Attackers spent this week exploiting real production infrastructure faster than most enterprises could patch it that’s the thread running through this Cybersecurity Weekly Report. Between July 20 and July 26, the dominant story was continued fallout from two remote-access zero-days in SonicWall SMA1000 appliances. They were first disclosed on July 14, but fresh technical detail and fresh victims kept surfacing all week.
A critical unauthenticated flaw in the ServiceNow AI Platform moved from disclosed to actively exploited within days. And a novel espionage implant called HOLLOWGRAPH showed just how far attackers will go to turn trusted Microsoft 365 features into invisible command channels. Ransomware activity didn’t slow down either: the Anubis, Qilin, and The Gentlemen groups all stayed active against manufacturing, food and beverage, and industrial targets.
For CISOs, the throughline is simple. Identity infrastructure, remote-access appliances, and SaaS platforms are now the primary battleground, and the gap between disclosure and exploitation keeps shrinking.
Round out the picture with a wave of WordPress mass-exploitation, a new AI-assisted vulnerability scanner from Capital One, and an updated CISA advisory on Iranian-linked attacks against operational technology, and you have the full scope of this week’s cybersecurity report section by section, below.
MAJOR INCIDENTS
1. SonicWall SMA1000 zero-day exploitation deepens (ongoing, confirmed since June 22)
The lead story in this Cybersecurity Weekly Report comes from Volexity, which published a detailed incident-response account this week confirming that threat actor UTA0533 had been chaining two SonicWall SMA1000 vulnerabilities since late June – weeks before SonicWall’s July 14 disclosure. The pair combined a CVSS 10.0 server-side request forgery with a post-authentication code-injection bug.
there, the attackers reached an internal CouchDB service, escalated to root using a tool dubbed ROOTRUN, and deployed a Python loader named KNUCKLEBALL that injected hidden components into a legitimate SonicWall process to stay memory-resident. Stolen material reportedly included VPN session databases and MFA seed configurations – enough to let attackers log into victim Active Directory environments without ever touching the VPN client again. Read More
Why This Matters: this isn’t a smash-and-grab. It’s credential theft engineered for long-term, VPN-less persistence inside identity infrastructure, and it’s the clearest example in thisCybersecurity Weekly Report of exploitation outrunning disclosure.
2. HOLLOWGRAPH turns Microsoft 365 calendars into a covert channel
Group-IB disclosed a new Windows implant this week, and it’s arguably the most unusual entry in thisCybersecurity Weekly Report. HOLLOWGRAPH abuses the Microsoft Graph API and a compromised Microsoft 365 mailbox to run a two-way “dead drop” through calendar events dated to the year 2050.
The malware issues only two commands – get and send – and refreshes its Microsoft Entra ID credentials through DNS tunneling instead of contacting attacker-owned infrastructure directly. Group-IB links it with high confidence to the Cavern backdoor framework and flags tradecraft overlap with Iran-nexus operators, though attribution to a named group remains open. Telemetry pointed to a narrow set of Israeli-linked mailboxes. Read More
Why This Matters: because the channel rides entirely on legitimate Microsoft cloud traffic, perimeter tools have nothing anomalous to flag. Detection has to move to identity and application-permission monitoring – a point worth returning to later in thisCybersecurity Weekly Report.
3. Anubis ransomware lists Coca-Cola’s Fairlife on its leak site
On to ransomware: the Anubis ransomware group added Coca-Cola’s dairy subsidiary Fairlife to its leak site on July 20, just days after Coca-Cola’s SEC filing disclosed the intrusion. The attackers claim roughly one terabyte of production-linked data and set a short leak deadline.
Coca-Cola temporarily suspended U.S. production lines tied to the affected environment while Canadian operations continued, and the company said product safety was unaffected. Read More
Why This Matters: a ransomware group reaching production-adjacent IT systems at a food manufacturer shows how thin the line has become between a data breach and physical operational disruption a distinction thisCybersecurity Weekly Report will keep watching across the manufacturing sector.
4. ServiceNow AI Platform pre-auth RCE (CVE-2026-6875) exploited in the wild
This one moved fast. A critical sandbox-escape vulnerability in the ServiceNow AI Platform went from patched-but-quiet to actively exploited in the space of a week, making it one of the more consequential entries in thisCybersecurity Weekly Report.
Researchers at Defused observed in-the-wild payloads hitting the same pre-authentication endpoint documented by Searchlight Cyber, though the attackers used a different sandbox-escape gadget than the published proof of concept. ServiceNow’s hosted instances were already patched, but self-hosted customers who hadn’t applied the July 13 update remained exposed. Read More
Why This Matters: ServiceNow underpins IT service management and, increasingly, Now Assist generative AI workflows across large enterprises. An unauthenticated remote code execution bug here has a very wide blast radius.
5. wp2shell mass-exploitation accelerates across WordPress
Last on the list though not least, given the numbers involved – a chained pair of WordPress core vulnerabilities, nicknamed wp2shell, saw exploitation grow sharply this week after a public exploit began circulating. The chain combines a REST API batch-route SQL injection with a deserialization flaw to achieve unauthenticated remote code execution on any of the more than 500 million WordPress sites running affected versions. Read More
Why This Matters: WordPress’s sheer install base means even a modest per-site success rate translates into mass compromise, and self-hosted or lightly maintained sites are the most exposed.
ANALYST INSIGHT : Four of the five incidents covered in this Cybersecurity Weekly Report share a pattern: attackers reaching production or identity systems through edge infrastructure VPN appliances, SaaS platforms, content-management software – rather than through endpoint malware. Security vulnerabilities in internet-facing management interfaces are now consistently more valuable to attackers than a phishing email. That should reshape where SOC teams put their monitoring budget for the rest of 2026.
NEW VULNERABILITIES & PATCHES
The CVE list for this Cybersecurity Weekly Report is short but urgent. Every entry below has confirmed active exploitation – not just a theoretical risk rating.
[CVE] CVE-2026-15409 / CVE-2026-15410 – SonicWall SMA1000
CVSS 10.0 (SSRF) and 7.2 (post-auth code injection). Actively exploited since June 22, 2026, per Volexity and Rapid7. Risk: chained exploitation gives root access and credential theft on remote-access appliances. Mitigation: apply SonicWall’s platform hotfixes 12.4.3-03453 or 12.5.0-02835 immediately, and rotate all VPN session credentials and MFA seeds on affected devices. Business impact: a compromised SMA1000 appliance is a direct bridge into Active Directory – and it’s the single highest-priority patch item in thisCybersecurity Weekly Report.
[CVE] CVE-2026-6875 – ServiceNow AI Platform
Unrated public CVSS at time of writing; described as a pre-authentication sandbox-escape RCE. Actively exploited as of July 18–20 via the /assessment_thanks.do endpoint. Mitigation: apply the July 13 patch to all self-hosted and partner-hosted instances; hosted customers should verify the fix landed automatically. Business impact: full compromise of the ServiceNow instance and any connected proxy servers. Call it the second must-patch item flagged in thisCybersecurity Weekly Report.
[CVE] CVE-2026-63030 / CVE-2026-60137 – WordPress Core (“wp2shell”)
Critical pre-authentication RCE chain via REST API batch-route SQL injection. Exploitation accelerated this week following a public proof-of-concept release. Mitigation: update WordPress core to the patched release, and audit for webshells if a site was internet-facing and unpatched during the exposure window. It’s a fast-moving story, and one thisCybersecurity Weekly Report will keep tracking.
[CVE] CVE-2026-50522 – Microsoft SharePoint Server
CVSS 9.8 deserialization-of-untrusted-data flaw, patched in July’s Patch Tuesday, now under active exploitation per watchTowr following a public proof-of-concept release. Mitigation: apply the July cumulative update, and where patching is delayed, restrict SharePoint Server internet exposure and enable AMSI-based request scanning a recurring theme across thisCybersecurity Weekly Report.
[CVE] CVE-2026-8933 – Ubuntu snap-confine local privilege escalation
CVSS 7.8. Lets an unprivileged local user obtain root on default Ubuntu Desktop 24.04, 25.10, and 26.04 installs. Mitigation: apply distribution security updates as they roll out, and treat multi-user Ubuntu Desktop endpoints as a higher priority than single-user workstations. That rounds out the vulnerability list for thisCybersecurity Weekly Report.
PRIORITY ACTION : The single priority action from this Cybersecurity Weekly Report: if your organization runs SonicWall SMA1000, self-hosted ServiceNow, on-premises SharePoint Server, or internet-facing WordPress, confirm patch status against these five CVEs before end of week. Every one of them is being actively exploited right now – not theoretically exploitable.
RANSOMWARE ACTIVITY
Ransomware activity kept climbing this week, and the numbers back it up: multiple trackers report roughly 20% year-over-year growth in global ransomware attacks through the first half of 2026, alongside a sharp jump in attacks against billion-dollar companies in Q2. The Qilin and The Gentlemen ransomware groups remain locked in a near-even rivalry for the top spot by claimed victim count, with each surpassing roughly 300 victims in Q2 2026 alone – a dynamic several trackers attribute to competitive one-upmanship between the two crews rather than a coordinated campaign.
Qilin (also tracked as Agenda) was observed this week exploiting a patched Palo Alto Networks PAN-OS authentication-bypass vulnerability as an initial-access vector, underscoring how quickly ransomware affiliates weaponize enterprise firewall disclosures.
Separately, the Anubis group’s pressure campaign against Fairlife (see Major Incidents) and a new ransomware strain called ENCFORGE – notable for specifically targeting AI model files through a Langflow remote code execution flaw – both point to ransomware operators adapting their targeting toward newer categories of enterprise infrastructure, including AI development pipelines.
Double-extortion leak-site pressure remains the default playbook across nearly every active group tracked in thisCybersecurity Weekly Report, with victims spanning manufacturing, legal services, healthcare, and non-profit sectors.
ANALYST INSIGHT : Here’s the ransomware angle worth flagging in this week’s cybersecurity report: ENCFORGE targeting Langflow AI model files is an early but meaningful signal. As organizations stand up more internal AI/ML pipelines, those pipelines are becoming a distinct ransomware target category rather than an extension of existing IT infrastructure – and most incident response playbooks don’t yet cover them.
THREAT INTELLIGENCE
The threat intelligence section of this week’s cybersecurity report is led by Group-IB’s HOLLOWGRAPH report (see Major Incidents), the most significant espionage disclosure this week, which used
[TTP] trusted-cloud C2 abuse via the Microsoft Graph API and
[IOC] calendar events dated 2050-05-13 with GUID-style subjects as its primary detection hooks. Separately, SentinelOne’s SentinelLabs detailed a sustained, multi-year espionage campaign against Pakistani law enforcement agencies, attributed to suspected China- and India-aligned threat actors targeting servers hosting biometric, criminal-case, and identity-record databases through compromised web applications disguised as portal updates.
In Japan, the China-nexus actor APT-C-60 continued spear-phishing campaigns using Proton Drive links and RAR archives to deliver SpyGlace spyware, abusing legitimate developer platforms including GitHub, GitLab, and jsDelivr to host payloads and blend malicious traffic with normal developer activity – a living-off-the-land approach consistent with MITRE ATT&CK technique T1102 (Web Service C2).
Kaspersky, meanwhile, kept tracking Armored Likho, a Python-infostealer campaign targeting government and power-grid personnel in Russia, Kazakhstan, and Brazil. Researchers say it increasingly relies on AI-generated code to strip away the stylistic fingerprints that normally aid attribution – a trend thisCybersecurity Weekly Report expects to keep surfacing.
ANALYST INSIGHT : Three separate campaigns tracked in this Cybersecurity Weekly Report – HOLLOWGRAPH, APT-C-60, and Armored Likho – each leaned on trusted, legitimate infrastructure (Microsoft cloud services, developer CDNs, AI-generated code) specifically to defeat signature-based detection. Threat intelligence teams should treat “traffic to a trusted cloud provider” as a category that now requires behavioral baselining, not an automatic allow-list.
INDUSTRY NEWS
CISA opens the industry-news portion of this Cybersecurity Weekly Report with an updated joint advisory on Iranian-affiliated actors exploiting internet-connected programmable logic controllers. The July 22 update expands the vendor scope beyond Rockwell Automation/Allen-Bradley to include Schneider Electric and Siemens PLCs, and adds new guidance for detecting malicious changes inside reusable PLC code modules – a meaningful update for any critical-infrastructure operator running OT alongside IT networks.
Separately, GitHub announced it will cut public bug bounty payouts by at least half across every severity tier starting July 27, shifting the largest rewards into a new invite-only VIP tier; researchers with reports already filed before the cutoff keep the old payout terms.
A Splunk-commissioned report published this week found that one in five CISOs say they’ve faced pressure to conceal a cybersecurity incident from stakeholders or regulators – a data point worth flagging for any board-level conversation about incident-response governance and disclosure obligations.
On the vendor side, Palo Alto Networks confirmed its acquisition of an observability platform, extending a push beyond core security into infrastructure monitoring following its earlier Chronosphere deal. It’s a deal-making trend thisCybersecurity Weekly Report expects to continue through the rest of 2026.
CYBERINFOS TAKEAWAY : If a security team reads only one item from this Cybersecurity Weekly Report, make it this: the gap between vulnerability disclosure and mass exploitation is now frequently measured in days, not weeks. SonicWall, ServiceNow, and SharePoint were all disclosed-then-exploited within a week or two this cycle, and patch cadence has to compress to match.
TOOL UPDATES
Capital One opens this week’s tool-updates roundup with VulnHunter, an agentic AI tool released under Apache 2.0 and optimized for Claude Opus 4.8. It reasons from an attacker’s perspective to find and validate exploit paths in large codebases, rather than relying solely on traditional static analysis, and has already been run against thousands of repositories.
Debian, meanwhile, shipped version 13.6 of its Trixie release on July 11 – still relevant to teams patching this week bundling kernel, Nginx, Redis, and Chromium security fixes alongside an fwupd update capable of refreshing UEFI Secure Boot certificate authorities ahead of the 2013 default CA’s expiry.
OpenTofu released v1.12.2, fixing a security issue in its Encrypted Client Hello implementation that could let a passive network observer de-anonymize a server hostname even with ECH enabled.
And Help Net Security’s ongoing open-source roundup highlighted AIMap, a new tool purpose-built to discover and fingerprint exposed Ollama servers, MCP endpoints, and inference proxies at internet scale a timely release given how many unauthenticated AI inference endpoints are now reachable from the public internet. It’s one thisCybersecurity Weekly Report will revisit as adoption grows.
LOOKING AHEAD
Mark the calendar: Black Hat USA 2026 runs August 1-6, and DEF CON 34 follows August 6-9, both in Las Vegas. Expect a fresh wave of vulnerability disclosures and offensive-tooling releases during “Hacker Summer Camp” that will likely dominate next week’s cybersecurity report.
GitHub’s public bug bounty payout cuts take effect July 27, which may shift researcher disclosure incentives toward the private VIP tier or toward other platforms entirely. And CISA’s federal patch deadline for the second actively exploited SonicWall SMA1000 flaw falls this week organizations still running unpatched appliances should treat that same deadline as their own internal benchmark, regardless of sector.
[WATCH] HOLLOWGRAPH’s operator has not yet been attributed to a named threat actor despite the Cavern-framework link. Watch for follow-on reporting from Group-IB or partner vendors that may extend attribution or reveal additional victims outside the currently observed Israeli-linked scope.
BY THE NUMBERS
The statistics behind this Cybersecurity Weekly Report, traced to a named source wherever possible:
| Metric | Figure | Source |
|---|---|---|
| Global ransomware attack growth, H1 2026 vs. H1 2025 | ~20% increase | SWK Technologies / industry trackers |
| Quarter-over-quarter rise in attacks on billion-dollar companies | 74% | SWK Technologies |
| Qilin / The Gentlemen claimed victims, Q2 2026 (each) | ~300 | SWK Technologies |
| SonicWall SMA1000 zero-day exploitation window before disclosure | Since June 22, 2026 | Volexity |
| ServiceNow CVE-2026-6875 CVSS rating | Critical (pre-auth RCE) | Searchlight Cyber / Help Net Security |
| WordPress sites potentially exposed to wp2shell | 500 million+ | Cyber Security News |
| CISOs reporting pressure to hide an incident | 1 in 5 | Splunk-commissioned report |
| GitHub bug bounty critical payout after July 27 cut | Reduced to $10,000 fixed | GitHub / HackerNews |
RECOMMENDED READING
The primary sources behind thisCybersecurity Weekly Report, for anyone who wants the full technical detail:
- Proxying to Compromise: SonicWall SMA 0-day Exploitation – Volexity. The full technical incident-response account behind thisCybersecurity Weekly Report’s lead story on UTA0533’s SonicWall exploitation chain.
- HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert C2 – Group-IB. Primary source behind thisCybersecurity Weekly Report’s coverage of the calendar-based espionage implant and its indicators of compromise.
- ServiceNow pre-auth RCE exploited in the wild (CVE-2026-6875) – Help Net Security. Confirms in-the-wild exploitation and patch guidance for the second must-patch item in thisCybersecurity Weekly Report.
- SonicWall SMA zero-days were exploited weeks before disclosure – Help Net Security. Malware naming and root-access mechanics.
- Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers – CISA. Updated joint advisory covering Rockwell, Schneider Electric, and Siemens PLCs.
- Critical ServiceNow code execution flaw now exploited in attacks – BleepingComputer. Vendor statement and patch timeline.
- SWK Cybersecurity News Recap July 2026 – SWK Technologies. Ransomware statistics and Fairlife/Anubis context.
FREQUENTLY ASKED QUESTIONS
What should SOC teams prioritize from this week’s cybersecurity report?
Per this Cybersecurity Weekly Report, patch SonicWall SMA1000, self-hosted ServiceNow, and internet-facing SharePoint Server first. All three have confirmed active exploitation this week, and the SonicWall compromise chain in particular has been running since late June.
How often does CyberInfos publish a weekly cybersecurity report?
This Cybersecurity Weekly Report goes out every week, covering the seven-day reporting window in its title, so SOC teams can track incidents, CVEs, and ransomware activity without digging through dozens of separate advisories.
Is HOLLOWGRAPH a Microsoft 365 vulnerability?
No – and this Cybersecurity Weekly Report wants to be clear on that point. HOLLOWGRAPH abuses legitimate Microsoft Graph API functionality through a compromised mailbox and stolen Entra ID credentials. There’s no patch to apply here; defense depends on identity monitoring, OAuth application audits, and watching for calendar events dated far in the future.
Which ransomware groups were most active this week?
Per this Cybersecurity Weekly Report, Qilin and The Gentlemen remain in a near-tied rivalry for most claimed victims in 2026, while Anubis pressured Coca-Cola’s Fairlife subsidiary and a new strain, ENCFORGE, began targeting AI model files specifically.
Final Thoughts
This Cybersecurity Weekly Report makes one point hard to avoid: the SonicWall, ServiceNow, and SharePoint stories all followed the same arc – quiet exploitation, public disclosure, then a scramble to patch before mass exploitation caught up. Pair that with an espionage implant that needs no vulnerability at all, just a stolen identity and a calendar, and the lesson for the week is clear.
Patch management and identity monitoring now have to move at the same speed. CyberInfos will keep tracking all of it – SonicWall’s federal patch deadline, HOLLOWGRAPH attribution, and next week’s Black Hat and DEF CON disclosures – in next week’sCybersecurity Weekly Report.
This Cybersecurity Weekly Report was researched and compiled from primary vendor advisories, CISA publications, and named security research firms current as of July 26, 2026. Developing stories are marked as such; figures without a confirmed public source are noted rather than estimated.
