Coverage: Last 72 hours

Today’s Highlights

The threat landscape this week is dominated by active exploitation: zero-days in major remote access and web server platforms, critical open source project supply chain incidents, and credible breaches at infrastructure-scale providers. Defenders must act with urgency on cloud credentials exposure, patching, and software integrity to guard against cascading attacker advantages. Heavy targeting of browser, AI, and public CMS ecosystems reinforces the need for proactive patch management and hardening, particularly as attackers exploit both novel and recurring weaknesses in internet-exposed infrastructure.

Table of Contents

1. Chrome 150 Update Patches Severe Memory Safety Bugs
2. SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines
3. Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
4. New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
5. OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests
6. GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft
7. SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access
8. WP2Shell WordPress Vulnerabilities Exploited in the Wild

Top Stories

Chrome 150 Update Patches Severe Memory Safety Bugs

Source: SecurityWeek | Risk: Critical | Impacted: Chrome enterprise managed endpoints, VDI and kiosk environments using Chrome, Users processing sensitive data in browser

Summary: The fresh security update resolves six critical and high-severity use-after-free vulnerabilities. The post Chrome 150 Update Patches Severe Memory Safety Bugs appeared first on SecurityWeek.

Why it matters: Critical browser memory safety bugs enable remote attackers to execute code or escape sandboxes during drive-by attacks, potentially leading to mass exploitation before organizations can enforce patch adoption.

Practitioner Perspective

With Chrome 150 resolving multiple high/critical use-after-free vulnerabilities, attackers racing to develop or sell zero-day exploits present immediate risk to all business endpoints. Since browsers are the de facto platform for initial compromise vectors, especially on staff laptops and BYOD, even a modest patch lag creates substantial exposure. Security teams must not assume default auto-update policies catch high-risk or VDI use cases. Web-facing organizations or those enabling browser-based sensitive transactions are at highest risk. The fastest possible update for all supported Chrome channels is non-negotiable this week.

Recommended Actions

• Enforce Chrome 150 (or latest available) deployment to all managed endpoints, including kiosk/VDI clones and persistent sessions
• Scan for fleet coverage on past-due Chrome versions and block or warn on web access until compliant

Emerging Signals

SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines

Source: The Hacker News | Risk: High | Impacted: Engineering teams using RubyGems, CI/CD pipeline operators for Ruby projects, Security operations maintaining Ruby environments

Summary: Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads. The rogue gems are listed below – git_credential_manager (versions 2.8.0, 2.8.1, 2.8.2, 2.8.3) – Published on July 18, 2026 Dendreo (versions 1.1.3, 1.1.4) –

Why it matters: Supply chain compromise via poisoned RubyGems packages can trigger silent compromise during routine development or CI/CD activity, leading to undetected attacker persistence within software pipelines.

Practitioner Perspective

Teams building with Ruby face heightened risk as attackers increasingly target developer trust chains by seeding malicious gems under plausible names. Even a single install can grant attackers initial access, with payloads potentially able to establish persistence deep in build pipelines. CI environments that lack egress controls or network segmentation are especially exposed. This supply chain dynamic shifts the burden to proactive detection and defense within both developer endpoints and automated systems. The imperative: every gem artifact should be scrutinized for provenance, especially following malicious campaign reports.

Recommended Actions

• Block installs of git_credential_manager (2.8.0-2.8.3) and Dendreo (1.1.3-1.1.4) on developer systems and CI/CD runners
• Hunt for usage/audit logs of the three flagged malicious gems in internal code and build artifact repositories

Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution

Source: The Hacker News | Risk: Critical | Impacted: NGINX reverse proxies (1.30.3 and below), NGINX Plus before 37.0.3.1, Internet-exposed application servers

Summary: F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 was patched on July 15 in nginx 1.30.4 (stable) and 1.31.3 (mainline), and in NGINX Plus 37.0.3.1; anyone on an earlier build should upgrade. Triggering it can crash or restart the

Why it matters: Critical remote code execution vulnerabilities in widely deployed web server stacks can provide unauthenticated attackers with immediate access to internal networks and sensitive apps through public-facing hosts.

Practitioner Perspective

NGINX serves as a core proxy and web tier for countless production workloads. The vulnerability (CVE-2026-42533) affecting both NGINX OSS and NGINX Plus can be triggered remotely and threatens business continuity through process crashes or potentially full system takeover. With existing proof of concept and accelerated patching advice from F5, unpatched instances essentially offer external actors a trivial entry point. Cloud edge and DMZ deployments lacking a rapid update path are at particular risk. The minimum viable defense is urgent patch prioritization ahead of any public exploit widespread use.

Recommended Actions

• Upgrade all NGINX OSS to 1.30.4/1.31.3 and NGINX Plus to 37.0.3.1 to address CVE-2026-42533
• Scan public IP ranges for outdated NGINX versions specifically on external web tiers

New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

Source: The Hacker News | Risk: Critical | Impacted: WordPress site operators, Hosting providers with mass WordPress deployments, Organizations segmenting by public CMS usage

Summary: Updated July 18, 2026: the two flaws now carry CVE IDs, the full mechanism has been published, a persistent-object-cache condition has surfaced, and a working proof-of-concept is public. An anonymous HTTP request can run code on a WordPress site. The bug is in core, so a bare install with zero plugins is exploitable.

Why it matters: Unauthenticated remote code execution in default WordPress installations creates a mass exploitation opportunity for attackers to automate site hijack and further propagate malware or spam.

Practitioner Perspective

A default WordPress site with no plugins or custom themes is now trivially exploitable via public proof-of-concept attacks related to the core bug. This changes the calculus for defenders: all public WordPress sites, not just those with shoddy plugins, are viable initial access vectors. The risk of widespread defacement, abuse for phishing, or as staging for secondary attacks rises sharply. Mass scanning and exploitation are expected. Risk owners must prioritize site takedown or patching immediately, delaying escalates exposure to opportunistic adversaries.

Recommended Actions

• Patch all affected WordPress installations with the latest core update addressing wp2shell vulnerability
• Block or alert on public PoC signatures for the anonymous HTTP request exploit used for RCE

OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests

Source: The Hacker News | Risk: Medium | Impacted: Internet-facing Linux servers using OpenSSL, Services on glibc systems without TLS DoS protections, Web hosts with memory-sensitive workloads

Summary: Eleven bytes will make an unpatched OpenSSL server set aside up to 131 KB of memory for a message that never arrives. On the glibc systems Okta tested, that memory is gone until the process restarts. OpenSSL shipped the HollowByte fix in June with no CVE, no advisory, and no changelog entry pointing at it. Okta’s Red Team, which reported

Why it matters: Resource exhaustion bugs in widely used cryptography libraries like OpenSSL may enable new classes of denial-of-service attacks that evade traditional mitigation due to minimal attacker effort.

Practitioner Perspective

OpenSSL’s HollowByte flaw enables attackers to reliably freeze server memory allocation using tiny TLS requests, particularly on glibc-based systems where the memory is not reclaimed until process restart. This subtly degrades availability and can facilitate broader exploitation if left unaddressed. The lack of a CVE or official OpenSSL communication at publication increases the difficulty of tracking remediation. Any service relying on OpenSSL, especially those exposed to the public internet, should prepare for non-traditional DoS probing. The action gap: attackers can leverage information asymmetry to cause business impact before defenders recognize the risk.

Recommended Actions

• Upgrade OpenSSL to June 2026 or later releases containing the HollowByte fix (no CVE assigned)
• Automate detection and restart of server processes that exhibit abnormal memory usage patterns post-TLS negotiation

GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft

Source: The Hacker News | Risk: High | Impacted: Software vendors using DigiCert signing, End-user environments relying on code-signing for trust, Enterprises with strict driver and application whitelisting

Summary: Cybersecurity researchers have attributed the April 2026 DigiCert security incident to a threat activity cluster dubbed CylindricalCanine. Expel, which shared technical details of the event, described the threat actor as a sub-group of GoldenEyeDog (aka APT-Q-27, Dragon Breath, and Miuuti Group), a Chinese cybercrime group known for its targeting of the gambling and gaming sectors using

Why it matters: Theft of code-signing certificates from major certificate authorities can undermine software trust chains and allow attackers to sign malware that bypasses endpoint controls.

Practitioner Perspective

The DigiCert breach by a subgroup of GoldenEyeDog spotlights how compromise at infrastructure providers rapidly translates to organizational downstream risk. Compromised code-signing certs permit attackers to craft convincingly signed malicious payloads that evade default security controls and user scrutiny. Organizations with internal or third-party apps signed via DigiCert’s process should monitor for certificate revocations and unauthorized signing activity. This pattern aligns with evolving targeting of trust infrastructure by both crime and nation-state actors. The main concern: traditional binary and driver validation mechanisms may be rendered ineffective during incident windows.

Recommended Actions

• Inventory applications and internal code signed with any DigiCert certificates since April 2026 for anomalous or unexpected issuances
• Intensify monitoring for new files or binaries signed with certificates revoked in response to the DigiCert breach

Exploits & CVEs

SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

Source: The Hacker News | Risk: Critical | Impacted: SonicWall SMA 1000 administrators, Remote access infrastructure teams, Corporate VPN users

Summary: A previously undocumented threat actor has been attributed to the exploitation of recently disclosed SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances as zero-days prior their public disclosure since June 22, 2026. Cybersecurity company Volexity is tracking the activity under the moniker UTA0533. The discovery was made following an incident response investigation earlier this

Why it matters: Attackers using zero-day exploits against popular remote access appliances negates perimeter controls, exposing sensitive infrastructure to full administrative compromise well before patches are released.

Practitioner Perspective

The exploitation of SonicWall SMA 1000 series devices before responsible disclosure removes defenders’ time advantage, leaving all unpatched appliances essentially under attacker control. Organizations relying on these VPNs for secure remote access must treat any recent activity as potentially compromised, especially given the established pattern of zero-day exploitation in remote access hardware. Security teams should assume opportunistic and targeted post-exploitation actions, including credential harvesting and network lateral movement. Preparedness for device reimaging and credential rotation must be built into incident response planning for this class of product. The key lesson: remote access gear is a prime first target for advanced actors, and routine patch readiness is non-negotiable.

Recommended Actions

• Immediately patch all SonicWall SMA 1000 series appliances with latest security updates released post-June 22, 2026
• Rotate VPN credentials and instrument increased logging for all administrator logins on affected appliances

WP2Shell WordPress Vulnerabilities Exploited in the Wild

Source: SecurityWeek | Risk: Critical | Impacted: Unpatched WordPress installations, Public-facing web teams, Shared hosting platforms

Summary: Exploitation of the new WordPress vulnerabilities tracked as CVE-2026-60137 and CVE-2026-63030 started soon after disclosure. The post WP2Shell WordPress Vulnerabilities Exploited in the Wild appeared first on SecurityWeek.

Why it matters: Active exploitation of CVE-2026-60137 and CVE-2026-63030 in production WordPress sites enables rapid attacker access and compromise, with the potential for sitewide takeover or malware deployment.

Practitioner Perspective

Now that both identified core WordPress vulnerabilities are being exploited in real-world attacks, defenders can expect mass scanning targeting sites running outdated versions. Since exploit attempts began immediately after disclosure, any site not patched is at crisis-level risk. This is not limited to plugin-heavy or legacy WordPress; default configurations are exposed. This event highlights once again that slow patch cycles are unsustainable on public internet software with a huge threat actor focus. Site operators must skip change windows and move to emergency patch status.

Recommended Actions

• Apply authentication and code-execution patches for CVE-2026-60137 and CVE-2026-63030 on all WordPress sites
• Review web traffic and logs since vulnerability disclosure for exploit attempt indicators

Defensive Actions

• Enforce Chrome 150 (or latest available) deployment to all managed endpoints, including kiosk/VDI clones and persistent sessions
• Scan for fleet coverage on past-due Chrome versions and block or warn on web access until compliant
• Block installs of git_credential_manager (2.8.0-2.8.3) and Dendreo (1.1.3-1.1.4) on developer systems and CI/CD runners
• Hunt for usage/audit logs of the three flagged malicious RubyGems in internal code and build artifact repositories
• Upgrade all NGINX OSS to 1.30.4/1.31.3 and NGINX Plus to 37.0.3.1 to address CVE-2026-42533
• Scan public IP ranges for outdated NGINX versions specifically on external web tiers
• Patch all affected WordPress installations with the latest core update addressing wp2shell vulnerability
• Block or alert on public PoC signatures for the anonymous HTTP request exploit used for RCE
• Immediately patch all SonicWall SMA 1000 series appliances with security updates released post-June 22, 2026
• Rotate VPN credentials and instrument increased logging for all administrator logins on affected SonicWall appliances

What We’re Watching

• Surge in supply chain threats to developer and package ecosystems (npm, RubyGems, Vite)
• Increased targeting of browser vulnerabilities as rapid initial access avenues
• Trust and integrity risks following certificate authority and large AI repository breaches
• Expansion of zero-day exploitation against remote access and edge web infrastructure
• Malicious campaigns using novel C2 strategies, including blockchain channels, for persistence in developer environments

Categories: Cybersecurity Blog, Cybersecurity News

Tags: AI Security, cybersecurity, patching, Supply Chain, Vulnerabilities, WordPress, Zero-Day