Posts
OS Weekly: Zero-Day Ransomware, a Record Patch Tuesday & Cybersecurity's Trust Problem
It’s been a loud week. A ransomware crew chained two “moderate” SonicWall bugs into full root access, Microsoft shipped the biggest Patch Tuesday anyone can remember, and active exploitation is running across tools most security and IT teams touch daily — SharePoint, WordPress, npm, even the code editor on your desktop. There’s also a good case study this week in why the people behind your security vendors matter as much as their feature list. Here’s what actually mattered.
Critical Threats & Active Exploits
Inc Ransomware chains two SonicWall zero-days into root access
Threat actors are combining two vulnerabilities in SonicWall’s Secure Mobile Access appliances — one rooted in improper security controls, the other in insufficient input validation — to get root-level access on affected devices. Neither flaw looks especially dangerous by itself, which is exactly the point: chained together, they hand attackers full control of the box.
It’s a good reminder that severity scoring doesn’t always capture real-world risk. Two “moderate” bugs in the same product line can add up to a critical compromise path. If SonicWall SMA appliances are in your environment, prioritize the vendor’s guidance now — don’t wait for a CVSS number to justify the urgency. If you need to walk leadership through how the chain actually works, a simple kill-chain diagram does more than a paragraph of prose — we sketch ours in Canva (affiliate link) when a whiteboard photo won’t cut it for the incident report.
CISA orders patching as SharePoint flaws see active exploitation
CISA confirmed active, in-the-wild exploitation of three vulnerabilities in on-premises SharePoint Server instances exposed to the internet. Attackers are using them for unauthorized access right now — this isn’t a theoretical risk queued up for next sprint’s patch cycle.
If you’re still running SharePoint on-prem rather than SharePoint Online, treat this as a today problem: confirm exposure, apply CISA’s guidance, and check logs for signs of prior compromise given exploitation is already underway.
“wp2shell” brings unauthenticated code execution to WordPress core
A newly disclosed flaw dubbed “wp2shell” lives in WordPress core itself — no plugins required — and lets an anonymous HTTP request execute arbitrary code on any site running version 6.9 or 7.0. As of July 18, it has assigned CVE IDs, the exploitation mechanism is publicly documented, and a working proof-of-concept is already circulating.
Given WordPress’s footprint, expect automated scanning for vulnerable installs to ramp up quickly. If you manage WordPress infrastructure, patch now rather than waiting for a maintenance window — public PoC plus unauthenticated exploitation is about as urgent as it gets.
A compromised npm package quietly dropped a Rust infostealer on install
Version 8.14.0 of the jscrambler npm package shipped with a malicious preinstall hook that silently deployed a Rust-based infostealer, dropping a platform-specific native binary on Windows, macOS, and Linux alike. Socket flagged the malicious release just six minutes after it was published on July 11 — fast detection that likely limited the blast radius.
It’s another entry in a long and growing list of npm supply-chain compromises. For teams building software, it reinforces the case for automated dependency monitoring, pinned versions, and real skepticism toward preinstall and postinstall scripts running with your permissions.
Update now: 7-Zip fixes a malicious-archive RCE flaw
7-Zip version 26.02 patches a remote code execution vulnerability that triggers just by opening a specially crafted compressed archive. No exotic delivery chain required — just a file a user is convinced to open, which makes this a prime candidate for phishing campaigns once exploit details spread further.
If 7-Zip is part of your standard toolkit or your org’s software image, push the update now instead of relying on users to self-update on their own schedule.
Australia warns of a global campaign hitting vulnerable CMS platforms
The Australian Cyber Security Centre issued an alert on a widespread exploitation campaign targeting outdated content management systems and their plugins. Attackers are using these weaknesses for unauthorized access, data theft, defacement, and malware distribution.
It’s a useful reminder that “boring” infrastructure — the CMS running your marketing site, not just your crown-jewel applications — stays a favorite initial-access vector precisely because it gets patched less consistently than anything customer-facing.
Cursor on Windows will silently execute a file named git.exe
A disclosed flaw in the Cursor code editor shows that opening a repository on Windows containing a binary named git.exe in the project root causes Cursor to run it automatically — no click, no approval dialog, no warning. The binary executes with the user’s permissions and keeps running for as long as the project stays open, which can expose source code, SSH keys, and cloud tokens.
For anyone leaning on AI-assisted IDEs, this is a timely nudge to scrutinize what you clone before opening it. “Just open the repo” is a trust decision now, not a formality.
Microsoft’s July Patch Tuesday was the biggest yet
Coverage varies on the exact tally — Krebs on Security reports 570 fixed vulnerabilities, Cisco Talos puts it at 622, with 57 rated critical and two already exploited in the wild. Either way, it’s a record, and both outlets point to the same driver: AI-assisted vulnerability discovery is surfacing flaws faster than patch cycles can comfortably absorb them. Talos also shipped fresh Snort rules to help detect exploitation attempts tied to this release.
The practical takeaway for security teams: patch volume is trending up structurally, not just this month. Investing in faster, more automated patch validation and deployment is looking less optional by the quarter.
Krebs coverage | Talos coverage
Cisco Talos discloses 18 vulnerabilities across WolfSSL, GeoVision, and VTK-DICOM
Cisco Talos’ Vulnerability Discovery & Research team disclosed 18 issues this week: three in WolfSSL, fourteen in GeoVision hardware, and one in VTK-DICOM. All have been patched by their respective vendors under Cisco’s third-party disclosure policy.
Beyond the specific products — worth checking against your dependency tree if you touch embedded TLS, video surveillance, or medical imaging tooling — it’s also a solid example of coordinated disclosure working as intended: researchers find the issues, vendors patch, details go public only once fixes ship.
Tools, Strategy & AI
White House launches an AI cybersecurity clearinghouse
The White House announced a new clearinghouse meant to centralize threat intelligence sharing around AI-driven attacks, connecting government agencies, private-sector partners, and international allies. The goal is more coordinated, faster responses to AI-enabled threats instead of every stakeholder working from a partial picture.
For anyone building a career in this field, initiatives like this are worth tracking — they tend to shape where funding, hiring, and policy attention flow over the following year. It’s also as good a nudge as any to make sure your own work is easy to find: if your CTF writeups, certs, or research are still scattered across random links, a quick Carrd page (affiliate link) gets them in front of the people making those hiring calls without you standing up a full site.
Industry & People
Who’s actually behind that “offensive cybersecurity” startup?
Krebs on Security published a deep dive into a startup offering substantial payouts for zero-day vulnerabilities — reportedly led by individuals with a documented history of running fake intelligence companies and operating under false identities. The piece raises real questions about vetting leadership and provenance before engaging any vendor that wants privileged access to your environment or your research.
It’s an uncomfortable but useful reminder: in offensive security especially, who’s behind the tool matters as much as what the tool claims to do.
Jen Ellis named MBE for bridging researchers and policymakers
Jen Ellis was recognized as a Member of the Order of the British Empire for years of work connecting the security research community with legislators — advocating for legal protections for researchers and pushing responsible disclosure norms into policy conversations. Worth a read for anyone curious how the policy side of this field actually moves.
Nigeria mandates cyberattack disclosure as cybercrime profits climb
New regulations now require organizations to disclose cyberattacks, aligning with a broader global trend toward mandatory transparency around security incidents. The logic is straightforward: better visibility into who’s being attacked, and how, improves collective defense across an economy — even when it’s uncomfortable for individual organizations in the short term.
Oak emerges from stealth with $60M to fix AI-agent identity chaos
Israeli startup Oak, co-founded by Shai Morag, stepped out of stealth with $60 million in seed funding to tackle a problem more security teams are quietly worried about: how do you govern identity and access when autonomous AI agents — not just human users — are acting on your systems? The funding signals real investor confidence that this is about to become a much bigger operational headache.
That’s the week. Patch what you can, question the provenance of the tools and vendors you trust, and keep stacking skills one CVE at a time. Follow CyberShield for next Sunday’s roundup.