunnels to services meant to be reachable only from the appliance itself, then uses CVE-2026-15410 for command execution. With root, the actor could read stored credentials, capture traffic, and intercept credentials the appliance processes.
Public exploit code is now available for wp2shell, a pair of WordPress core flaws that chain into pre-authentication remote code execution against a stock site with no plugins installed. CVE-2026-63030 is a route confusion bug in the REST API batch endpoint, which has shipped enabled by default since 2020, and CVE-2026-60137 is a SQL injection in the author parameter handling of WP_Query. Chained, an anonymous HTTP request can run code on the server. The chain affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, fixed in 6.9.5 and 7.0.2, and WordPress enabled forced automatic updates given the severity.
F5 patched a critical nginx vulnerability that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 sits in nginx's script engine, the code that builds strings from configuration directives at request time, and only surfaces under a specific configuration: a regex based map whose output is referenced in a string expression after an earlier regex capture. Under that pattern the engine's two pass evaluation disagrees on buffer size. Triggering it crashes or restarts the worker, and F5 says code execution may be possible where address randomization is disabled or bypassed. Fixes shipped July 15.
A critical flaw in the ServiceNow AI Platform is now being exploited in attacks. ServiceNow disclosed CVE-2026-6875 on July 13 in advisory KB3137947, describing it as a sandbox escape that lets an attacker bypass intended platform restrictions and execute code, and noting that exploitation does not require authentication. The AI Platform underpins much of the company's IT service management and workflow tooling, and the flaw affects both hosted and self-hosted deployments. ServiceNow deployed fixes to its hosted instances and released updates for self-hosted customers. Because these instances commonly connect to identity systems, cloud services, and endpoint management tools, a compromised one is a strong pivot point.
7-Zip has released version 26.02 to fix a remote code execution vulnerability that can be triggered when a user opens a specially crafted compressed file. The archiving tool is installed on a very large number of Windows systems and is routinely used to open attachments and downloads, so a flaw that fires on opening an archive is attractive to attackers who rely on phishing. There are no reports of active exploitation so far. Similar archiving tool flaws have been weaponized quickly in the past: a WinRAR vulnerability was used last year by a Russian group in phishing attacks to install malware, so patching early matters.
TrustStrike Labs