Issue #005 · Week of July 19, 2026

This Week’s Verdict

Microsoft patched a record 622 CVEs and openly credited AI for the flood, which is the industry equivalent of building a bigger firehose and then admitting you also built the fire. Meanwhile a Russian tourist may or may not be a REvil operator, a robot vacuum can hand over your Wi-Fi password, and the single most effective attack technique of the week was convincing people to paste a command into a box and press Enter. Nothing new under the sun, just more of it, faster.

The Breaches

The theme this week is food and consultancies, which is not a sentence I expected to write. Coca-Cola suspended Fairlife dairy production across the US after a ransomware attack, and Japan’s frozen food giant Nichirei pulled its systems offline on July 13. Ransomware crews have figured out that hitting production lines gets a faster payout than hitting spreadsheets, and empty shelves make excellent leverage.

On the professional-services side, Ernst & Young disclosed a breach traced to a compromised third-party support ticket system, and Abbott Laboratories is juggling two separate incidents at once, including unauthorized access to legacy Exact Sciences systems in its cancer diagnostics business. Legacy plus third-party is the breach recipe that never goes out of style.

The one worth reading closely is CISA’s own GitHub leak, dissected by Krebs. A contractor left dozens of internal credentials, including AWS GovCloud keys, in a public repo for nearly six months. The agency that tells everyone else to lock the door left it open, and only found out because a journalist told them. Humbling, and instructive: the postmortem is the most useful thing CISA published this week.

Also notable: two Scattered Spider members got five and a half years each for the 2024 TfL hack, a reminder that this cohort is young, sloppy, and increasingly caught.

Vulnerabilities Worth Your Attention

Start with the ones being exploited right now. SonicWall SMA 1000 appliances are under active attack via two zero-days, CVE-2026-15409 (SSRF, CVSS 10.0) and a command-execution partner, chained to root by Inc ransomware and tracked by Volexity as UTA0533. If you run these appliances, assume compromise and investigate, do not just patch.

Microsoft SharePoint gets another one: CVE-2026-58644 (CVSS 9.8), a deserialization RCE already in CISA’s KEV catalog with a same-week federal deadline. CISA also ordered agencies to patch two actively exploited Fortinet FortiSandbox flaws by the weekend.

Then the record-setting Patch Tuesday: 622 CVEs, three zero-days, two under active attack. Grab the exploited ones first and let the other 619 wait their turn. Hours later, a researcher dropped LegacyHive, a Windows User Profile Service privilege-escalation PoC that works on fully patched systems, because of course they did.

The quieter ones that matter: 7-Zip (RCE via malicious archives, update to 26.02), the wp2shell WordPress Core RCE (unauthenticated code execution on a bare install, public PoC available, patch immediately), Zoom for Windows (CVE-2026-53412, CVSS 9.8, account takeover), and SAP NetWeaver ABAP (CVE-2026-44747, CVSS 9.9). And HollowByte, an OpenSSL DoS that lets an eleven-byte request pin up to 131 KB of memory that never comes back until the process restarts. OpenSSL shipped the fix in June with no CVE and no changelog note, which is its own small scandal.

Special mention to the 11 Microsoft-signed UEFI shims that stayed trusted for years, quietly reopening the Secure Boot bypass door everyone assumed was shut.

Threat Actors & Campaigns

ClickFix owned the week. Russia’s UAC-0145 (a Sandworm sub-cluster) used ClickFix CAPTCHAs against Ukrainian targets; ACR Stealer rode ClickFix lures into enterprise Microsoft 365 and OneDrive, prompting a Microsoft warning; and new families TELEPUZ and the macOS ClickLock (which kills your apps on a loop until you type your password) piled on. The technique rents at scale, dodges EDR, and needs no exploit. It just needs you.

Elsewhere: China-linked Daxin resurfaced in a Taiwanese manufacturer after four years dark, alongside a new pre-login backdoor called Stupig. North Korea’s Contagious Interview crew hid OtterCookie-aligned payloads in SVG files inside fake coding tests. ShinyHunters-style actors spent a year walking into Salesforce environments through OAuth trust rather than any flaw. And the supply chain kept bleeding: seven malicious Vite npm packages (ViteVenom), compromised @asyncapi packages, and 148 fake student-proxy packages that turned browsers into a DDoS botnet.

The Bigger Picture

Two threads tie the week together, and both are about trust rather than exploits.

The first is that the human paste-box is the perimeter now. ClickFix, ACR Stealer, ClickLock, and the fake-coding-test crowd all skip the vulnerability entirely and ask the user to do the work. No CVE, no patch, no EDR alert worth the name. When your most effective attack requires zero exploits, your most effective defense is not another appliance.

The second is that AI is now feeding both sides of the vulnerability pipeline. Microsoft explicitly blamed AI for tripling its CVE count, and Krebs noted the same. More findings is not the same as more safety when defenders still have to triage by hand. Meanwhile the agentic-AI attack surface is filling in fast: the Cursor IDE auto-executing a rogue git.exe from a cloned repo, Grok Build quietly uploading entire Git repositories to xAI storage, the Claude for Chrome extension flaws letting rogue extensions drive your Gmail, and data-injection tricks that make agents misclick. We are wiring these tools into everything before we have agreed on what they are allowed to touch. That bill comes due later, and it will not be small.

Patch. Now.

  • SonicWall SMA 1000: patch CVE-2026-15409 and its partner, then hunt for compromise. Under active exploitation.
  • SharePoint: apply the fix for CVE-2026-58644 (in KEV, federal deadline already here).
  • Fortinet FortiSandbox: patch the two exploited flaws CISA flagged, immediately.
  • Windows: prioritize the two actively exploited zero-days from July Patch Tuesday before the other 620.
  • WordPress Core: patch the wp2shell RCE now; public exploit is live and a bare install is vulnerable.
  • 7-Zip (26.02), Zoom for Windows (CVE-2026-53412), SAP NetWeaver ABAP (CVE-2026-44747): all critical, all worth this week.
  • OpenSSL: confirm you picked up June’s HollowByte fix, since it shipped without a CVE.
  • Everyone: teach your people that nothing legitimate ever asks them to paste a command into a Run box. That one lesson beats half this list.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

It’s not if, it’s already when.

More: Issues · Field Notes · RTFM

New Issue every week. Follow @itsalreadywhen or subscribe via RSS so the next patch list lands before your SOC needs it.