Today's cybersecurity landscape features critical new vulnerabilities requiring urgent patching across major platforms like WordPress, OpenSSL, and Microsoft SharePoint. We're also tracking significant data breaches, an active ransomware campaign impacting a major beverage company, and evolving threats from state-backed actors and botnets targeting AI services.
Critical WordPress Core Flaw Allows Unauthenticated Code ExecutionVulnerability
A recently discovered critical vulnerability, dubbed 'wp2shell', in WordPress core allowed unauthenticated attackers to execute arbitrary code on affected websites. This flaw impacts WordPress versions 6.9 and 7.0, making even bare installations vulnerable until patches 6.9.5 and 7.0.2 were released via forced automatic updates.
Why it matters: If you manage a WordPress site, ensure it is updated to the latest version immediately to prevent unauthenticated code execution and protect your website's integrity.
Read more at The Hacker News ↗
OpenSSL 'HollowByte' Bug Poses Denial-of-Service RiskVulnerability
A denial-of-service vulnerability, named 'HollowByte' by Okta's Red Team, can cause unpatched OpenSSL servers to allocate significant memory for minimal malicious TLS requests. This flaw, fixed in June without a public CVE or advisory, could lead to server memory exhaustion and crashes.
Why it matters: Verify your OpenSSL installations are updated to the latest versions to prevent denial-of-service attacks that could take your services offline.
Read more at The Hacker News ↗
SharePoint Remote Code Execution Zero-Day Actively ExploitedVulnerability
Microsoft SharePoint Server is affected by a critical remote code execution vulnerability (CVE-2026-58644) that is actively being exploited. CISA has added this flaw to its Known Exploited Vulnerabilities catalog, urging federal agencies to apply patches promptly.
Why it matters: If your business uses Microsoft SharePoint Server, prioritize applying the security updates immediately to protect against active exploitation and potential server compromise.
Read more at The Hacker News ↗
Dairy Producer Fairlife Halts Production Due to CyberattackRansomware
Coca-Cola subsidiary Fairlife has suspended its U.S. production operations following a cyber incident, believed to be a ransomware attack. The company is actively investigating the full scope and impact of the breach, affecting plants in multiple states.
Why it matters: This incident highlights the significant operational and financial impact of ransomware, emphasizing the need for robust backup strategies and incident response plans for all businesses.
EY Discloses Data Breach from Third-Party Support System CompromiseBreach
Global professional services firm Ernst & Young (EY) has announced a data breach originating from the compromise of a third-party support ticket system used by its IT department. Customers are being notified about potential exposure of their data.
Why it matters: Supply chain security is critical; ensure your third-party vendors adhere to strict security standards as their vulnerabilities can directly impact your business and customer data.
Read more at BleepingComputer ↗
NadMesh Botnet Targets Exposed AI Services for Cloud CredentialsThreat
A new Go-based botnet, NadMesh, has emerged, actively scanning the internet for exposed AI services like ComfyUI and Ollama. Its primary objective is to steal AWS keys and Kubernetes tokens, with its operators reportedly claiming thousands of stolen AWS keys.
Why it matters: Secure all publicly accessible services, especially new AI development tools. Misconfigurations can lead to the exposure of critical cloud credentials, putting your entire infrastructure at risk.
Read more at The Hacker News ↗
Chinese GoldenEyeDog Subgroup Linked to DigiCert BreachBreach
A subgroup of the Chinese cybercrime organization GoldenEyeDog (also known as APT-Q-27 and Dragon Breath), dubbed CylindricalCanine, has been attributed to the April 2026 DigiCert security incident. This incident involved the theft of code-signing certificates.
Why it matters: A compromised code-signing certificate can be used to sign malicious software, making it appear legitimate. Rely on reputable certificate authorities and be vigilant about software provenance.
Read more at The Hacker News ↗
Malicious npm Packages Leverage Blockchain for C2 in Software Supply Chain AttackThreat
Researchers have uncovered a sophisticated software supply chain attack, 'ViteVenom', involving seven malicious npm packages targeting the Vite frontend tooling ecosystem. These packages use an advanced four-tier blockchain-based command-and-control (C2) infrastructure to deliver a Remote Access Trojan (RAT).
Why it matters: Be cautious when integrating third-party libraries and components into your projects. Always vet dependencies to prevent supply chain attacks that can compromise your applications and data.
Read more at The Hacker News ↗
North Korean Hackers Use Fake Coding Tests with Steganography to Deliver MalwareThreat
Threat actors linked to North Korea's 'Contagious Interview' campaign are employing fake job postings and coding challenges to distribute malware. They hide payloads aligned with OTTERCOOKIE (a credential and crypto wallet stealer) within SVG image files using steganography.
Why it matters: Exercise extreme caution with unsolicited job offers or coding challenges. Verify the legitimacy of senders and avoid running unknown code, as it could hide sophisticated malware.
Read more at The Hacker News ↗
E.U. Mandates Google to Open Android AI Assistant AccessPolicy
The European Commission has ordered Google to grant rival AI assistants the same deep access to Android features, including the camera, microphone, screen content, and background app control, that Gemini currently possesses. This mandate is slated for implementation by August 1, 2027, with Android 18.
Why it matters: While this is a platform-level policy, it underscores the increasing regulatory scrutiny on big tech regarding data access and competition, which could indirectly influence how businesses develop and secure mobile applications.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.