Threat Intelligence Bulletin: July 22, 2026

Ivanti CSO Daniel Spicer says frontier models have shown surprising effectiveness in early stages; but cost and human-in-the-loop viability remain open question… Read more

When combined with another exploit, the "PromptFiction" vulnerability, which has been fixed, could have enabled an end-to-end attack on a targeted sys… Read more

Simple age-old bugs give bad actors access to developers’ secrets and source code-rich environments. Read more

Ukraine’s computer emergency response team, CERT-UA, has warned that the Kremlin-backed Sandworm hacking group is leveraging fake CAPTCHA checks on compromised … Read more

A cloud intrusion that ended with the deployment of cryptomining malware has exposed a bigger risk for enterprises: AI gateways that conc… Read more

GitHub continues to be a scintillating target for attackers because it sits in the middle of the software supply chain and gives threat a… Read more

A prompt injection attack can trick GitHub’s preview Agentic Workflows into retrieving content from private repositories and publishing i… Read more

Cybercriminals are exploiting India’s tax filing season with a new malware campaign that refuses to put all its eggs in one basket. Re… Read more

A single invisible comment in an Azure DevOps pull request can turn a reviewer’s own AI coding agent against them, driving it into projects the attacker has no … Read more

Apple has moved to address a security flaw in its Hide My Email service that enabled users’ real email addresses to be unmasked, effectively undermining the fea… Read more

A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per watchTowr. The vu… Read more

More than 20 Brazilian government websites were hijacked and turned into malware delivery channels in an active PhantomEnigma campaign uncovered by ANY.RUN, a l… Read more

F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HT… Read more

Mozilla has released updates to address two critical flaws in Firefox for which it warned that exploit code has been published. The vulnerabilities are listed … Read more

Any other browser extension that can run a script on claude.ai can still trigger Claude for Chrome tasks aimed at your Gmail, your latest Google Doc and its com… Read more

Cybersecurity researchers have flagged a new macOS information stealer called CrashStealer that’s capable of harvesting sensitive data from compromised systems…. Read more

OpenAI has never been as open as its name suggests and is becoming even less so. The free-spending AI giant recently revised the multi-agent orchestration in i… Read more

IBM says customers spooked by soaring demand for AI infrastructure raided their mainframe budgets to stockpile servers, storage, and memory instead, knocking B… Read more

Notice more spam getting through that corporate email filter lately? Attackers are using a technique known as "text salting," which hides benign-looking words … Read more