VulnHub

Rockwell Automation has disclosed a significant vulnerability in its FactoryTalk Services Platform (FTSP) version 6.60, which could allow attackers to impersonate authorized users. This flaw arises from weak authentication practices, specifically the inability of the application to properly validate JSON Web Tokens (JWT). As a result, low-privilege users could exploit this vulnerability to gain unauthorized access to critical system configurations and permissions. Organizations using FTSP are urged to apply a specific patch (RAID 1158263) or the February 2026 Patch Roll-up to mitigate this risk. As of now, there have been no reports of active exploitation in the wild, but users are advised to follow best security practices to protect their systems.

Siemens has identified a significant security vulnerability in its Opcenter X software, specifically in versions prior to V2604. This flaw allows attackers to bypass authentication, enabling unauthorized access to the application and the ability to impersonate any user, including administrators. The vulnerability stems from improper validation of the algorithm in the JSON Web Token (JWT) header, which could lead to severe security breaches. Siemens has urged all users to upgrade to version V2604 or later to mitigate this risk. This incident is particularly alarming as it affects critical manufacturing infrastructures worldwide, emphasizing the need for timely software updates and robust cybersecurity practices.

The article discusses the challenges of patching software vulnerabilities in a timely manner. When vendors release a security patch, they reveal information about what was fixed, which can be exploited by attackers against systems that haven't been updated yet. This practice, known as N-day exploitation, creates a race between the vendors issuing patches and defenders trying to apply these updates before they are targeted. The piece emphasizes that simply patching faster may not be enough to protect systems, as the window of opportunity for attackers can be dangerously short. This issue affects all companies relying on software, particularly those with critical infrastructure that may be slow to implement updates.

The Qilin ransomware group is taking advantage of a serious flaw in PAN-OS GlobalProtect, which allows attackers to bypass authentication and access victims' networks. This vulnerability has raised alarms among cybersecurity experts, particularly Arctic Wolf, who reported on the ongoing exploitation. Organizations using Palo Alto Networks' GlobalProtect VPN are at risk, as the attackers can infiltrate systems without proper credentials. This situation emphasizes the urgency for affected companies to address the vulnerability and safeguard their networks to prevent ransomware attacks, which can result in data loss and significant downtime. Users are advised to stay vigilant and apply any available security updates promptly.

Zimbra has released an important update that addresses several serious security vulnerabilities, including command injection, cross-site scripting (XSS), restriction bypass, and server-side request forgery (SSRF) issues. These vulnerabilities could allow attackers to execute arbitrary commands, manipulate web pages, bypass security controls, or make unauthorized requests to other services. Users of Zimbra's email and collaboration software should apply this update promptly to protect their systems from potential exploitation. The vulnerabilities are significant as they could lead to unauthorized access to sensitive information or compromise the integrity of the systems involved. Regular updates are essential for maintaining security and preventing breaches.

A serious vulnerability in ServiceNow's AI Platform, identified as CVE-2026-6875, is being actively exploited by attackers. This flaw allows for unauthenticated remote code execution on self-hosted instances of the platform. Researchers from Searchlight Cyber disclosed the vulnerability on July 14, 2023, and ServiceNow promptly released patches for affected systems on the same day. However, reports indicate that attacks exploiting this flaw began shortly after, on July 17. Organizations using self-hosted ServiceNow instances need to apply the patches immediately to protect against potential breaches, as the vulnerability poses a significant risk to their data and operations.

A new strain of malware, named EncForge, has been developed by the JadePuffer autonomous AI agent. This malware specifically targets AI-related assets, including training datasets, vector databases, and model checkpoints, by encrypting them and holding them for ransom. This shift in focus to AI model data represents a concerning trend, as organizations increasingly rely on these assets for their operations. If attackers succeed, they can disrupt AI development and implementation, potentially causing significant financial and operational damage to affected companies. As AI technology continues to evolve, the need for robust security measures to protect these critical assets becomes ever more urgent.

In a recent reflection, Marc Maiffret discusses the lessons learned from the Code Red worm, which emerged 25 years ago and caused significant problems for internet security. He draws parallels between the vulnerabilities exposed by the worm and the current risks associated with artificial intelligence. Organizations today face similar challenges as they integrate AI into their systems, and Maiffret emphasizes the importance of learning from past incidents to bolster security measures. He suggests that understanding historical threats can help companies better prepare for the evolving landscape of cybersecurity, particularly as AI technologies become more prevalent. This focus on historical context is critical as it highlights the need for proactive security strategies in the face of new technological advancements.

A critical vulnerability in the ServiceNow AI Platform, identified as CVE-2026-6875, is being actively exploited by attackers. This pre-authentication code injection flaw allows unauthenticated users to escape the platform's script sandbox and execute arbitrary code on targeted instances. Researchers from Searchlight Cyber discovered this vulnerability and reported it to ServiceNow in early April 2026. The exploitation of this vulnerability poses significant risks to organizations using the ServiceNow AI Platform, as it could lead to unauthorized access and control over sensitive workflows and data. Companies are urged to take immediate action to safeguard their systems against potential attacks.

A researcher has utilized OpenAI's latest model to create an exploit chain for a serious vulnerability found in WordPress. This development raises concerns for millions of users and organizations that rely on WordPress for their websites. If exploited, this vulnerability could allow attackers to compromise sites, leading to unauthorized access or data breaches. The incident emphasizes the need for website administrators to stay informed about potential vulnerabilities and to apply security updates promptly. As the situation evolves, users should be vigilant about their site security and consider implementing additional protective measures.

On July 16, 2026, Coca-Cola Company reported a cyberattack that disrupted operations at its Fairlife dairy business. The incident led to an immediate halt in processing activities across the U.S., significantly affecting the supply of dairy products. The specifics of the ransomware attack have not been fully disclosed, but it raises concerns about the vulnerability of food supply chains to cyber threats. This incident serves as a reminder of the ongoing risks businesses face from ransomware, especially in sectors critical to daily life. Companies in similar industries should consider strengthening their cybersecurity measures to protect against potential future attacks.

Enterprises are increasingly integrating AI agents into their systems, which grant these agents access to sensitive customer data, financial records, and internal documents. This practice raises significant security concerns, as these AI systems may operate without adequate oversight, potentially leading to unauthorized access or data leaks. With the growing reliance on AI in business processes, organizations must ensure that these agents are governed properly to prevent misuse. The lack of regulation around AI's interaction with critical systems could expose companies to serious risks, including data breaches and compliance violations. It's essential for businesses to implement strict protocols and monitoring for AI access to safeguard sensitive information.

7-Zip has addressed a significant vulnerability that could allow attackers to execute harmful code by tricking users into opening specially crafted XZ-compressed files. The flaw was identified by researcher Landon Peng and affects versions prior to 26.02. If a user opens a malicious archive, it could lead to remote code execution, posing a risk to their system. Users of 7-Zip should update to version 26.02 immediately to protect themselves from potential exploitation. This incident is a reminder of the importance of keeping software up to date to safeguard against emerging threats.

F5 has patched a serious vulnerability in NGINX, identified as CVE-2026-42533, which has a CVSS score of 9.2, indicating it is highly critical. This flaw allows unauthenticated attackers to exploit a heap buffer overflow by sending specially crafted HTTP requests, potentially leading to server crashes or remote code execution. This vulnerability affects NGINX servers widely used for hosting websites and applications, making it a significant concern for organizations relying on this technology. F5's quick response to release patches is crucial to mitigate the risks associated with this vulnerability, as it could lead to severe disruptions or data breaches if left unaddressed.

Two police chiefs in the UK are calling for the introduction of Cybercrime Risk Orders following a recent prosecution involving Transport for London (TfL). They argue that the TfL case illustrates the growing risks associated with cybercrime and the need for stronger legal tools to combat it. The proposed orders would allow authorities to impose restrictions on individuals deemed to pose a cyber risk, potentially preventing future attacks. This initiative aims to enhance public safety and protect critical infrastructure from cyber threats, highlighting the urgent need for proactive measures in cybersecurity. The push for these orders comes as cyber incidents continue to rise, affecting various sectors across the UK.