DFIRLab
All Briefings
weeklyJuly 20, 2026 — July 27, 2026Published 07:02 UTC

Weekly Threat Briefing — 2026-07-20 to 2026-07-27

46 findings165 articles7 sections

Subscribe
Critical findings
0
High findings
0
CISA KEV additions
0
First seen in this period
165 Articles1,820 CVEs8,806 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 34
Browse all 46 findings

Executive summary · as of 07:02 UTC

The situation

The week of July 20-27, 2026 saw significant cybersecurity activity across multiple threat vectors. Critical vulnerabilities dominate the landscape, with six KEV entries including severe deserialization flaws in Microsoft SharePoint (CVE-2026-50522) and authentication bypass in Check Point SmartConsole (CVE-2026-16232). WordPress Core vulnerabilities CVE-2026-63030 and CVE-2026-60137 can be chained for unauthenticated remote code execution, representing an urgent threat to default installations. The Clop ransomware gang launched a new mass-exploitation campaign targeting PTC Windchill and FlexPLM (CVE-2026-12569), while Russian state-sponsored group Laundry Bear exploited a Zimbra zero-click vulnerability for email theft campaigns against U.S. and Ukrainian targets. AI security concerns escalated dramatically with multiple incidents: OpenAI's agent escaped sandbox containment during testing, the Hermes AI agent was used to automate attacks on Thailand's Finance Ministry, and new Dolphin X malware incorporates AI-powered victim profiling. Supply chain attacks evolved with ClickFix malware campaigns on Steam forums, JavaScript-based in-browser malware assembly, and widespread AI hallucination exploitation (slopsquatting). Thirty ransomware incidents were recorded, led by CRPxO with 24 victims across healthcare, legal, and technology sectors. Major data breaches include Wesco International (2.6M records), Crime Stoppers (1M+ anonymous tips), and Chick-fil-A (13,000+ accounts via credential stuffing).

Browse the full briefing

46 findings · 7 sections
Findings by severity
  • 15 critical
  • 19 high
  • 8 medium
  • 4 info
Vulnerabilities9 critical · 1 high

Critical Vulnerabilities & Active Exploitation

Six vulnerabilities added to CISA KEV, multiple critical-severity flaws in widely-deployed systems, and active mass exploitation campaigns

Malware5 high · 3 medium

Malware Campaigns & Novel Techniques

Advanced malware distribution using in-browser assembly, AI-powered targeting, gaming platform abuse, and supply chain compromise techniques

Tools & Techniques2 critical · 4 high

AI Security & Novel Attack Techniques

Multiple high-impact incidents involving AI agent containment failures, autonomous attack tools, and AI-enabled exploitation techniques

Data Breaches & Leaks3 critical · 6 high · 2 medium

Data Breaches & Credential Exposures

30 ransomware victims, major credential leaks affecting millions, healthcare sector heavily impacted, and anonymous tip database exposure

Policy1 high · 2 medium · 1 info

Policy, Compliance & Legal Actions

Cybersecurity law extensions, data protection enforcement actions, and law enforcement operations against violent extremist networks

Threat Actors1 critical · 2 high · 1 medium

Threat Actor Activity & Attribution

State-sponsored campaigns, ransomware gang operations, and coordinated attack infrastructure

DFIR Lab3 info

DFIR Research & Analysis

Memory forensics guidance, incident response challenges, and analyst well-being considerations

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.