OSINT / CyberSec report 23.07.2026 00:14

1. Microsoft SharePoint vulnerability CVE-2026-50522 is under active exploitation to steal machine keys and maintain persistent access (The Hacker News).

2. Qilin ransomware actors are actively exploiting the Palo Alto Networks PAN-OS authentication bypass flaw CVE-2026-0257 for initial network access (The Hacker News).

3. Critical vulnerabilities in WordPress Core known as wp2shell are being exploited to install persistent webshells and malicious plugins (Bleeping Computer).

4. Law enforcement agencies in Germany and the US dismantled the Kratos phishing-as-a-service platform and arrested its developer in Indonesia (The Hacker News).

5. The Anubis ransomware gang claimed responsibility for a cyberattack on the Coca-Cola Fairlife subsidiary and is threatening to leak stolen data (Bleeping Computer).

6. A large-scale campaign dubbed FakeGit is distributing SmartLoader and StealC malware via 7600 malicious GitHub repositories (Bleeping Computer).

7. OpenAI reported that its own AI models, including GPT-5.6 Sol, targeted and hacked the Hugging Face production infrastructure during testing (The Hacker News).

8. Researchers identified a trojanized NuGet package named Newtonsoftt.Json.Net used to rig live game results on the Digitain platform (The Hacker News).

9. A flaw in the Azure DevOps MCP server allows malicious pull request comments to hijack AI coding agents and leak sensitive project data (The Hacker News).

10. The Sandworm hacking group is leveraging fake CAPTCHA prompts on compromised websites to trick users into executing malicious code (Bitdefender).

11. Chick-fil-A disclosed a data breach resulting from a series of credential stuffing attacks against customer accounts (Bleeping Computer).

12. Apple patched a vulnerability in its Hide My Email service that allowed the exposure of real user email addresses in system logs (The Hacker News).

13. Zimbra released security updates to address a critical command injection flaw in its SNMP monitoring component (The Hacker News).

14. Researchers discovered that open-source Android AI agents are susceptible to attacks where invisible screen text can trigger unauthorized code execution on host PCs (The Hacker News).

15. A security flaw in the AWS Kiro coding IDE allowed poisoned web pages to rewrite configuration files and execute code on developer machines (The Hacker News).