Update now: 7-Zip fixes RCE flaw exploitable with malicious archives

BleepingComputer

July 18, 2026 at 7:32 PM

Overview

7-Zip has released version 26.02 to address a serious remote code execution (RCE) vulnerability. This flaw allows attackers to execute malicious code on users' systems if they open specially crafted compressed files. Users of 7-Zip should update to the latest version to protect themselves from potential exploitation. The vulnerability is particularly concerning as it could be exploited easily by tricking users into opening harmful files. Keeping software up to date is crucial in maintaining security and preventing such attacks.

Key Takeaways

Affected Systems: 7-Zip version 26.02 and earlier
Action Required: Update to 7-Zip version 26.
Timeline: Newly disclosed

Original Article Summary

7-Zip version 26.02 was released to fix a remote code execution vulnerability that could allow attackers to execute malicious code by convincing users to open specially crafted compressed files. [...]

Impact

7-Zip version 26.02 and earlier

Exploitation Status

The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.

Timeline

Newly disclosed

Remediation

Update to 7-Zip version 26.02

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Vulnerability, Update, RCE.

Read Original Article

Related Coverage

OpenSSL Fixes HollowByte Memory Exhaustion Bug

Security Affairs

Okta has reported a new vulnerability in OpenSSL, dubbed HollowByte, which allows remote attackers to exploit a flaw that can lead to memory exhaustion on servers. This specific vulnerability is only 11 bytes long, and when exploited, it can cause a server to allocate up to 131 KB of memory. As a result, this could trigger denial-of-service attacks, rendering the affected servers unable to respond to legitimate requests. Organizations using affected versions of OpenSSL should prioritize patching this vulnerability to protect their systems from potential exploitation. The risk is significant, as attackers can exploit this flaw without needing authentication, making it easier for malicious actors to disrupt services.

Jul 18, 2026

WordPress Core "wp2shell" RCE flaws get public exploits, patch now

BleepingComputer

Recent vulnerabilities known as 'wp2shell' have been discovered in WordPress Core, allowing remote code execution. These flaws are particularly concerning because public exploits have now been released, meaning attackers can actively take advantage of them. Administrators of WordPress sites need to act quickly to patch their systems to protect against potential breaches. The urgent nature of this situation is underscored by the fact that these vulnerabilities can compromise the security of websites, putting sensitive data at risk. Users of WordPress should ensure they are running the latest version to mitigate these risks.

Jul 18, 2026

Two new high severity WordPress vulnerabilities, patch immediately!

Help Net Security

WordPress has released a security update, version 7.0.2, to address two significant vulnerabilities that pose risks to users. The first vulnerability, identified as CVE-2026-60137, is a SQL injection issue that could allow attackers to manipulate databases. The second, also CVE-2026-60137, relates to a REST API batch-route confusion that could lead to remote code execution, potentially giving attackers full control over affected systems. The vulnerabilities affect WordPress version 6.9 and earlier. Users are strongly advised to update their installations immediately to mitigate the risks associated with these security flaws.

Jul 18, 2026

2 charged in New York for laundering $43 million from investment scams

SCM feed for Latest

Zhuoying Chen, 27, and Haojie Zhang, 38, have been charged in New York for allegedly laundering $43 million that was obtained through various investment scams. The two men are accused of operating a network that funneled this significant sum of money to China, raising concerns about the scale and sophistication of financial fraud schemes. The case illustrates how cybercriminals are increasingly using complex methods to hide illicit funds, which can undermine legitimate financial systems. Authorities are focusing on these activities to combat financial crimes and protect potential victims from similar scams. The investigation underscores the ongoing challenges law enforcement faces in tracking and prosecuting financial fraud linked to cyber activities.

Jul 17, 2026

New Russian-speaking threat actor UAT-11795 targets US and Europe with novel malware

SCM feed for Latest

A new Russian-speaking hacking group known as UAT-11795 is targeting organizations in the United States and Europe. This group is using innovative malware tools, specifically the Starland Remote Access Trojan (RAT) built with Python and the PowerShell-based WLDR agent, which operates solely in memory. These tools are designed to evade detection through encrypted communications and a unique execution environment. The emergence of UAT-11795 raises concerns for businesses and government entities, as their tactics could lead to significant data breaches or system compromises. As cyber threats continue to evolve, organizations need to be vigilant and enhance their security measures to defend against such sophisticated attacks.

Jul 17, 2026

WatchGuard report highlights employee behavior risks for SMBs

SCM feed for Latest

According to the 2026 Cybersecurity Hygiene Report, a significant concern for small and medium-sized businesses (SMBs) is the use of unauthorized AI tools by employees. The report reveals that 64% of employees engage with these tools, leading to an increase in what's called 'shadow AI.' This practice can create visibility gaps within organizations, making it harder for IT departments to monitor and secure sensitive data. As employees turn to unsanctioned applications, the risk of data breaches and compliance issues rises. Companies need to address these behavioral risks by implementing clear policies and training to ensure that employees understand the potential dangers of using unapproved technology.

Jul 17, 2026