Posts
OS Weekly: Active Exploits, Patch Overload & AI's Double-Edged Sword
It was a patch-heavy week across the industry. Microsoft, 7-Zip, and WordPress core all shipped fixes for actively exploitable flaws, a chained SonicWall zero-day handed ransomware operators root access, and two separate Talos Intelligence writers landed on the same conclusion from different angles: you can’t patch everything at once, so patch smart. Add a $1.2B endpoint security launch and a fresh debate over whether AI guardrails help or hurt defenders, and that’s your week.
Critical Threats & Active Exploits
Inc ransomware chains two SonicWall zero-days into root access
Two vulnerabilities in SonicWall’s Secure Mobile Access (SMA) appliances — one involving improper security controls, the other insufficient input validation — can be combined to give an attacker root-level access. Inc ransomware operators are already exploiting the chain in active campaigns.
For practitioners, this is a reminder that individually “moderate” findings can become critical when chained. If you or your organization run SonicWall SMA for remote access, treat this as a same-day patch, not a backlog item — and it’s a good exercise in threat modeling to ask what else in your stack has two “medium” bugs sitting next to each other.
Microsoft patches a record 570 security flaws
Microsoft’s latest Patch Tuesday addressed more than 570 vulnerabilities across Windows and related software — nearly triple the volume of its previous record-setting release. The jump is largely attributed to AI-assisted vulnerability discovery accelerating how quickly researchers and internal teams surface flaws.
That’s good news for defenders in one sense (bugs get found before attackers find them) and a real operational challenge in another: patch queues are growing faster than most teams’ capacity to triage them. Risk-based prioritization — not “patch everything in order” — is what separates teams that keep up from teams that fall behind.
New “wp2shell” flaw lets unauthenticated attackers run code on any WordPress site
A critical vulnerability dubbed wp2shell lives in WordPress core itself, affecting versions 6.9 and 7.0 — no plugins required for exploitation. An anonymous HTTP request combined with a persistent-object-cache condition is enough to execute code on a vulnerable site. The flaw already has a CVE assigned, the exploitation mechanism is public, and a working proof-of-concept is circulating.
Because this hits core rather than a plugin, the usual advice to “just disable the vulnerable plugin” doesn’t apply — every WordPress install on the affected versions is exposed until patched. If you manage WordPress infrastructure, or inherited some as part of a broader environment, this belongs at the top of this week’s list.
Update now: 7-Zip fixes RCE flaw exploitable with malicious archives
7-Zip 26.02 patches a remote code execution vulnerability triggered simply by opening a specially crafted compressed file — no additional user interaction beyond extraction required. Given how routinely archive files move through email attachments and file shares, this is exactly the kind of low-friction delivery mechanism phishing campaigns favor.
The fix is straightforward — update to the latest version — but the harder problem is reach: 7-Zip isn’t centrally managed in most organizations the way browsers or OS patches are, so assume a meaningful chunk of your user base is still on a vulnerable build until you actively push it.
Threat Intelligence & Takedowns
Malvertising campaign makes the victim’s own browser build the malware
The SourTrade malvertising campaign, active since late 2024 and detailed by Confiant on July 23, impersonates trading platforms like TradingView, Solana, and Luno to target retail traders. Its twist: rather than serving a complete malicious file from a fixed URL, it sends the malware in pieces and has the victim’s own browser assemble the final Windows executable using a legitimate Bun runtime.
That approach sidesteps a lot of traditional file-based detection, since there’s no single malicious artifact to fingerprint until assembly happens client-side. It’s a good example of why behavioral detection — watching what a page or process actually does — is increasingly necessary alongside signature-based tools.
A rare win: police dismantle the Kratos phishing kit
German and US law enforcement, led by the Frankfurt public prosecutor’s cybercrime unit (ZIT) and Germany’s Federal Criminal Police Office (BKA), dismantled the core infrastructure behind Kratos — described as one of the most widely used phishing kits for stealing Microsoft 365 sessions and bypassing MFA. Indonesian authorities separately arrested the individual alleged to have built and operated it.
Takedowns like this are worth highlighting for aspiring practitioners: they’re the product of sustained, cross-border collaboration between technical investigators and law enforcement, not a single flashy exploit. If international incident response or cybercrime investigation interests you, this is the kind of case study worth following as details emerge.
Patch Management & Strategy
Begun, the patch wars have
Talos Intelligence’s Joe writes about what he calls the long-predicted “Great Patching” — a surge of updates and fixes hitting across the software ecosystem simultaneously. The piece is less about any single vulnerability and more about organizational readiness: managing complex dependencies, minimizing downtime, and coordinating patch rollouts across teams that don’t always talk to each other.
If keeping those rollout schedules and status updates on track across teams sounds familiar, it’s the same underlying problem we solve for this newsletter’s production cadence with Hypefury — batch drafts, queue posts, resurface evergreen content instead of scrambling week to week. Affiliate link — signing up may support CyberShield at no extra cost to you.
Don’t swing at everything
In a companion piece from the same outlet, Talos’s Thorsten reviews Q2 2026 vulnerability statistics and makes a case using a baseball metaphor: not every pitch is worth swinging at, and not every disclosed vulnerability deserves the same urgency. Reactively chasing every CVE that crosses your feed burns team capacity without proportionally improving your security posture.
We lean on Make ourselves to pull CVE feeds, tag them by stack, and route only the high-signal hits to the team instead of manually triaging every advisory — the same “don’t swing at everything” logic applied to our own workflow. Affiliate link — signing up may support CyberShield at no extra cost to you.
Industry & People
Ransomware is accelerating, but it’s not because of AI
Dark Reading pushes back on the popular narrative that AI is the primary driver behind the recent ransomware surge. The real drivers, per the piece: a more fragmented ransomware ecosystem with smaller, more numerous actors; a steady influx of new attackers entering the space; and a strategic shift toward targeting less-defended organizations that offer easier payouts with less resistance.
For anyone fielding “is AI making ransomware worse?” questions from leadership or clients, this is a useful, more precise framing — the acceleration is structural and economic as much as technological.
Glow emerges from stealth at $1.2B valuation to challenge endpoint security in the AI era
Glow launched out of stealth with a $1.2B valuation, aiming at a category of endpoint risk that’s grown faster than most security programs have adapted to: AI agents and developer tools that enterprises are adopting at speed, often with limited oversight. Traditional endpoint protection was built around conventional devices — laptops, phones, servers — and Glow’s bet is that autonomous AI components interacting with enterprise systems need a fundamentally different security model.
Whether or not Glow becomes the category leader, the underlying premise is worth internalizing: your definition of “endpoint” needs to expand alongside your organization’s AI adoption, or your coverage gaps will grow right along with it.
CISOs vs. boards: myth or misunderstanding?
Dark Reading examines the often-cited tension between CISOs and corporate boards. Escalating threats have pushed boards to prioritize cybersecurity more than ever, but a persistent communication gap remains: security teams often struggle to translate technical risk into business terms, and boards frequently lack the technical grounding to fully evaluate what they’re being told.
For anyone with CISO ambitions, this is worth sitting with. The technical skills get you in the door; the ability to communicate risk in terms a board will act on is what determines whether you’re effective once you’re there.
LG to ban residential proxies from smart TV apps
LG Electronics USA is moving to suspend apps on its webOS smart TV platform that quietly turn TVs into always-on residential proxy nodes — routing unknown third parties’ internet traffic through users’ devices. Research cited in the reporting found that more than 42% of games and apps on LG’s webOS store permitted this kind of undisclosed traffic routing.
It’s a useful data point on how far “endpoint” now extends beyond laptops and phones. Consumer IoT devices, largely unmonitored and rarely threat-modeled, are exactly the kind of infrastructure that ends up quietly recruited into someone else’s network without the owner ever noticing.
How AI guardrails are impeding the work of offensive cybersecurity researchers
TechCrunch reports on a growing friction point: the same AI guardrails designed to prevent misuse are also restricting legitimate offensive security researchers who rely on AI tooling to simulate attacks and discover vulnerabilities before adversaries do. Restricted access to certain datasets and capabilities can slow down exactly the kind of proactive research that improves collective defense.
There’s no clean resolution here — the guardrails exist for good reasons, and so does the research they’re constraining. It’s a tension worth understanding if you’re heading into offensive security, since it’s likely to shape how tooling in this space evolves for years, not months.
That’s the week. Patch what’s actually exploitable first, question the “AI did it” headlines before repeating them, and keep building toward the room where these calls get made. Follow CyberShield for the next installment, and if you found this useful, share it with someone building their way into the field.