Windmill servers are under active attack.

Experts say attackers are exploiting CVE-2026-29059 to read arbitrary server files without logging in. On some systems, the same flaw can lead to superadmin access and code execution.

Full details: https://thehackernews.com/2026/07/hackers-exploit-windmill-flaw-to-read.html

76% of employees now use AI at work. Most of those tools were never reviewed by security.

When approval takes six weeks and a workaround takes six minutes, AI use moves out of sight.

How to make the secure path the faster one: https://thehackernews.com/2026/07/the-fastest-path-to-ai-adoption-runs.html

🛑 One visit to a malicious webpage could have been enough to expose your #WhatsApp Web chats.

CVE-2026-48294 in Adobe Acrobat’s Chrome extension could read messages, contact names, chat previews, and profile data without malware, stolen credentials, or session cookies.

The extension has over 314 million users.

See how HermeticReader worked: https://thehackernews.com/2026/07/adobe-acrobat-extension-flaw-let.html

⚡ AI is pushing code output up 10–50x. Security programs still assume humans can review what humans build.

That model breaks at machine speed.

Learn how to govern AI-built software with secure-by-default architecture.

Save your seat: https://thehacker.news/secure-ai-development

🚨 A flaw in Ubuntu’s snap-confine could turn local user access into root.

CVE-2026-8933 chains FUSE and symlink race conditions to plant malicious udev rules and execute commands as root.

Default Ubuntu #Linux Desktop 24.04, 25.10, and 26.04 installations are affected.

Read how the exploit works: https://thehackernews.com/2026/07/ubuntu-snap-confine-flaw-could-give.html

GitHub is cutting public bug bounty payouts by at least half.

The reset comes as AI floods programs with low-effort reports while helping skilled researchers find real bugs faster.

Top rewards now move to an invite-only VIP tier.

Read the full story: https://thehackernews.com/2026/07/github-cuts-public-bug-bounty-payouts.html

⚠️ Attackers are exploiting a Check Point SmartConsole flaw that can grant full administrative access.

CVE-2026-16232 affects management servers exposed directly to the internet under a specific configuration. Check Point says a small number of customers were targeted.

Read: https://thehackernews.com/2026/07/check-point-patches-exploited.html

🛑 A newly disclosed, 9-year-old #Linux flaw lets unprivileged users overwrite root-owned files and gain persistent root access.

On affected XFS systems, the overwrite survives reboot without changing ownership, permissions, timestamps, or the setuid bit.

Read: https://thehackernews.com/2026/07/nine-year-old-refluxfs-linux-flaw-gives.html

🔥 Google now lets users RECOVER LOCKED ACCOUNTS with a selfie video.

Users save a face clip, then record another when they need to prove the account is theirs. An optional setting can expand how Google uses that data beyond sign-in.

What is stored and how it may be used: https://thehackernews.com/2026/07/google-adds-selfie-video-recovery-for.html

🚨 Attackers turned GitHub-hosted runners into cPanel attack infrastructure.

They planted 583 malicious workflows to target cPanel and WHM servers exposed to CVE-2026-41940, hunting for cloud keys, API tokens, SSH data, and other secrets.

How the campaign worked: https://thehackernews.com/2026/07/attackers-weaponize-github-actions.html

Social engineering is now a margin game.

Convincing lures cost 95% less to produce. Median time to click: 21 seconds.

Doppel’s Josh Bartolomie says defenders should stop chasing lures and make attacks too costly to scale.

Learn how to break the economics: https://thehackernews.com/expert-insights/2026/07/how-to-make-social-engineering.html

🛑 China-nexus JadeProx breached a Vietnamese hospital’s medical imaging server and targeted Malaysia’s foreign ministry with a new Windows loader.

The same operation also hid malware inside a fake Claude installer.

How the campaign worked: https://thehackernews.com/2026/07/china-nexus-jadeprox-uses-new-triback.html

‼️ Chaos Hid Its C2 Inside Chrome.

Instead of connecting directly to its command server, Chaos #ransomware’s msaRAT launches Chrome or Edge in hidden mode and uses the browser to send encrypted commands over WebRTC, making the malicious traffic look like normal browser activity.

Read: https://thehackernews.com/2026/07/chaos-ransomware-uses-msarat-to-route.html

🚨 Researchers say one short message let Claude Cowork escape its Linux VM and access files across the host Mac.

The SharedRoot chain used CVE-2026-46331 to gain guest root, then crossed through Cowork’s read-write host mount.

Read how it worked: https://thehackernews.com/2026/07/claude-cowork-flaw-could-let-ai-agent.html

🚨 Attackers are targeting the datacenters that train, host, and serve AI, not just the AI models themselves.

Lava has released FORGE: The Top 10 Data Center & AI Infrastructure Security Risks: https://thn.news/forge-risk-guide

Built with security leaders and practitioners across neoclouds, HPC, and enterprise security — open, free, and made to evolve.

⚡ Spyware on Phones, Malware in Code, Attacks on Factories

This week’s #ThreatsDay roundup covers 15 security stories spanning mobile surveillance, software supply-chain attacks, AI abuse, and industrial systems.

• PyPI Lockdown
• PLC Attacks
• Fake VPN Malware
• Vibe-Code Bugs
• AI Jailbreaks
• TrickBot DNS
• AI Bug Hunter

...and more. Read: https://thehackernews.com/2026/07/threatsday-android-spyware-plc-attacks.html

Not every dangerous machine identity is stolen. Some are fake from the start.

Fabricated machine identities can blend into NHI sprawl, gain privileges, and evade controls built to catch stolen credentials because no legitimate owner exists to raise the alarm.

See how it works: https://thehackernews.com/2026/07/how-synthetic-identity-fraud-is-coming.html

🛑 No link. No attachment. Just viewing the email.

A Russian state-supported espionage group exploited a Zimbra zero-day for at least 5 months to steal passwords, 2FA recovery codes, organization directories, and 90 days of mail.

Read how ZimReaper worked - https://thehackernews.com/2026/07/russian-espionage-group-exploited.html

🚨 A malicious Notepad++ plugin is turning the legitimate editor into a malware loader.

CERT-UA links the campaign to Russia-aligned UAC-0099. It establishes persistence and deploys MATCHBOIL.V2 for follow-on malware.

Read more: https://thehackernews.com/2026/07/fake-notepad-plugin-delivers.html

🛑 Kimi K3 AI agents found Redis 0-days. Then they built working RCE exploits.

The authenticated chains abuse RESTORE across multiple #Redis releases. Redis has shipped seven security updates, with no exploitation reported in the wild.

Details: https://thehackernews.com/2026/07/kimi-k3-agents-found-redis-zero-days.html