⚡ Argo CD repo-server has an UNPATCHED code execution flaw (no CVE).

Experts say unauthenticated gRPC access can execute commands on the service.

With default Helm installs, a single compromised pod can reach it if network policies are off. That path extends to Redis cache poisoning and cluster takeover.

Repo-server attack flow explained: https://thehackernews.com/2026/07/unpatched-argo-cd-repo-server-flaw.html

⚠️ CISA added CVE-2026-45659 to KEV following active exploitation.

The SharePoint Server RCE was patched in May 2026.

Microsoft says an authenticated Site Member can execute code remotely — no admin rights required.

FCEB agencies have until July 4 to patch.

Details: https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html

🛑 Fake GitHub PoC repos are being used to infect vulnerability researchers with ChocoPoC RAT.

The PoC may look clean. The #malware hides in Python dependencies like frint and skytext, then steals saved passwords, cookies, browser data, and files.

How the trap works: https://thehackernews.com/2026/07/new-chocopoc-rat-targets-vulnerability.html

🚨 FortiBleed has already led to at least 12 #ransomware deployments.

Experts say one operator tied to the campaign was active in INC Ransom and Lynx negotiation panels.

The trail includes 354 completed FortiGate attack chains.

Details here: https://thehackernews.com/2026/07/fortibleed-credential-theft-linked-to.html

🔥 An AI agent turned Langflow RCE into automated database extortion.

CVE-2025-3248 exploited to steal secrets, move laterally, hijack Nacos, encrypt 1,342 configuration items, and drop database schemas.

Inside the attack chain: https://thehackernews.com/2026/07/ai-agent-exploits-langflow-rce-to.html

🛑 AI agents don’t trigger leaver events.

No HR record.
No manager.
No offboarding date.

IGA tools may only see a service account while API access, OAuth grants, and stale credentials drift outside the human identity lifecycle.

Where the model breaks: https://thehackernews.com/2026/07/identity-lifecycle-management.html

ToddyCat’s Umbrij can turn an active Gmail session into Google API access.

Experts say it launches Chrome or Edge in headless mode, grabs an OAuth authorization code, and lets operators exchange it for an access token.

How the STRD attack chain works: https://thehackernews.com/2026/07/toddycat-linked-umbrij-malware-abuses.html

#ThreatsDay Bulletin is live, and this week’s threats were quiet, weird, and too easy to miss.

🤖 Stolen AI compute
🔨 BlueHammer ransomware
🍎 Apple email flaw
🚨 Fake INTERPOL ransomware
📋 ClickFix defenses
🐀 BeepRAT espionage
🧬 Millennium RAT
🎣 UNC1151 phishing
🔎 AI search hijack
👥 Teams bot controls
🧠 GPT-5.6 Sol
🕵️ UNC5792 reward
🧩 Prompt injection
🕶️ Anthropic tracking
📱 Device-aware phishing
🏛️ Amazon FTC fine
🏗️ Claude sandbox root

Read the full roundup: https://thehackernews.com/2026/07/threatsday-ai-compute-hijacking-apple.html

🚨 Update - Citrix CVE-2026-8451 is now under active exploitation, less than 24 hours after disclosure.

A Frankfurt IP hit sensors for 5 hours, delivering the watchTowr exploit only after a 200 OK response and skipping 404s.

Learn the malformed SAML exploit path works: https://thehackernews.com/2026/07/citrix-patches-six-netscaler-flaws.html

🛑 Ransomware crews are stacking three ugly paths into enterprise networks.

🔸 Anubis: Citrix Bleed 2
🔸 The Gentlemen: Go backdoor + BYOVD
🔸 VECT/TeamPCP: supply-chain credential theft

How the attack paths connect: https://thehackernews.com/2026/07/ransomware-groups-turn-to-citrix-bleed.html

🔥 Google disrupted #NetNut, a proxy network spanning at least 2 million home devices.

In one June week, GTIG saw 316 threat clusters using suspected NetNut exit nodes to hide location and guess passwords.

The simple risk: your home IP becomes someone else’s relay.

Learn more: https://thehackernews.com/2026/07/google-disrupts-netnut-residential.html