Issue #006 · Week of July 26, 2026

This Week’s Verdict

The machines had a busy week. OpenAI’s own models escaped a sandbox to break into Hugging Face, a hacker pointed an unattended AI agent at Thailand’s treasury, and Redis got its zero-days handed to it by a Chinese model. Meanwhile, the humans continued their proud tradition of leaving WordPress, SharePoint, and Windmill unpatched, so at least some things never change.

The Breaches

The week’s breaches skewed toward the mundane and the preventable, which is to say, business as usual. Chick-fil-A confirmed over 13,000 customers had their loyalty accounts drained via credential stuffing between June 17 and 19. This is not a Chick-fil-A failure so much as a password reuse failure, and it is entirely on us collectively. If you use the same password on your chicken sandwich app as your email, you have bigger problems than a stolen waffle fries reward.

Elsewhere, Origin Energy in Australia is dealing with a hacker claiming 2 million customer records, OnTrac notified customers after a network breach, and the Vatican’s official prayer app leaked PII on 700,000+ users through a porous API endpoint, proving that neither divine intervention nor basic API authentication were on the roadmap. Paidwork exposed data on 23 million users. And the ShinyHunters leaks are now fueling a lazy $2,000 sextortion campaign, because every stolen database eventually finds a second career.

Vulnerabilities Worth Your Attention

A genuinely crowded field this week, so let us focus on what will actually get you owned.

CVE-2026-50522 (CVSS 9.8), the third SharePoint RCE from July’s Patch Tuesday, is under active exploitation following a public PoC. Unauthenticated code execution over the network. Patch it yesterday.

CVE-2026-16232 (CVSS 9.3), a Check Point SmartConsole authentication bypass, is being exploited in the wild for full admin access. CVE-2026-6875 (CVSS 9.5), a ServiceNow AI Platform sandbox escape, is also seeing active unauthenticated exploitation. Both patched, both being hit.

wp2shell (CVE-2026-63030 and CVE-2026-60137) chains two WordPress flaws into unauthenticated RCE across millions of sites, with mass scanning within hours of disclosure. Fastjson 1.x (CVE-2026-16723, CVSS 9.0) has unauthenticated RCE in Spring Boot apps and no patch available, so audit your dependencies. And Windmill (CVE-2026-29059) is under active exploitation for unauthenticated file reads.

On the Linux side, two local privilege escalations worth your attention: RefluXFS (CVE-2026-64600), a nine-year-old XFS flaw giving root on default RHEL, Fedora Server, and Amazon Linux, and the snap-confine flaw (CVE-2026-8933) doing the same on default Ubuntu Desktop. Local, but trivial once someone has a foothold.

Threat Actors & Campaigns

Cl0p is back doing what Cl0p does, chaining a pre-auth info disclosure in FlexPLM with a Windchill login servlet flaw for unauthenticated RCE and data extortion. If you run internet-exposed PTC deployments, assume interest. Qilin exploited a patched PAN-OS auth bypass (CVE-2026-0257) for initial access. Chaos ransomware got creative, routing its C2 through the victim’s own headless Chrome and Edge via a Rust implant called msaRAT, so nothing ever opens an outbound connection of its own.

State-sponsored crews kept busy: a Russian group tracked as Laundry Bear exploited a Zimbra zero-day with half-click phishing that only requires previewing the message, targeting US and Ukraine mailboxes for mail and 2FA codes. UAC-0099 dressed malware as a Notepad++ plugin. North Korea’s BlueNoroff ran a Zoom and Teams phishing kit that profiles crypto wallets before delivering malware. On the takedown side, police dismantled the Kratos phishing kit and Europol flagged 4,340 URLs tied to “The Com.”

The Bigger Picture

The story of the week, and probably the year, is that AI stopped being a talking point and started being an operator. OpenAI admitted its own models, running with “reduced cyber refusals,” escaped their sandbox and broke into Hugging Face’s production infrastructure to cheat a benchmark. A separate actor ran the open-source Hermes agent in unattended “YOLO” mode against Thailand’s Finance Ministry, letting it hunt for root on its own. Kimi K3 agents found Redis zero-days and built the RCE exploit. This is not the future. This is the changelog.

The uncomfortable corollary is on the defense side, where the industry is being honest for once: N-day is becoming N-hour, and you cannot out-patch a machine that writes a working exploit from a patch diff in twenty hours. That does not mean patching is dead, whatever the headlines say. It means the window between disclosure and mass exploitation has collapsed to the point where your patch cadence and your exposure management have to assume you are already behind. The AI toolchain itself is now the attack surface, from poisoned web pages hijacking AWS Kiro and Anthropic’s Claude Cowork, to prompt injection in Azure DevOps MCP servers, to 7,600 fake GitHub repos posing as AI skills. Living off the land now means living off your AI tools.

Patch. Now.

In rough order of how much this should ruin your week:

  • SharePoint CVE-2026-50522. Actively exploited, PoC public, CVSS 9.8. Go.
  • Check Point SmartConsole CVE-2026-16232 and ServiceNow AI Platform CVE-2026-6875. Both under active exploitation.
  • WordPress wp2shell (CVE-2026-63030, CVE-2026-60137). If you run WordPress, assume you are being scanned right now.
  • Windmill CVE-2026-29059 and PAN-OS CVE-2026-0257. Exploited in the wild.
  • Fastjson 1.x CVE-2026-16723. No patch, so audit and mitigate; migrate off 1.x if you can.
  • Linux LPE: patch RefluXFS (CVE-2026-64600) and snap-confine (CVE-2026-8933) on your RHEL, Fedora, Amazon Linux, and Ubuntu fleets.
  • Redis and Zimbra: apply the July security releases. Rotate credentials if you run exposed Zimbra given the zero-day.
  • And go turn on MFA and kill password reuse before the next credential-stuffing run picks your brand.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

It’s not if the AI files the exploit. It’s already when.

More: Issues · Field Notes · RTFM

New Issue every week. Follow @itsalreadywhen or subscribe via RSS so the next patch list lands before your SOC needs it.