Weekly threat intelligence digest: July 13-19, 2026

Executive summary

This week represents one of the most severe patch cycles on record, with Microsoft alone releasing 622 vulnerabilities including actively exploited zero-days, alongside a critical vulnerability in SQLite's ATTACH DATABASE functionality and multiple high-impact supply-chain compromises. The threat landscape reflects a coordinated shift toward supply-chain targeting, LLM-assisted malware development, and exploitation of trust boundaries in enterprise software. Organisations should treat this week's advisories as an emergency patch priority and elevate monitoring of critical infrastructure endpoints.

Critical & high priority

Microsoft's record 622-vulnerability patch cycle signals escalating active exploitation

Microsoft's July update contained 622 patches across a single cycle—triple the previous record—with two zero-day remote code execution flaws already exploited in production environments. One zero-day affects Active Directory Domain Services (the authentication foundation for enterprise Windows networks), and another impacts SharePoint Server, both representing high-value targets for ransomware operators and nation-state actors. A third critical flaw in BitLocker was publicly disclosed before the patch release, creating a brief exploitation window. The scale suggests Microsoft's AI-driven vulnerability discovery initiatives are accelerating the detection of latent flaws, but this creates a remediation burden that many organisations lack capacity to handle within standard patching windows. Recommendation: Immediately assess your Active Directory and SharePoint Server deployments; treat these patches as emergency priority ahead of normal change windows.

Anyquery Server Mode unrestricted SQLite ATTACH DATABASE enables unauthenticated RCE (CVE-2026-50006)

Anyquery's server mode fails to restrict SQLite's ATTACH DATABASE command, allowing unauthenticated remote attackers to write arbitrary files to any filesystem path accessible to the process. This directly enables remote code execution via web shell injection, SSH key injection, or cron job manipulation. Any organisation running Anyquery in server mode with network accessibility is immediately compromised. Recommendation: Disable Anyquery server mode until patches are deployed; audit logs for unauthorised file writes in /tmp, /root/.ssh, and cron directories.

FacturaScripts critical vulnerability chain: 2FA bypass, SQL injection, and unauthenticated RCE

FacturaScripts contains multiple critical flaws released simultaneously: (1) CVE-2026-47677 — unauthenticated TOTP brute-force without rate limiting enabling account takeover on any 2FA-enabled account; (2) CVE-2026-45262 — authenticated SQL injection via parenthesis bypass in REST API filters allowing password hash extraction; (3) A path traversal flaw in file upload handlers enabling arbitrary file writes and .htaccess manipulation for RCE. These represent a complete compromise chain from external attacker to system code execution. FacturaScripts is commonly deployed in SME and mid-market environments. Recommendation: Immediately patch all FacturaScripts instances; disable file upload functionality until patches are confirmed deployed.

Mass GitHub impersonation campaign: 300 fraudulent repositories distributing infostealer malware

A threat actor has created approximately 300 fake GitHub repositories mimicking legitimate open-source projects and security tools. These repositories are seeded with infostealer malware designed to capture credentials and session tokens from developer systems. Given GitHub's role as a primary distribution channel for software dependencies, this represents a supply-chain attack vector with potential to compromise build pipelines, CI/CD systems, and development credentials across thousands of organisations. Recommendation: Implement repository pinning and checksum verification in dependency management; audit recent git clone operations in your development infrastructure; consider enforcing GitHub organisation policies that restrict dependency sources.

CrashStealer macOS information stealer exploits Apple notarisation trust model

CrashStealer uses Apple-notarised C++ droppers to bypass Gatekeeper protections, validating credentials locally before exfiltration to evade detection. The use of native compilation rather than scripting languages suggests a sophisticated threat actor with resources to maintain macOS-specific malware. The attack exploits the implicit trust in Apple's notarisation process—a security boundary that developers and end-users rely upon. Recommendation: Deploy network detection targeting unusual outbound credential transmission from macOS endpoints; inspect notarised applications with additional scrutiny; consider blocking unsigned or notarised-but-unverified executables via MDM policies.

SonicWall SMA1000 zero-days actively exploited in the wild (CVE-2026-15409, CVE-2026-15410)

Two remote code execution zero-days in SonicWall SMA1000 secure access appliances are under active exploitation. SMA1000 devices are often deployed as perimeter access gateways for remote workforce access, making compromise directly relevant to lateral movement and internal network access. Recommendation: Check CVSS and exploit details for these CVEs immediately upon release; prioritise patching above all other network appliance updates; consider temporary network segmentation if patches cannot be deployed within 24 hours.

Kimai Docker hardcoded APP_SECRET enables authentication bypass (CVE-2026-52824)

Official Kimai Docker images ship with a publicly-known default APP_SECRET, allowing attackers to forge Symfony HMAC-signed cookies and assume any account without credentials. Every unpatched Kimai Docker deployment is immediately compromised. Recommendation: Force a rebuild of all Kimai Docker deployments with SECRET_KEY overridden; audit session tokens and force password resets across all user accounts; check for lateral movement from Kimai into connected infrastructure.

Siemens ROX II three-stage zero-day chain compromises industrial switches

Three chained zero-day vulnerabilities in Siemens ROX II OT switches enable privilege escalation to persistent root access. This represents a complete compromise pathway for critical industrial network infrastructure, directly relevant to power generation, water treatment, and manufacturing facilities. Recommendation: Contact Siemens immediately for patch timelines; implement network segmentation between ROX II switches and other OT systems; monitor for unusual administrative access patterns on affected devices.

WordPress Core RCE in 6.9 and 7.0 with public exploits available

Unauthenticated remote code execution flaws in WordPress 6.9 and 7.0 are exploitable via malicious file uploads (wp2shell vulnerabilities), and public exploits are now available. WordPress deployed forced auto-updates on Friday, rapidly patching to 6.9.5 and 7.0.2, but any unpatched installations remain trivially exploitable. The WordPress install base exceeds 40% of all websites. Recommendation: Verify all WordPress instances are running 6.9.5 or 7.0.2 minimum; audit file upload directories for suspicious files; monitor web server logs for unusual POST requests to wp-admin upload handlers.

7-Zip RCE flaw affects ubiquitous compression utility

7-Zip 26.02 patches a remote code execution vulnerability triggered by opening malicious archives. The tool is ubiquitously deployed across millions of systems as a native Windows compression handler and cross-platform utility. Recommendation: Deploy 7-Zip updates to all endpoints; monitor email gateways and file transfer systems for suspicious compressed archives; consider disabling automatic archive preview functionality in file explorers.

Critical infrastructure outages: Japan's largest taxi operator and food supply chain disruption

Nihon Kotsu (Japan's largest taxi operator) suffered operational shutdown affecting millions of passengers; Fairlife suspended US production across three states. These incidents demonstrate that critical infrastructure remains exposed to operational disruption despite regulatory frameworks. Both organisations likely experienced data exfiltration and potential ransom demands. Recommendation: Audit backup and disaster recovery procedures for critical infrastructure; implement air-gapped backups for operational systems; establish incident response runbooks that prioritise rapid recovery over ransom negotiation.

Abbott Laboratories dual breach: legacy systems and cloud portals compromised

Abbott is investigating unauthorised access to legacy Exact Sciences systems and a separate breach of its LabCentral cloud portal with alleged data theft. Healthcare infrastructure spanning legacy on-premises systems and modern cloud platforms creates extensive attack surface. Recommendation: If your organisation depends on Abbott services, contact your account team for incident scope; monitor healthcare.gov breach notification databases for patient data related to Abbott Laboratory Services.

Notable developments

LabubaRAT: Rust-based trojan impersonates NVIDIA software

A previously undocumented Rust-based remote access trojan establishes persistent hands-on access by masquerading as NVIDIA drivers. The use of a compiled language and legitimate vendor branding indicates a threat actor investing in operational longevity. This follows trends of malware authors adopting compiled languages to evade signature-based detection.

Envoy Gateway path normalisation bypass enables credential disclosure (CVE-2026-53713)

A path normalisation flaw in Envoy Gateway allows attackers to bypass authentication and read sensitive files (Kubernetes tokens, TLS certificates) by submitting malicious EnvoyExtensionPolicy objects. This directly impacts Kubernetes environments running Envoy as an ingress controller. Organisations should audit RBAC policies restricting who can create EnvoyExtensionPolicy resources.

Pheditor hardcoded default credentials with no forced change (CVE-2026-55579)

Pheditor ships with hardcoded SHA-512 default credentials ('admin') and no forced change mechanism, enabling unauthenticated RCE on any unpatched instance. This represents trivial pre-authentication compromise affecting all versions. Organisations using Pheditor should immediately change default credentials and audit access logs.

n8n-MCP multi-tenant workflow backup isolation bypass (CVE-2026-54052)

Authenticated tenants in multi-tenant HTTP n8n-MCP deployments can access, modify, or delete other tenants' workflow backups, exposing credential references and authorization headers. This is relevant to organisations running n8n as a workflow automation platform in shared environments. Update to patch 2.56.1 immediately.

Cursor AI editor path traversal enables malicious git.exe injection

Cursor automatically executes git.exe from the project root without validation, allowing attackers to achieve arbitrary code execution by distributing malicious repositories. This is concerning given Cursor's tight integration with development environments and CI/CD pipelines. Developers should disable automatic git execution or isolate Cursor to sandboxed directories.

ClickLock macOS malware forces password disclosure via process termination

ClickLock terminates all visible processes to coerce users into entering system login credentials, bypassing user friction and normal detection windows. This represents a novel credential harvesting technique targeting macOS users with no administrative restrictions on process termination.

Scattered Spider sentenced: TfL ransomware attack perpetrators receive 5.5-year sentences

Owen Flowers (18) and Thalha Jubair (20) received sentences for the 2024 Transport for London ransomware attack that disabled 148 systems. The sentencing marks a law enforcement victory but underscores that Scattered Spider remains operationally active and capable of infrastructure-level disruption.

CISA credential exposure: six-month detection gap reveals insider risk failures

CISA's postmortem on a contractor's accidental publication of internal credentials and AWS Govcloud keys to public GitHub for six months exposes critical gaps in credential scanning, access controls, and incident response procedures. This is particularly concerning given CISA's role in national cybersecurity guidance. Organisations should audit their own credential scanning practices and access revocation procedures.

Vulnerability landscape

This week's vulnerability database tracked 395 new CVEs, with severity skewed toward high-impact flaws: 9 critical, 320 high, 66 unspecified/medium. Adobe leads vendor counts with 11 new vulnerabilities, followed by Microsoft with 7, while Symfony and Apache each contributed 3-4. The concentration of critical flaws in infrastructure software (SQLite, WordPress, 7-Zip, SonicWall, Siemens) reflects a shift toward exploiting widely-deployed foundational tools rather than niche enterprise applications.

The sheer volume—395 CVEs in a single week—signals that vulnerability discovery at scale (driven by AI-assisted analysis at vendors like Microsoft) is outpacing the security community's remediation capacity. Many organisations lack the resources to patch 622 Microsoft vulnerabilities within standard change windows, creating a structural gap between vulnerability disclosure and defensive response.

Recommended actions

1. Declare a patch emergency for Microsoft, Anyquery, FacturaScripts, SonicWall, and Kimai. These vendors represent non-negotiable patch priorities regardless of change management procedures. Test patches immediately in isolated environments and deploy to production within 24 hours.

2. Audit dependency repositories and git clone sources. Implement repository pinning in package managers (npm, pip, cargo, etc.) and verify checksums against official sources. Review recent git operations in development infrastructure for suspicious repositories.

3. Scan Active Directory and SharePoint for exploitation indicators. Check authentication logs for anomalous logons, Kerberos ticket requests, and unusual service principal activity. Monitor file operations in SharePoint for unauthorized document access or macro execution.

4. Enforce forced authentication on all perimeter access appliances. If running SonicWall SMA1000, implement temporary network segmentation until patches are deployed. Audit VPN session logs for compromised credentials.

5. Rebuild Docker deployments with explicit secrets management. Audit all Docker images in your registry for hardcoded credentials; implement CI/CD pipeline checks to block images containing secrets.

6. Monitor macOS endpoints for CrashStealer and ClickLock indicators. Deploy network detection for unusual outbound credential transmission; audit notarised applications with additional scrutiny; disable automatic archive preview in file explorers.

7. Force WordPress core updates to 6.9.5 or 7.0.2 minimum. If you cannot force auto-updates, manually verify all WordPress instances; audit file upload directories; monitor web server logs for upload requests.

8. Establish emergency backup and recovery procedures for critical infrastructure systems. Test restoration procedures for air-gapped backups; establish incident response playbooks that prioritise rapid recovery over ransom negotiation.

Looking ahead

Monitor next week for patch Tuesday releases from Cisco (Talos hinted at coordinated patching), Adobe, and other major vendors. The trend toward AI-assisted vulnerability discovery suggests patch cycle volumes will remain elevated—organisations should treat 600+ CVE months as a new normal rather than an anomaly.

Watch for exploitation details on the WordPress wp2shell flaws, the Siemens ROX II zero-day chain, and SonicWall SMA1000 CVEs. Public exploits will likely emerge within days, creating rapid exploitation timelines. Prioritise network segmentation and segmentation-based defence strategies over patching alone.

Supply-chain targeting is accelerating: the GitHub impersonation campaign (300 repositories), npm ecosystem maturation, and LLM-assisted malware development all signal that attackers are shifting investment from endpoint targeting to development infrastructure compromise. Organisations should assume that malware will continue to masquerade as legitimate tools and that developer environments will remain high-value targets.

Finally, monitor regulatory responses to the Microsoft 622-patch release. The Trump administration's Gold Eagle programme (announced this week) signals a shift toward centralised vulnerability intelligence coordination, which may influence patch prioritisation frameworks and force organisations to realign remediation strategies around government-designated critical vulnerabilities.