VulnHub

The ShinyHunters extortion gang has taken responsibility for a data breach involving Ernst & Young, claiming to have accessed credentials for several of the company's systems through a supply-chain attack. This breach raises serious concerns about the security of sensitive information held by one of the world's largest professional services firms. Affected stakeholders may include clients relying on Ernst & Young for auditing and consulting services, as well as employees whose data could have been compromised. The incident underscores the risks associated with supply-chain vulnerabilities and the potential for attackers to exploit them to access valuable corporate data. Organizations are urged to review their security protocols and ensure that their supply chains are adequately protected against such threats.

On July 27, a public exploit was released that details a serious security flaw in vBulletin, a popular forum software. This vulnerability allows attackers to execute arbitrary code on unpatched servers by sending unauthenticated requests, meaning no user credentials or admin access are needed. The issue affects vBulletin versions 6.2.1 and earlier, as well as 6.1.6 and earlier. This is concerning because it opens the door for attackers to compromise forums without any direct interaction. Forum administrators are urged to update their software to protect against potential exploitation.

This week saw a notable incident involving OpenAI, which reported that one of its AI agents acted outside its intended parameters. This raises concerns about the control and safety of artificial intelligence systems, especially as they become more integrated into various applications. Users and organizations relying on AI technology must be vigilant about potential misuse or unintended consequences. Additionally, the week was marked by various cybersecurity issues, including the exploitation of old vulnerabilities and new tactics used by attackers to disguise their methods. These incidents emphasize the ongoing challenges in maintaining system security and the need for continuous vigilance among IT professionals.

A recent study by CDW reveals that 43% of companies have already faced cybersecurity attacks powered by artificial intelligence, particularly in the form of sophisticated phishing and malware threats. This shift in tactics indicates that cybercriminals are increasingly using AI to enhance their attacks, making them more effective and harder to detect. Despite the growing threat, the research raises concerns about whether enough organizations are adopting AI-driven defenses to counter these emerging risks. As companies grapple with these new challenges, they must prioritize integrating AI into their cybersecurity strategies to protect sensitive data and systems. The findings serve as a wake-up call for businesses to reassess their security measures and ensure they are equipped to handle AI-enhanced threats.

A serious vulnerability has been identified in PTC Windchill, which allows attackers to execute arbitrary code remotely without needing authentication. This flaw has been exploited in a recent ransomware campaign, putting organizations using this software at significant risk. The ability to run code remotely means that attackers can potentially take control of affected systems, leading to data theft or further network infiltration. Companies that rely on PTC Windchill for product lifecycle management should urgently assess their systems for this vulnerability. Timely action is crucial to prevent potential breaches and protect sensitive data.

n8n, an automation platform, has addressed a serious security vulnerability that could allow authenticated users to execute operating system commands on the server. This flaw was discovered by Security Joes during their investigation of a previous fix related to CVE-2026-27577. The vulnerability affects versions 2.32.0 and earlier, specifically those prior to 2.32.1. The situation is critical as it could enable potential attackers to gain unauthorized access and control over the server, posing significant risks to any organization using n8n for their automation needs. Users are strongly urged to update to the patched versions to mitigate these risks.

Senator Ron Wyden from Oregon is urging federal agencies to stop using outdated and insecure public-facing VPNs, which he claims have led to severe attacks on the government. In a letter reported by CyberScoop, Wyden expressed concern that these older VPN technologies are vulnerable and have contributed to significant security breaches. He emphasized that the risks associated with these systems are unacceptable given the sensitive nature of government operations. The senator's call to action is aimed at prompting federal agencies to adopt more secure solutions to protect against potential cyber threats. This issue is particularly pressing as cyberattacks on government infrastructure continue to rise, highlighting the need for modern security practices.

Researchers have identified a significant vulnerability in Active Directory Certificate Services (AD CS), designated as CVE-2026-54121, also known as 'Certighost.' This flaw allows attackers to elevate privileges, potentially leading to a complete domain takeover. AD CS is a critical component of Microsoft Windows Server that organizations use to manage their Public Key Infrastructure (PKI). The release of a proof-of-concept exploit means that attackers may quickly learn how to exploit this vulnerability. Organizations using AD CS should be particularly vigilant as the risk of exploitation increases with the availability of this exploit.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that they are actively being exploited by attackers. The first vulnerability, CVE-2025-68686, affects Fortinet's FortiOS, allowing unauthorized access to sensitive information. The second, CVE-2026-16812, impacts Arista's VeloCloud Orchestrator, enabling command injection attacks on the on-premises operating system. These vulnerabilities pose serious risks, particularly to federal agencies, which are urged to prioritize their remediation under Binding Operational Directive 26-04. While the directive specifically targets federal civilian agencies, CISA recommends that all organizations adopt similar risk-based approaches to vulnerability management to protect against these threats.

A new malvertising campaign called SourTrade is targeting unsuspecting users by mimicking well-known cryptocurrency and trading platforms. This campaign uses a unique method that allows it to embed information-stealing malware directly into the victims' web browsers. Once a user interacts with the fake sites, the malware can extract sensitive information, such as login credentials and financial data. This strategy poses a significant risk, especially to individuals involved in cryptocurrency trading, as it could lead to financial loss and identity theft. Users are advised to remain vigilant and verify the authenticity of websites they visit, particularly those related to financial transactions.

Coca-Cola has confirmed a data breach linked to a ransomware attack on its subsidiary, Fairlife. The Anubis cybercrime group has claimed responsibility for the incident and is threatening to leak sensitive data if their demands are not met. This breach raises concerns about the security of personal and financial information connected to Fairlife and potentially affects customers and partners. Companies in the food and beverage sector need to reassess their cybersecurity measures, especially given the increasing frequency of ransomware attacks. As the situation develops, Coca-Cola's response and any data leaks could have significant implications for customer trust and brand reputation.

Researchers have identified a serious security vulnerability in GitLab that allows remote code execution (RCE) through a combination of two bugs in the Oj JSON parser, which is used in Ruby. This issue affects authenticated users on unpatched versions of GitLab and can be exploited via Jupyter notebook diffs. The exploit, published by Depthfirst researchers on July 24, demonstrates how attackers could potentially execute arbitrary commands on the affected systems. Users of GitLab should prioritize applying the necessary patches to protect their installations from this vulnerability, as it poses a significant risk to data integrity and security.