07/22/2026-07/29/2026 Trojanized Newtonsoft.Json Fork; New RefluXFS Linux Flaw; Windmill Flaw And More.

1. Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library

Researchers at JFrog uncovered a NuGet typosquat, “Newtonsoftt.Json.Net,” a trojanized fork of Newtonsoft.Json that rigs betting results rather than stealing data. Seven versions (11.0.4–11.0.11) were published between August 13–October 10, 2025, downloaded ~1,200 times, and later unlisted by owner MagicalPuff96—though still downloadable.The package works normally until JsonConvert.DefaultSettings initializes, triggering a randomized delay to evade detection. It then targets servers running Digitain’s FG-Crash betting-game backend, exfiltrating rigged round results to 185.126.237[.]64:5341 via header “X-Seq-ApiKey: theperfectheist2025,” disguised as telemetry. Metadata leaks an internal Digitain repo URL, suggesting the author had source-code access.

Across three generations, obfuscation evolved: Gen-1 was a local proof-of-concept, Gen-2 added exfiltration hidden via reflection/ConfuserEx, Gen-3 stabilized exfiltration, with 11.0.11 left unobfuscated. Researcher Guy Korolevski noted the malware has no credential theft or persistence—only integrity compromise targeting one organization.

Developers should remove the package, block the C2 address, and pin Newtonsoft.Json via packages.lock.json. Digitain says it’s addressing the issue; full exposure remains unclear.

2. Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers

Researchers detailed a campaign turning compromised GitHub repositories into attack infrastructure targeting cPanel/WHM servers. Attackers compromised a PHP maintainer’s account and pushed malicious GitHub Actions workflows across 10 Packagist packages (July 12–13, 2026), syncing 583 malicious workflow files.

Triggered by a push or manual run, the workflows spin up GitHub-hosted runners, detect CPU architecture, and download a Linux payload that exploits CVE-2026-41940, a cPanel/WHM authentication bypass flaw, then harvests credentials—AWS, GitHub/GitLab tokens, API keys, Stripe, database, and SSH data—exfiltrating results via HTTP POST. Unlike typical package attacks, this doesn’t target package users; GitHub’s own runners do the scanning and exploitation.

Roughly 6,100 workflow files sharing a common identifier suggest a broader campaign beyond one maintainer. Separately, Socket flagged “Operation Muck and Load,” using 200 GitHub repos across 190 accounts to deliver Windows malware (stealers, RATs, miners) via multi-stage chains pulling payloads from Pastebin, Telegram, and similar platforms—tactically linked to the “Water Curse” threat cluster.

3. New RefluXFS Linux Flaw Lets Attackers Gain Root Privileges

A nine-year-old Linux kernel flaw in XFS, CVE-2026-64600 (“RefluXFS”), lets local attackers gain root by exploiting a race condition in reflink-enabled systems (default on major enterprise distros) running kernel 4.11+. Attackers reflink-clone a target file like /etc/passwd, then race concurrent writes so changes land on the original file’s physical block—bypassing SELinux, lockdown, and memory protections since it operates below the filesystem layer. Exploitation is reliable, leaves no logs, and survives reboot.

Found by Qualys TRU, the bug dates to a 2017 kernel commit and was patched July 16. Affected distros include RHEL, Oracle Linux, Amazon Linux, Fedora, CentOS Stream, Rocky Linux, AlmaLinux, and CloudLinux—an estimated 16.4 million systems. Notably, the flaw was surfaced through a Qualys-Anthropic research initiative using Claude Mythos Preview to hunt for Dirty COW-style race conditions; Qualys researchers then verified and reproduced the exploit independently. Immediate patching and reboot are recommended, as no mitigations exist.

4. Ubuntu Snap-Confine Vulnerability Enables Local Root Access

A newly disclosed flaw in snap-confine, the component isolating Ubuntu’s snap applications, lets any local user gain full root on default Ubuntu Desktop 24.04, 25.10, and 26.04 installs. Qualys TRU disclosed the high-severity bug, CVE-2026-8933, on July 21—the second snap-confine root-escalation flaw from the same team in four months.

The issue traces to a July 2025 hardening change that moved snap-confine to a set-capabilities model, leaving a brief window where temporary sandbox files remain owned by the unprivileged caller before root takes over. Attackers exploit this with two race conditions: mounting a FUSE filesystem over the scratch directory to escape isolation, and redirecting a symlink so snap-confine writes to an attacker-controlled target before ownership transfers. A malicious rules file dropped via /run/udev/rules.d/ bypasses AppArmor, forcing systemd-udevd to execute commands as root. Canonical has released patches. Since affected snapd ships by default, workstations and developer systems are in scope—administrators should verify installed snapd versions and update immediately.

5. Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication

A high-severity flaw in open-source developer platform Windmill, CVE-2026-29059 (CVSS 7.5), is under active exploitation, according to VulnCheck. The bug is an unauthenticated path traversal in Windmill’s “get_log_file” endpoint: an unsanitized filename parameter lets attackers use “../” sequences to read arbitrary server files.

The main risk is exposure of the SUPERADMIN_SECRET environment variable, which—if set—can be used as a Bearer token to gain superadmin access and execute arbitrary code via the job preview API. It’s not set by default, so unconfigured standalone instances face only arbitrary file read. The flaw was patched in Windmill 1.603.3 (January 2026).

Researcher Valentin Lobstein discovered and reported the issue; VulnCheck says attackers are targeting the endpoint to extract “/etc/passwd,” hitting both direct Windmill endpoints and the Nextcloud proxy path. About 170 vulnerable systems remain exposed across 24 countries. Affected organizations should upgrade immediately, as SUPERADMIN_SECRET exposure can escalate to full remote code execution.