Cybersecurity News Roundup — July 12, 2026

Today's cybersecurity landscape highlights critical vulnerabilities, with a significant flaw in Zimbra's email platform allowing arbitrary code execution and a compromised jscrambler npm package delivering infostealers. Alongside these, we see warnings about a global campaign exploiting vulnerable CMS platforms and novel AI prompt injection techniques emerging.

Critical Zimbra Flaw Allows Remote Code Execution via Crafted EmailsVulnerability

A critical vulnerability in the Zimbra Classic Web Client could allow attackers to execute arbitrary code within a user's session. This stored cross-site scripting (XSS) flaw is triggered by specially designed emails and currently lacks a CVE identifier.

Why it matters: If your business uses Zimbra, applying the latest security updates is crucial to prevent attackers from compromising user accounts and systems through malicious emails.

Malicious jscrambler npm Package Infects Systems with InfostealerVulnerability

The jscrambler npm package's 8.14.0 release was compromised, featuring a preinstall hook that deploys an infostealer. This malicious code affects Windows, macOS, and Linux systems upon installation, highlighting supply chain risks.

Why it matters: When incorporating third-party libraries into your website or applications, always verify their integrity to avoid unknowingly installing malware that could steal sensitive business data.

Global Campaign Targets Vulnerable CMS PlatformsThreat

The Australian Cyber Security Centre (ACSC) has alerted organizations about an ongoing global campaign actively exploiting known vulnerabilities in Content Management Systems (CMS) and their associated plugins.

Why it matters: Regularly updating your website's CMS (like WordPress, Joomla, or Drupal) and all installed plugins is essential to protect against widespread exploitation campaigns that target outdated software.

New 'Ghostcommit' Technique Hides Prompt Injections in Images to Deceive AIThreat

Researchers have developed 'Ghostcommit,' a technique that embeds prompt injections within PNG images. This method successfully bypasses AI code reviewers and can trick AI coding agents into revealing sensitive information, such as repository secrets.

Why it matters: If your business uses AI tools for code review or development, be aware that advanced hidden prompt injection methods can bypass current security checks, potentially exposing sensitive internal data.

Balochistan Police Portal Weaponized in Multi-Group Cyber EspionageThreat

Cybersecurity researchers have uncovered extensive cyber espionage against Pakistani law enforcement, including the Balochistan Police. Suspected Chinese and Indian state-backed threat actors exploited web application servers managing police and citizen data.

Why it matters: This incident underscores the risk of web application compromises leading to data breaches, even for sensitive government systems. Ensure your business's web applications are secure and regularly audited to prevent similar espionage or data theft.

Ghost Accounts Used for Mass Reconnaissance on GitHub OrganizationsThreat

Multiple cyber campaigns are utilizing 'ghost accounts' on GitHub to conduct reconnaissance on various organizations. These accounts are used to map out repositories and identify members within GitHub organizations.

Why it matters: Be mindful of unusual activity on your company's GitHub repositories. This reconnaissance could precede more targeted attacks, so monitor for unauthorized access attempts or suspicious account interactions.