Security incidents in July 2026

A Coldcard firmware flaw let thieves recover keys from weak wallet seeds. Every affected model and track now has fixed firmware, but updating cannot protect an old affected seed: create a new seed on fixed firmware and carefully move the funds.

Cisco Secure Firewall Management Center has a built-in login that anyone on the network can use without a password (CVE-2026-20316). It was exploited before a fix existed. Upgrade to 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.

Attackers are using a FortiOS flaw to read private information from previously compromised FortiGate firewalls. Fixes are in 7.4.7 and 7.6.2; older branches require migration. Ask your IT provider to update and investigate earlier intrusion.

Attackers exploited VeloCloud Orchestrator, which manages business networks. Released fixes cover three branches, but Arista has not confirmed complete coverage. Ask your IT provider to update, restrict management access and check for compromise.

Attackers exploited Check Point SmartConsole login to gain administrator access to exposed business security-management servers. Hotfixes exist, but published version boundaries conflict. Ask IT to install the current vendor update and investigate access.

Attackers are exploiting CVE-2026-0770 to run code on Langflow AI-building servers without logging in. Restrict access and check for compromise. CISA links version 1.9.0, but a vendor-confirmed fix could not be verified.

Attackers are exploiting an old DD-WRT router flaw when UPnP is enabled and reachable. The source fix is revision 45724; firmware coverage is unverified. Disable UPnP and ask your router administrator to check its firmware.

Two WordPress Core flaws, chained, let anyone run code on a site without logging in. CISA lists them as exploited. Fixed in WordPress 7.0.2, 6.9.5 and 6.8.6; check your site is on one of those, or ask whoever manages it.

Two FortiSandbox flaws let attackers run commands without signing in. CISA confirms exploitation. Business IT teams should install the applicable fixes, migrate from 4.2 and confirm Cloud remediation with Fortinet.

Attackers are exploiting CVE-2026-46817 in Oracle E-Business Suite’s Payments module. It affects unpatched versions 12.2.3–12.2.15 and allows takeover without logging in. Ask your IT team to apply Oracle’s May 2026 security patches and check for compromise.

Attackers can disable and lock unprotected KNX home and building automation devices. CVE-2023-4346 has no published patched version identified. Ask your installer to check BCU key protection, keep the key safely documented and remove direct internet access.

An exploited flaw affects Microsoft's AD FS business sign-in infrastructure. Ask IT to install October 2026 or later Windows security updates on every AD FS server and verify that unsafe permissions were repaired.

Attackers are exploiting CVE-2026-58644 to run code on organisations' SharePoint servers. Fixes exist for all three affected editions. Ask your IT provider to install current security updates and check the servers for signs of intrusion.

Attackers exploited CVE-2026-50522 to run code on organisations’ own SharePoint servers and steal server keys. Fixes cover all three affected editions. Ask IT to update, check for compromise and rotate exposed credentials and machine keys.

Attackers are exploiting CVE-2026-56164 in self-hosted Microsoft SharePoint Server. Fixes cover 2016, 2019 and Subscription Edition. Ask IT to patch, check for compromise and migrate unsupported 2016/2019 installations.

SonicWall SMA1000 remote-access appliances (SMA6210, 7210, 8200v) had two flaws used together, from at least 22 June, to take full control. Fixes exist (12.4.3-03453, 12.5.0-02835). Patch, then check for compromise and reset credentials and MFA codes.

Attackers are using an old Cisco IOS 12.4 web administration flaw to run router commands. The software is unsupported and no fixed release is confirmed. Ask your network provider to identify and replace affected equipment.

Attackers used iCagenda's event attachments to upload and run malicious files on Joomla websites. The flaw was fixed in June. Website owners should install the current release and check for earlier compromise; visitors have no software to update.

Attackers used CVE-2026-56291 to take over Joomla websites running Balbooa Forms 2.4.0 or earlier. Version 2.4.1 fixed this flaw; update to the current 2.4.4.0 and have previously exposed sites checked for compromise.

Attackers used a Page Builder CK flaw to upload and run code on Joomla websites without logging in. Fixes are available. Ask your website manager to install the latest compatible release and check the whole site for backdoors.

Attackers are exploiting a Langflow flaw that lets a signed-in user run someone else’s AI workflows, potentially exposing sensitive data and consuming resources. Organisations running Langflow should update to 1.9.1 or later and investigate unauthorised use.

Attackers are exploiting CVE-2026-48282 in Adobe ColdFusion website servers. Businesses should install the latest cumulative update: the first fixes were 2025 Update 10 and 2023 Update 21.

Attackers used SP Page Builder's custom icon upload to run code on Joomla websites without signing in. Version 6.6.2 fixes this flaw. Ask your website maintainer to install the current release and check for planted files and administrator accounts.

Attackers, including ransomware gangs, are using CVE-2026-45659 in on-premises SharePoint Server (2016, 2019, Subscription Edition). Microsoft fixed it in May 2026. If you run SharePoint yourself, confirm the May 2026 updates are installed.

Firefox patched two critical flaws with public exploit code on 14 July; ESR and Thunderbird fixes followed on 21 July. Update affected browsers and Thunderbird. Mozilla reported no known attacks, and no later confirmation was found.

An attack disrupted eight CEVA warehouses and exposed retailers’ customer data. Valve warned European Steam hardware buyers, though a later customer-shared email cleared its recipient. Check your retailer’s notice and verify delivery requests directly.

RingCentral customer contact details were stolen and published after a social engineering attack. Have I Been Pwned identified 1.6 million email addresses. Check your exposure and verify unexpected messages or calls through a trusted contact.

Malware disrupted AnMed care across South Carolina and northeast Georgia, and criminals copied files containing possible patient information. AnMed says its network is restored; the data review continues. Watch for notices and verify unexpected messages.

Attackers targeted equipment at more than 30 Minnesota water systems on 26–27 July. Some utilities used manual operations. Follow your local utility’s notices; no statewide recovery confirmation was found by 3 November.

Attackers socially engineered a Triple-A engineer and drained the Singapore payment firm's own treasury wallets on 24-25 July 2026. Client funds were not affected. Triple-A has not stated the loss; outside estimates are about US$11.8M. No recovery reported.

The Verus-Ethereum bridge lost about US$7.54M on 23 July, 66 days after a US$11.58M theft through the same flaw. No fix, recovery or Verus statement was found. Don't move funds across this bridge, and ignore anyone offering reimbursement.

Origin Energy’s breach affected approximately 900,000 current and former customers, including some bank, identity and concession numbers. Read your individual notification, use the offered monitoring and independently verify unexpected messages.

Wanchain's Cardano–BNB bridge lost about 515 million NIGHT tokens (US$9–13 million) on 20 July 2026 through a signature flaw. The bridge is offline. No return of funds is confirmed. Don't use this bridge; wait for Wanchain's own announcements.

Ransomware stopped Fairlife’s US dairy production and stole company data. Nearly all production was back by 28 July. Coca-Cola said product safety was unaffected. Families have no update to install or product-safety action to take over this incident.

Attackers stole 23.75 million USDC from Ostium’s liquidity vault; trader collateral was unaffected. Trading resumed, but compensation remains incomplete. Affected vault holders should check the official recovery portal and read its release terms.

An attack on Romania’s land registry stopped property transactions. e-Terra restarted on 11–12 August, but other platforms awaited restoration in the latest update found. Former ePay users should change their password, including wherever it was reused.

Bonzo Lend users face losses after a false price feed enabled US$9.05 million in borrowing. The verifier was fixed, but recovery remains incomplete. Claims are targeted for the week of 9 November; wait for official instructions.

Attackers stole Lidl online shop customers’ personal details in Germany, Belgium and the Netherlands through an IT provider. Lidl says passwords and payment details were unaffected. Watch for convincing fake Lidl messages and verify them independently.

AFX Trade, an Arbitrum perpetuals exchange, lost 24.15M USDC on 22 July after attackers compromised bridge signing keys via its development environment. No recovery reported. AFX launched a goodwill programme for users. Use only AFX's official channels.

An attacker stole about US$6.04 million from two Summer.fi Ethereum USDC vaults. Remaining funds are claimable through Merkl; full reimbursement is unconfirmed. Other vaults reopened for withdrawals, while new deposits remain blocked.

An attacker bought about 1% of BONK supply, passed proposal BIP #76 and drained roughly US$20M of BONK from BonkDAO's treasury on 6 July 2026. No recovery or charges found. Nothing to patch; BONK holders should expect no refund and ignore "recovery" offers.

Pegasus infected former MEP Stelios Kouloglou’s iPhone during Parliament’s spyware inquiry in 2022–23. He filed a criminal complaint in September 2026. Keep iPhones updated; anyone receiving an Apple spyware warning should seek expert help.

Attackers copied patient information from healthcare software provider Unlimited Technology Systems, affecting about 3.8 million people. If notified, check your letter’s identity-monitoring deadline, review your credit reports and consider credit freezes.

Malicious releases of four AsyncAPI npm packages (generator, helpers, components, specs) on 14 July 2026 installed malware that steals browser, cloud and wallet data. Releases were removed. If you installed them, delete the dropped file and rotate credentials.

ModHeader, a header-editing extension with about 1.6 million Chrome and Edge installs, held dormant code to collect visited domains. Google and Microsoft removed it; no upload was seen. If you have it, uninstall it and check browser sync.

Fake Claude Desktop search adverts infected Windows PCs with password-stealing malware. Anthropic removed the lure, but related incidents continued into August. Download Claude only from its official page; seek help if you ran the fake installer.

Cisco Talos found fake installers for Zoom, Webex, FACEIT, MobaXterm and DBeaver installing Starland malware on Windows PCs, which steals passwords and crypto wallets. Download only from official sites and don't paste commands you don't understand. No arrests found.

RedWing tricks Android users into installing spyware and granting powerful permissions, exposing messages, banking logins and phone control. Use official app stores; if installed, remove it and secure important accounts from another device.