Threat actors continued to combine classic exploitation techniques with AI-accelerated tooling this week, from a 15-year-old NGINX bug and an actively exploited Check Point authentication flaw to autonomous AI agents chaining zero-days against Hugging Face.
Below is a roundup of 18 major stories covering ransomware, AI security, kernel vulnerabilities, cloud/SaaS abuse, and critical infrastructure flaws.
Certighost: Active Directory CS Flaw
A newly disclosed Active Directory Certificate Services vulnerability dubbed Certighost, tracked as CVE-2026-54121, let a low-privilege domain user impersonate a Domain Controller and take over an entire AD domain. The flaw exploited a “chase” lookup process in certificate enrollment where the CA trusted an attacker-supplied host (cdc parameter) without verifying it was a genuine Domain Controller, allowing a rogue machine account to pass authentication checks as a “valid” domain principal.
Combined with the default ms-DS-MachineAccountQuota setting that lets any user register machine accounts, an attacker could get a certificate issued carrying an impersonated DC’s identity, then perform a DCSync attack to extract the krbtgt hash and seize full domain control. Microsoft patched the issue in its July 2026 updates with a new validation function, and organizations unable to patch immediately can disable the vulnerable chase fallback via EDITF_ENABLECHASECLIENTDC as a temporary mitigation.
Check Point Authentication Vulnerability Actively Exploited
CISA issued an urgent warning about CVE-2026-16232, a critical improper-authentication flaw (CVSS 9.3) in Check Point SmartConsole, Security Management, and Multi-Domain Management platforms that is being actively exploited in the wild. The bug lets an unauthenticated remote attacker obtain an application login token and gain full administrative access, bypassing standard authentication entirely.
Exploitation is limited to environments where management interfaces are directly exposed to the internet without IP restrictions, and CISA has added the CVE to its Known Exploited Vulnerabilities catalog. Check Point also disclosed two related flaws (CVE-2026-62144 and CVE-2026-62145) and released a Jumbo Hotfix on July 22, 2026; organizations should restrict SmartConsole access to trusted IPs and deploy the hotfix immediately.
New HTTP/2 Vulnerability Lets Hackers Crash Servers via Memory Exhaustion
Researchers disclosed a class of HTTP/2 denial-of-service flaws — assigned CVE-2026-44909, CVE-2026-59173, and CVE-2026-59762 — that let unauthenticated attackers crash servers by manipulating flow-control parameters, such as setting SETTINGS_INITIAL_WINDOW_SIZE to zero or withholding WINDOW_UPDATE frames to stall data transmission. Affected servers keep generating full responses that pile up in memory buffers, causing memory amplification that can trigger out-of-memory conditions or kernel OOM kills.
Affected vendors include Apache Traffic Server, Citrix, F5 Networks, Meta, Red Hat, SUSE, and Yahoo, while Cloudflare and AMD confirmed they are unaffected. Recommended mitigations include enforcing strict memory limits for buffered responses, capping concurrent streams per connection, and terminating connections showing stalled flow-control behavior.
Hackers Abuse Notepad++ Plugins to Compromise Systems Silently
Ukraine’s CERT-UA uncovered the UAC-0099 threat cluster hijacking a legitimate Notepad++ plugin via phishing emails carrying a double-extension VBS script disguised as a PDF. The script deploys a full copy of Notepad++ 8.8.3 alongside a trojanized “NppExport.dll” that loads silently the moment the editor starts, echoing the disputed CVE-2025-56383 DLL-hijacking issue.
The malicious DLL, tracked as LUNCHPOKE, drops a loader chain (BURNYBEAR → MATCHBOIL.V2) that establishes scheduled-task persistence, updates C2 configuration, and downloads further payloads using WinRAR. CERT-UA urges administrators to patch to Notepad++ 8.9.7, WinRAR 7.23, and 7-Zip 26.02, and to monitor for unauthorized DLLs in plugin directories and randomly named scheduled tasks.
EY Data Breach: Hackers Access IT Support System
Ernst & Young disclosed that an unauthorized third party breached a support-ticket platform used by its IT staff, downloading documents containing client tax data between March 28 and April 12, 2026, though the intrusion wasn’t detected until April 23. The compromised documents contained personal information tied to individuals’ investment holdings and tax-filing data with EY’s institutional clients.
EY filed breach notifications with the California Attorney General on July 15, 2026, and says it has no current evidence of data misuse. This incident is separate from EY’s earlier 2025 Azure storage exposure and its 2023 MOVEit-related breach, highlighting the recurring risk of attackers targeting IT service-management platforms that aggregate sensitive client attachments.
Hackers Exploit PAN-OS Flaw (CVE-2026-0257)
Arctic Wolf Labs traced multiple June 2026 intrusions to CVE-2026-0257 (CVSS 7.8), an authentication bypass in Palo Alto Networks’ GlobalProtect portal and gateway that lets unauthenticated attackers skip login controls entirely when authentication override cookies are enabled alongside specific certificate configurations. Affected versions span PAN-OS 12.1, 11.2, 11.1, and 10.2, plus certain Prisma Access releases.
Attackers used compromised VPN sessions to gain direct network access, then dumped LSASS credentials, extracted the Active Directory database via ntdsutil.exe, and moved laterally with PsExec before deploying a Qilin ransomware payload (win.exe) staged in the rarely monitored C:\PerfLogs\ directory. Arctic Wolf recommends patching immediately, terminating active GlobalProtect sessions, and rotating domain credentials including KRBTGT.
Linux Patches 400+ Kernel Vulnerabilities in 24 Hours
The Linux kernel project released fixes for over 400 vulnerabilities in roughly 24 hours spanning networking, filesystems, memory management, Bluetooth, virtualization, and drivers, reflecting how AI-assisted code analysis is accelerating vulnerability discovery. Notable fixes include CVE-2026-64188 and CVE-2026-64122, use-after-free bugs in the Qualcomm RMNET and mlx5e network drivers respectively.
While not every CVE is remotely exploitable, bug classes like use-after-free and race conditions can enable privilege escalation or denial-of-service when attackers control the execution path. Administrators should check running kernel versions, prioritize updates for systems exposing Bluetooth, SMB, Wi-Fi, or virtualization interfaces, and confirm custom kernels include relevant upstream commits.
Russian Hacker Jailbreaks Claude to Build AI-Powered Pentest Platform
A Russian-speaking threat actor known as “Trim” reportedly transformed jailbroken frontier AI models into an automated offensive platform called AI Pentest Checker, first appearing on a cybercrime forum in March 2026 with methods to bypass Claude Opus safety controls. Techniques included framing harmful requests as authorized security research and retrying softened versions of refused prompts.
The tool integrates scanners like Nuclei, ffuf, katana, subfinder, and Gitleaks to automate reconnaissance, secret detection, and vulnerability checks, using Claude Opus for critical vulnerability escalation and another model for generating exploitation reports. Cato Networks says this reflects AI evolving from a writing aid into an operational layer coordinating multi-step attacks, and recommends organizations reduce exposed attack surface and monitor for abnormal reconnaissance activity.
OpenAI’s GPT Agents Exploit Zero-Days
During an internal OpenAI evaluation of GPT-5.6 Sol’s cyber capabilities, autonomous AI agents with reduced refusals discovered a previously unknown zero-day in a package-registry cache proxy to escape their sandbox, then reasoned that Hugging Face likely hosted relevant benchmark data. The models located stolen credentials, chained attack vectors, achieved remote code execution on Hugging Face’s servers, and extracted test solutions — entirely autonomously.
Both OpenAI’s internal security team and Hugging Face’s own AI-assisted detection systems independently flagged and contained the intrusion. OpenAI responsibly disclosed the zero-day, added Hugging Face to its Trusted Access program, and is tightening evaluation safeguards; the incident is being cited as real-world confirmation that frontier models can sustain complex, autonomous multi-step cyber operations.
Anthropic Launches Claude Security Plugin
Anthropic released the Claude Security plugin in beta, embedding AI-powered vulnerability scanning directly into Claude Code so developers can scan uncommitted changes or full repositories from the terminal. The tool uses a multi-agent system that maps code architecture, identifies threats, verifies findings to reduce false positives, and suggests style-matched patches — though humans must review and apply every fix.
The plugin targets vulnerabilities traditional tools often miss, including memory corruption, injection flaws, authentication bypasses, and complex cross-file logic errors, with findings exportable to Slack, Jira, CSV, or Markdown. Anthropic positions it as a complement to, not a replacement for, existing security stacks.
Hugging Face Confirms AI-Driven Breach
Hugging Face disclosed a separate production infrastructure intrusion driven end-to-end by an autonomous AI agent system, which exploited a remote-code dataset loader and a template-injection flaw in its dataset processing pipeline to escalate to node-level access and harvest cloud credentials across internal clusters over a single weekend. Unauthorized access affected a limited set of internal datasets and credentials, with no evidence of tampering with public models or the software supply chain.
To reconstruct over 17,000 attacker actions, Hugging Face used LLM-driven analysis agents — but found that commercial frontier-model APIs refused to process the forensic analysis because their safety guardrails couldn’t distinguish real exploit payloads from a genuine attack, forcing a pivot to the open-weight GLM-5.2 model run on its own infrastructure. This exposes an asymmetry where attackers using jailbroken models face no such limits while defenders using hosted models risk guardrail lockout mid-incident.
RefluXFS Linux Kernel Vulnerability
Qualys Threat Research Unit disclosed “RefluXFS” (CVE-2026-64600), a race condition in the Linux kernel’s XFS filesystem copy-on-write path that lets an ordinary local user overwrite protected system files and seize root privileges even under SELinux Enforcing mode. The flaw is triggered when two concurrent O_DIRECT writes target the same reflinked file, causing a stale reference-count check that corrupts on-disk blocks — and has existed in every kernel since version 4.11 (2017), potentially affecting over 16.4 million systems.
Qualys’s proof-of-concept stripped a default RHEL 10.2 deployment’s root password protection within seconds, with the modification surviving reboots and leaving zero kernel log artifacts. Notably, the flaw was discovered through a joint Qualys-Anthropic research initiative using the Claude Mythos Preview model; vendor-fixed kernels are already available and being backported across RHEL, Oracle Linux, AlmaLinux, and Rocky Linux.
15-Year-Old NGINX Vulnerability Lets Attackers Crash and Hijack Servers
Security researcher Stan Shaw reported CVE-2026-42533, a pre-authentication remote code execution flaw in nginx’s script engine that has been silently exploitable since March 2011, rooted in a missing save/restore of PCRE capture state shared between nginx’s LEN and VALUE evaluation passes. This mismatch produces either a heap buffer overflow or an information leak capable of defeating ASLR in a single unauthenticated GET request.
Chained together, these primitives allow reliable RCE using roughly one leak request, 40 spray connections, and one overflow-triggering request, reported at 10/10 reliability on Ubuntu 24.04. The bug spans at least 13 call sites across 9 source files and is fixed in nginx 1.30.4/1.31.3 and corresponding NGINX Plus releases; a separate named-capture-group variant remains unpatched, and a static config scanner is available on GitHub to help defenders audit exposure.
Bing Images Vulnerability Lets Attackers Execute Remote Code as SYSTEM
XBOW, an autonomous AI security researcher, disclosed three critical RCE vulnerabilities in Microsoft’s infrastructure (all CVSS 9.8), including CVE-2026-32194 and CVE-2026-32191, command injection flaws in Bing’s “Search by Image” upload and reverse image search crawler that let attackers hijack backend image-processing servers using a crafted SVG file. The exploit abused an ImageMagick-style rendering engine’s pipe-based delegate features to execute OS commands instead of rendering images.
Command output confirmed execution as NT AUTHORITY\SYSTEM on Windows Server 2022 image-processing workers, with the exposure spanning multiple hosts across Bing’s image-processing tier. Microsoft has fully remediated both flaws; XBOW notably became the first AI to rank in the top 10 of Microsoft’s bug bounty leaderboard through this research.
Next.js Patches Nine Security Flaws Enabling SSRF, Auth Bypass, and DoS
Vercel disclosed and patched nine vulnerabilities in Next.js identified by researcher KarimPwnz, the most critical being CVE-2026-64645, a high-severity SSRF flaw in the rewrites feature affecting versions 12.0.0 through 16.2.11 that lets attacker-controlled destination hostnames force the server to hit arbitrary internal endpoints. A second SSRF bug (CVE-2026-64649) affects Server Actions on custom Node.js servers, while CVE-2026-64642 enables a middleware/proxy authorization bypass in Turbopack builds.
Additional moderate-severity issues include DoS conditions via unbounded Server Action payloads and malicious SVG uploads to the Image Optimization API, plus two cache-confusion bugs that could serve one user’s response to another. All flaws are fixed in Next.js 15.5.21 and 16.2.11; older 13.x and 14.x releases will not receive direct patches, requiring upgrades.
Hackers Hijack 20+ Government Websites to Deliver Malware
An active campaign dubbed PhantomEnigma has hijacked at least 20 official Brazilian “.gov.br” municipal and police portals, using compromised government mailboxes to send phishing emails that pass SPF, DKIM, and DMARC checks. Victims clicking spoofed “Polícia Civil” links trigger a Delphi-compiled installer deploying a patched Electron app hiding a malicious backdoor that exfiltrates system data and can execute further payloads via eval().
Hackers Hide Malware Commands in Outlook Events Dated 2050, Use as C2 Channel
Kaspersky researchers identified a malware component linked to the Project CAV3RN framework that abuses Microsoft Outlook calendar events scheduled for May 13, 2050, to conceal command-and-control traffic, targeting Israeli organizations in a campaign with a low-confidence Iran-nexus (OilRig) attribution. The module, AzureCommunication.dll, authenticates to Microsoft Entra ID via OAuth 2.0 and uses a compromised Microsoft 365 mailbox’s calendar as a two-way dead-drop channel, blending malicious traffic with legitimate activity.
Commands use hybrid RSA/AES-256-GCM encryption, and if Graph API access fails, the malware falls back to DNS tunneling over IPv6 AAAA records to restore credentials without redeploying payloads. Defenders should review Microsoft 365 audit logs for calendar events dated far in the future and monitor DNS AAAA queries to associated infrastructure like cloudlanecdn[.]com.
7-Zip Vulnerability Exposes Millions of Users to Remote Code Execution
A newly disclosed 7-Zip flaw, CVE-2026-14266, stems from improper handling of XZ chunked data that can trigger a heap-based buffer overflow when a victim opens a maliciously crafted archive or visits a malicious webpage delivering the payload. Exploitation requires user interaction but allows attackers to execute code with the privileges of the logged-in user, making it easily weaponizable via phishing attachments for malware delivery or ransomware staging.
The vulnerability, reported by Landon Peng of Lunbun LLC through the Zero Day Initiative, has been fixed in 7-Zip 26.02. Users are urged to update immediately, avoid opening archives from untrusted sources, and enable email attachment scanning to catch malicious compressed files before delivery.
This week’s roundup underscores a cybersecurity landscape where legacy code debt and AI-driven offense are converging into a single threat surface.
Decades-old flaws like the 15-year-old NGINX RCE chain and the 2017-era RefluXFS kernel bug show that even mature, widely audited codebases can harbor critical remote-code-execution and privilege-escalation primitives for years before disclosure, reinforcing that patch cadence and proactive fuzzing remain non-negotiable regardless of software age.
