07/22/2026-07/29/2026 Trojanized Newtonsoft.Json Fork; New RefluXFS Linux Flaw; Windmill Flaw And More.

1. Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library

Researchers at JFrog uncovered a NuGet typosquat, “Newtonsoftt.Json.Net,” a trojanized fork of Newtonsoft.Json that rigs betting results rather than stealing data. Seven versions (11.0.4–11.0.11) were published between August 13–October 10, 2025, downloaded ~1,200 times, and later unlisted by owner MagicalPuff96—though still downloadable.The package works normally until JsonConvert.DefaultSettings initializes, triggering a randomized delay to evade detection. It then targets servers running Digitain’s FG-Crash betting-game backend, exfiltrating rigged round results to 185.126.237[.]64:5341 via header “X-Seq-ApiKey: theperfectheist2025,” disguised as telemetry. Metadata leaks an internal Digitain repo URL, suggesting the author had source-code access.

Across three generations, obfuscation evolved: Gen-1 was a local proof-of-concept, Gen-2 added exfiltration hidden via reflection/ConfuserEx, Gen-3 stabilized exfiltration, with 11.0.11 left unobfuscated. Researcher Guy Korolevski noted the malware has no credential theft or persistence—only integrity compromise targeting one organization.

Developers should remove the package, block the C2 address, and pin Newtonsoft.Json via packages.lock.json. Digitain says it’s addressing the issue; full exposure remains unclear.

2. Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers

Researchers detailed a campaign turning compromised GitHub repositories into attack infrastructure targeting cPanel/WHM servers. Attackers compromised a PHP maintainer’s account and pushed malicious GitHub Actions workflows across 10 Packagist packages (July 12–13, 2026), syncing 583 malicious workflow files.

Triggered by a push or manual run, the workflows spin up GitHub-hosted runners, detect CPU architecture, and download a Linux payload that exploits CVE-2026-41940, a cPanel/WHM authentication bypass flaw, then harvests credentials—AWS, GitHub/GitLab tokens, API keys, Stripe, database, and SSH data—exfiltrating results via HTTP POST. Unlike typical package attacks, this doesn’t target package users; GitHub’s own runners do the scanning and exploitation.

Roughly 6,100 workflow files sharing a common identifier suggest a broader campaign beyond one maintainer. Separately, Socket flagged “Operation Muck and Load,” using 200 GitHub repos across 190 accounts to deliver Windows malware (stealers, RATs, miners) via multi-stage chains pulling payloads from Pastebin, Telegram, and similar platforms—tactically linked to the “Water Curse” threat cluster.

3. New RefluXFS Linux Flaw Lets Attackers Gain Root Privileges

A nine-year-old Linux kernel flaw in XFS, CVE-2026-64600 (“RefluXFS”), lets local attackers gain root by exploiting a race condition in reflink-enabled systems (default on major enterprise distros) running kernel 4.11+. Attackers reflink-clone a target file like /etc/passwd, then race concurrent writes so changes land on the original file’s physical block—bypassing SELinux, lockdown, and memory protections since it operates below the filesystem layer. Exploitation is reliable, leaves no logs, and survives reboot.

Found by Qualys TRU, the bug dates to a 2017 kernel commit and was patched July 16. Affected distros include RHEL, Oracle Linux, Amazon Linux, Fedora, CentOS Stream, Rocky Linux, AlmaLinux, and CloudLinux—an estimated 16.4 million systems. Notably, the flaw was surfaced through a Qualys-Anthropic research initiative using Claude Mythos Preview to hunt for Dirty COW-style race conditions; Qualys researchers then verified and reproduced the exploit independently. Immediate patching and reboot are recommended, as no mitigations exist.

4. Ubuntu Snap-Confine Vulnerability Enables Local Root Access

A newly disclosed flaw in snap-confine, the component isolating Ubuntu’s snap applications, lets any local user gain full root on default Ubuntu Desktop 24.04, 25.10, and 26.04 installs. Qualys TRU disclosed the high-severity bug, CVE-2026-8933, on July 21—the second snap-confine root-escalation flaw from the same team in four months.

The issue traces to a July 2025 hardening change that moved snap-confine to a set-capabilities model, leaving a brief window where temporary sandbox files remain owned by the unprivileged caller before root takes over. Attackers exploit this with two race conditions: mounting a FUSE filesystem over the scratch directory to escape isolation, and redirecting a symlink so snap-confine writes to an attacker-controlled target before ownership transfers. A malicious rules file dropped via /run/udev/rules.d/ bypasses AppArmor, forcing systemd-udevd to execute commands as root. Canonical has released patches. Since affected snapd ships by default, workstations and developer systems are in scope—administrators should verify installed snapd versions and update immediately.

5. Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication

A high-severity flaw in open-source developer platform Windmill, CVE-2026-29059 (CVSS 7.5), is under active exploitation, according to VulnCheck. The bug is an unauthenticated path traversal in Windmill’s “get_log_file” endpoint: an unsanitized filename parameter lets attackers use “../” sequences to read arbitrary server files.

The main risk is exposure of the SUPERADMIN_SECRET environment variable, which—if set—can be used as a Bearer token to gain superadmin access and execute arbitrary code via the job preview API. It’s not set by default, so unconfigured standalone instances face only arbitrary file read. The flaw was patched in Windmill 1.603.3 (January 2026).

Researcher Valentin Lobstein discovered and reported the issue; VulnCheck says attackers are targeting the endpoint to extract “/etc/passwd,” hitting both direct Windmill endpoints and the Nextcloud proxy path. About 170 vulnerable systems remain exposed across 24 countries. Affected organizations should upgrade immediately, as SUPERADMIN_SECRET exposure can escalate to full remote code execution.

07/15/2026-07/22/2026 Critical SNMP Command Injection and Four XSS Vulnerabilities; Critical NGINX Vulnerability; SharePoint RCE Vulnerability CVE-2026-50522 And More.

1. Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities

Zimbra has released fixes for nine security vulnerabilities in Zimbra 10.1.20, the most severe being a command injection flaw in the SNMP monitoring component that triggers when SNMP notifications are enabled. Four cross-site scripting (XSS) flaws in the Classic Web Client were also patched, involving malicious attachment filenames, crafted fields, and crafted attachments that could execute scripts under certain conditions. Separately, the update fixes a mail forwarding restriction bypass (CVE-2026-50055) that let authenticated users exfiltrate email even with forwarding restrictions enabled, discovered by Rapid7’s Jonah Burgess.

Zimbra withheld further technical details, saying “in line with industry best practices, information disclosure is limited for security vulnerability fixes.” This follows a patch issued just over a week ago for a critical stored XSS bug in the Classic Web Client that could enable arbitrary code execution.

None of the newly patched flaws are known to be actively exploited, but given XSS bugs’ history of exploitation in email platforms, prompt patching is strongly advised.

2. FakeGit Campaign Uses 7,600 GitHub Repos to Push SmartLoader Malware

A campaign dubbed “FakeGit” is distributing SmartLoader and StealC malware through 7,600 malicious GitHub repositories with over 14 million downloads. More than 800 repositories posed as AI skills or MCP servers, appearing 600+ times in public AI registries—a technique researchers call “agentbaiting,” designed to increase visibility to AI agents.

Attributed to threat actor “Water Kurita” and building on an earlier Lumma Stealer campaign, FakeGit’s AI focus emerged in March, peaking in April. Repositories impersonate tools like Gmail, WhatsApp, and Docker, using fake stars, forks, and documentation. READMEs direct victims to ZIP files disguised as installers that trigger SmartLoader, which establishes persistence, fetches its C2 address via a Polygon smart contract, and deploys StealC.

Island researchers found ChatGPT, Gemini, and Claude sometimes surfaced these repositories and relayed installation instructions when prompted. In controlled tests, Claude Code cloned malicious repos and downloaded files but halted before execution upon detecting suspicious indicators.

3. Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution

F5 has patched a critical nginx flaw, CVE-2026-42533, that lets an unauthenticated attacker trigger a heap buffer overflow via crafted HTTP requests. Fixed in nginx 1.30.4/1.31.3 and NGINX Plus 37.0.3.1 on July 15, it affects every version since 0.9.6 (2011). The bug arises when a regex-based map variable is referenced alongside an earlier regex capture—nginx’s two-pass engine sizes a buffer for one capture but writes data from another, causing overflow. It can crash worker processes (DoS) and, F5 says, enable RCE if ASLR is bypassable.

Researcher Stan Shaw argues the flaw supplies its own ASLR bypass by leaking heap data, potentially making RCE far easier than F5’s advisory suggests—a claim he says tested 10/10 but hasn’t published proof for yet. He also found F5’s suggested mitigation (named captures) incomplete, leaving a secondary path open. CISA hasn’t flagged active exploitation yet, but similar recent nginx bugs were quickly weaponized, so patching promptly is advised.

4. CISA Warns Admins to Patch Actively Exploited SharePoint Flaws

CISA warned that attackers are actively exploiting three on-premises SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164), affecting all supported self-hosted versions, including Subscription Edition. Attackers are using them to bypass authentication, gain remote code execution, steal IIS machine keys, and deploy malware.

CISA also flagged two newly patched flaws (CVE-2026-55040, CVE-2026-58644) as likely future targets, though not yet exploited. Shadowserver tracks nearly 10,000 exposed SharePoint servers, with over 800 unpatched against the first two CVEs.
CISA recommends applying patches, enabling AMSI and Microsoft Defender detections, rotating IIS machine keys after hunting for intrusion artifacts, restricting SharePoint’s internet exposure, and using reverse proxies where exposure is unavoidable. Federal agencies must secure or disconnect affected servers by July 17 under BOD 26-04.

Since 2021, CISA has flagged 11 exploited SharePoint vulnerabilities, seven also used in ransomware attacks.

5. Public PoC Triggers Active Exploitation of critical SharePoint RCE Vulnerability CVE-2026-50522

A critical SharePoint vulnerability, CVE-2026-50522 (CVSS 9.8), is under active exploitation following release of a public proof-of-concept. Patched in Microsoft’s July 2026 Patch Tuesday, the deserialization flaw lets attackers with Site Owner privileges execute arbitrary code remotely. It’s paired with CVE-2026-58644, both unauthenticated-exploitable deserialization bugs; CVE-2026-50522 was demonstrated at Pwn2Own Berlin, yet Microsoft’s advisory lists exploit maturity as unknown. watchTowr’s honeypot network captured exploitation attempts within hours of the PoC’s release, with attackers stealing SharePoint machine keys via a single request to maintain persistent access—meaning patching alone won’t remove attacker access. Security firm Defused Cyber also observed attacks delivering a .NET deserialization payload through SharePoint’s sign-in endpoint.

This follows earlier exploited SharePoint flaws CVE-2026-45659, CVE-2026-32201, and CVE-2026-20963, all added to CISA’s KEV catalog since March. Organizations should patch immediately and rotate potentially exposed credentials.

07/08/2026-07/15/2026 CVSS 9.9 NetWeaver ABAP Flaw, Jscrambler npm Supply Chain Attack, Joomla Sites Running iCagenda or Balbooa Exploited in Attacks And More.

1. SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data

SAP’s July 2026 security updates address multiple vulnerabilities, most notably a critical flaw in SAP NetWeaver Application Server ABAP. CVE-2026-44747 (CVSS 9.9) is an out-of-bounds write bug letting an authenticated attacker trigger memory corruption, potentially leading to unauthorized data access, modification, or system unavailability. Onapsis notes SAP’s proposed workaround—disabling certain ICF nodes in transaction SICF—breaks SAP GUI for HTML transactions, so patching the ABAP Kernel is strongly advised instead.

Two other critical flaws were also fixed. CVE-2026-27690 (CVSS 9.1) is an HTTP request/response smuggling issue in SAP Approuter (non-Cloud Foundry deployments), letting unauthenticated attackers desynchronize requests to expose responses or cause denial-of-service. CVE-2026-44761 (CVSS 9.1) affects SAP Commerce Cloud, where sample configuration scripts from SAP’s documentation created OAuth 2.0 clients with hard-coded, publicly known credentials. Attackers who find these unchanged in production could obtain valid access tokens to read and modify data. Customers who removed the sample client or rotated the secret aren’t affected; others should audit and remove it. No active exploitation has been reported, but patching is recommended.

2. Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days

Microsoft’s July 2026 Patch Tuesday addressed a record 622 vulnerabilities, including two actively exploited zero-days. CVE-2026-56155 affects Active Directory Federation Services, allowing local privilege escalation to administrator. CVE-2026-56164, in SharePoint Server, enables unauthenticated network-based privilege escalation. Microsoft also flagged CVE-2026-50661, a BitLocker bypass exploitable by attackers with physical access, which was publicly disclosed before the patch release—Tenable’s Satnam Narang suggested a possible link to prior zero-days from researchers “Nightmare-Eclipse” or “Chaotic-Eclipse,” though unconfirmed.

Windows received 416 fixes and Office 164. Other notable flaws include critical bugs in Windows VMSwitch (CVE-2026-57092, CVSS 9.9) and SharePoint (CVE-2026-50522, CVSS 9.8), an Exchange Server XSS (CVE-2026-55008), and RCE issues in RDP, Windows DHCP Server, Windows Server Network driver, and Minecraft Bedrock Dedicated Server. Updates also covered Azure, Defender, Exchange, Edge, and SQL Server.

Microsoft says AI-assisted scanning is accelerating vulnerability discovery. Separately, Adobe patched 88 vulnerabilities, including critical ColdFusion, Commerce, Experience Manager, and Illustrator flaws.

3. Jscrambler npm Supply Chain Attack Steals Developer and Cloud Credentials

A compromised release of the widely used jscrambler npm package exposed developers and CI/CD pipelines to a credential-stealing campaign after attackers hijacked the maintainer’s npm publishing credentials. Malicious versions 8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0 installed hidden Rust-based infostealers targeting cloud credentials, cryptocurrency wallets, browser data, AI coding assistants, messaging apps, and OS keyrings. Initially, the malware used an undocumented preinstall script, but later versions embedded the dropper directly into the package, bypassing protections such as npm install --ignore-scripts. Stolen data was encrypted and exfiltrated over TLS to a remote server. Jscrambler confirmed the breach, revoked the compromised credentials, and released version 8.22.0 as a clean version. Organizations that installed affected releases should treat impacted systems as compromised, upgrade to 8.22.0 (or revert to 8.13.0), rotate all exposed credentials, and review systems for signs of unauthorized binaries or suspicious activity.

4. npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk

GitHub has released npm 12, introducing major security improvements by disabling install scripts and risky dependency sources by default. Dependency lifecycle scripts, Git dependencies, and remote URL packages now require explicit approval, reducing the risk of supply chain attacks. Developers can review and allow trusted scripts using npm approve-scripts --allow-scripts-pending and save the allowlist in package.json.

GitHub also announced the deprecation of npm granular access tokens (GATs) that bypass two-factor authentication (2FA). Starting in August 2026, these tokens will no longer be able to perform sensitive account, package, or organization management tasks. By January 2027, GATs will also lose the ability to publish packages directly, with GitHub recommending trusted publishing (OIDC) or staged publishing with human approval instead. Additionally, pnpm 11.10 introduces a new _auth configuration that securely binds registry credentials to specific hosts, preventing malicious project files from redirecting authentication tokens.

5. CISA Warns of Joomla Sites Running iCagenda or Balbooa Exploited in Attacks

CISA has flagged active exploitation of two unrestricted file upload vulnerabilities in Joomla extensions, allowing attackers to potentially seize control of vulnerable websites. CVE-2026-48939 affects iCagenda, an event management extension, while CVE-2026-56291 affects Balbooa Forms—both letting unauthenticated or low-privileged attackers upload executable malicious files. Exploitation can enable web shells, giving attackers remote command execution, data theft, new admin accounts, content tampering, or a foothold for further attacks.

CISA warns file-upload flaws remain a common attack vector, with internet-facing Joomla sites especially at risk from automated scanning. Federal agencies must remediate under Binding Operational Directive 26-04, and CISA urges private organizations to do the same.

Administrators should check for these extensions, apply patches or vendor mitigations, and if unavailable, disable the component or restrict uploads and access. Because exploitation is ongoing, patching alone may not remove existing attackers—teams should hunt for web shells, suspicious accounts, altered templates, and unusual traffic, then rotate credentials and restore from clean backups if compromised.

6. Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read

Researchers discovered that xAI’s Grok Build CLI (v0.2.93) uploaded entire Git repositories—including commit history—to xAI-managed cloud storage, rather than only the files required for coding tasks. Tests showed that a 12 GB repository generated over 5 GiB of uploads, even though the AI model processed only a small fraction of the data. Researchers also confirmed that tracked files, including a .env file with unredacted test credentials, were transmitted and stored. Disabling the “Improve the model” setting did not stop repository uploads, as it controlled model training rather than data collection. On July 13, xAI disabled repository uploads via a server-side configuration without updating the client. The company stated users can run /privacy to disable retention and delete synced data. Security experts recommend rotating any credentials stored in tracked files or Git history, as deleted secrets may still exist in repository commits.