DFIRLab
All Briefings
weeklyJuly 13, 2026 — July 20, 2026Published 07:02 UTC

Weekly Threat Briefing — 2026-07-13 to 2026-07-20

39 findings160 articles6 sections

Subscribe
Critical findings
0
High findings
0
CISA KEV additions
0
First seen in this period
160 Articles1,692 CVEs7,565 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 30
Browse all 39 findings

Executive summary · as of 07:02 UTC

The situation

This week's threat landscape is marked by critical remote code execution vulnerabilities across widely deployed platforms, including WordPress Core 'wp2shell' flaws with public exploits, 7-Zip RCE vulnerabilities, and SonicWall SMA zero-days actively exploited by Inc Ransomware. CISA has mandated immediate patching of actively exploited Fortinet FortiSandbox vulnerabilities by government agencies. The period saw a surge in ACR Stealer campaigns targeting enterprise customers to harvest browser credentials and authentication tokens, while new macOS malware ClickLock employs process termination tactics to force password disclosure.

Browse the full briefing

39 findings · 6 sections
Findings by severity
  • 12 critical
  • 18 high
  • 9 medium
Vulnerabilities6 critical · 2 high

Critical Vulnerabilities Requiring Immediate Action

Multiple critical RCE vulnerabilities with active exploitation and public exploits demand urgent patching, including WordPress Core, 7-Zip, SonicWall, and Fortinet platforms.

Malware1 critical · 5 high · 1 medium

Emerging Malware Campaigns and Threat Activity

Significant surge in ACR Stealer attacks targeting enterprises, new macOS information stealer, and sophisticated supply chain compromises via software updates.

Data Breaches & Leaks3 critical · 5 high · 1 medium

Data Breaches & Leaks

Major credential exposure affecting 23+ million Paidwork users, healthcare giant Abbott investigates dual breaches, and 30 new ransomware victims posted including critical infrastructure targets.

Tools & Techniques3 high · 3 medium

Emerging Attack Techniques and Tools

AI agent security vulnerabilities, sophisticated evasion techniques including SVG steganography, and novel authentication bypass methods characterize this week's evolving threat landscape.

Threat Actors2 critical · 3 high

Threat Actor Activity and Attribution

Multiple ransomware groups remain highly active with 30 new victim postings. North Korean APT continues developer-focused campaigns. Russian government agencies targeted by sophisticated supply chain attack.

Policy4 medium

Policy, Regulation, and Legal Actions

Regulatory enforcement actions and policy developments around data protection, age verification, and international surveillance legislation.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.