# Threat Intel Brief — July 22, 2026

TL;DR

  • Critical vulnerabilities in Microsoft SharePoint (CVE-2026-50522) and WordPress Core (CVE-2026-63030, CVE-2026-60137) are under active exploitation, enabling remote code execution and persistent webshell deployment.
  • Qilin ransomware operators are exploiting a Palo Alto Networks PAN-OS authentication bypass (CVE-2026-0257) to breach enterprise networks.
  • FakeGit campaign distributed malware through 7,600+ malicious GitHub repositories, accumulating over 14 million downloads targeting software developers.
  • Russian intelligence services are systematically compromising security cameras across Europe and Ukraine to monitor military logistics and weapons shipments supporting Kyiv.
  • AI infrastructure faces emerging threats from autonomous agents and specialized ransomware targeting training datasets and model repositories.

Critical Threats

Microsoft SharePoint RCE (CVE-2026-50522)

What happened: A critical remote code execution vulnerability in Microsoft SharePoint Server (CVSS 9.8) is being actively exploited following public proof-of-concept disclosure. Attackers are leveraging the deserialization flaw to steal machine keys, enabling persistent backdoor access that survives patching.

Impact: Unauthenticated attackers can achieve full server compromise on internet-facing SharePoint instances. The theft of machine keys allows adversaries to maintain access even after security updates are applied, requiring organizations to regenerate cryptographic keys and conduct thorough incident response beyond standard patching procedures.

Recommendations: Apply Microsoft's July 2026 patches immediately. Regenerate all SharePoint machine keys post-patching. Hunt for web shells, unauthorized scheduled tasks, and anomalous authentication patterns in SharePoint logs. Isolate suspected compromised servers and initiate incident response protocols. Review IIS logs for suspicious deserialization attempts since PoC publication.

WordPress wp2shell Vulnerabilities (CVE-2026-63030, CVE-2026-60137)

What happened: Two critical WordPress Core vulnerabilities collectively known as "wp2shell" enable unauthenticated remote code execution when chained together. Active exploitation began early Saturday morning UTC, with mass scanning campaigns underway driven by public exploit availability.

Impact: All unpatched WordPress installations face immediate compromise risk. Attackers are deploying persistent webshells and installing malicious plugins, enabling data theft, site defacement, malware distribution, and lateral movement. The widespread deployment of WordPress makes this a high-volume threat affecting organizations globally.

Recommendations: Update WordPress Core to the latest version immediately across all installations. Scan for webshells in wp-content/uploads, wp-includes, and theme directories using file integrity monitoring tools. Review installed plugins and themes for unauthorized additions. Deploy WAF rules targeting wp2shell exploitation patterns. Monitor POST requests to wp-admin endpoints for suspicious activity.

Qilin Ransomware Exploiting PAN-OS (CVE-2026-0257)

What happened: The Qilin ransomware gang is actively exploiting a high-severity authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect portal and gateway components. Arctic Wolf Labs investigated multiple intrusions in June 2026 leveraging this now-patched flaw for initial access.

Impact: Organizations with unpatched PAN-OS deployments face ransomware compromise through their perimeter security infrastructure. The authentication bypass enables attackers to gain unauthorized network access without credentials, followed by data exfiltration and encryption for double-extortion demands.

Recommendations: Apply Palo Alto Networks patches for CVE-2026-0257 immediately to all PAN-OS instances, prioritizing internet-facing components. Hunt for authentication anomalies and unauthorized portal access in June 2026 timeframe logs. Implement network segmentation to limit lateral movement from VPN gateways. Monitor for ransomware indicators including mass file encryption and shadow copy deletion. Maintain offline backups with regular restoration testing.

SonicWall SMA1000 Zero-Day Exploitation

What happened: Two zero-day vulnerabilities in SonicWall SMA1000 VPN appliances were exploited in active attacks to deploy custom malware before patches became available.

Impact: Enterprise VPN infrastructure compromise enables persistent malware deployment, potential traffic interception, and network infiltration through trusted security devices. Organizations using SMA1000 appliances face immediate breach risk.

Recommendations: Identify all SMA1000 appliances and apply available SonicWall patches immediately. Review appliance logs for suspicious authentication, configuration changes, or unexpected process execution. Isolate management interfaces to trusted networks only. Monitor for unusual outbound connections from appliances. Prepare to rebuild compromised devices from known-good configurations if breach is suspected.

Threat Actor Activity

FakeGit Supply Chain Campaign

A large-scale supply chain attack leveraged approximately 7,600 malicious GitHub repositories to distribute SmartLoader and StealC malware, accumulating over 14 million downloads. The campaign specifically targeted software developers by impersonating AI tools and Model Context Protocol servers with convincing documentation and lookalike developer profiles. This represents a significant evolution in repository poisoning attacks, exploiting developer trust in open-source platforms at unprecedented scale.

Organizations should implement repository verification processes, deploy endpoint detection for SmartLoader indicators, enforce code signing requirements, and conduct developer security awareness training focused on supply chain risks.

Kratos PhaaS Platform Dismantled

German and U.S. authorities dismantled the Kratos phishing-as-a-service platform and arrested its developer in Indonesia. The coordinated international operation targeted the central infrastructure enabling global phishing campaigns. While the takedown may temporarily disrupt operations, customers are likely to migrate to alternative PhaaS platforms within weeks.

Anubis Ransomware Targets Fairlife

The Anubis ransomware gang claimed responsibility for attacking Coca-Cola's Fairlife dairy subsidiary, threatening to publish stolen corporate data unless ransom demands are met. The incident highlights continued targeting of food and beverage supply chains by financially motivated ransomware operators employing double-extortion tactics.

JadePuffer AI Infrastructure Ransomware

JadePuffer, characterized as an autonomous AI agent, has been upgraded with EncForge ransomware specifically designed to encrypt AI assets including training datasets, vector databases, and model checkpoints. This represents a novel threat targeting the growing AI infrastructure sector with specialized capabilities beyond traditional ransomware.

HollowGraph Microsoft 365 C2

A newly discovered espionage implant named HollowGraph uses hijacked Microsoft 365 calendars as a covert command-and-control channel. The malware hides operator instructions and exfiltrated data in calendar events dated to 2050, leveraging legitimate Microsoft Graph API traffic to evade detection. Organizations should monitor for anomalous calendar operations and unusual Graph API access patterns.

Geopolitical Context

Russian Intelligence Camera Compromise

Russian intelligence services are systematically compromising internet-connected security cameras across Europe and Ukraine to conduct surveillance of military logistics, weapons shipments to Kyiv, and Ukrainian troop locations, according to a July 10 advisory from the Netherlands' AIVD and MIVD intelligence agencies. The campaign demonstrates convergence of cyber operations with conventional military intelligence requirements, targeting NATO support infrastructure for Ukraine.

The activity has direct implications for European security and Alliance cohesion, exposing vulnerabilities in logistics chains supporting Ukraine's defense. NATO members should accelerate efforts to secure IoT devices near critical infrastructure and military facilities, implement network segmentation requirements, and enhance operational security for military aid coordination.

AI-Assisted Phishing in Mexico

Rapid7 discovered an exposed malware delivery server containing an AI-assisted phishing toolkit actively targeting Windows users in Mexico through fake government ID-lookup websites. The toolkit demonstrates the commoditization of AI-enhanced social engineering capabilities, lowering technical barriers for sophisticated phishing campaigns. The incident underscores persistent challenges in securing digital government services across Latin America.

Russian-Speaking Botnet Operations

A Russian-speaking threat actor used Google's Gemini CLI to control a botnet of eight dental clinic PCs, leveraging AI for password cracking and malicious operations. The incident illustrates the rapid integration of generative AI tools into cybercriminal tradecraft and highlights vulnerabilities in under-resourced healthcare facilities.

Recommended Actions

Immediate (0-24 hours)

  • Patch critical vulnerabilities: Deploy updates for SharePoint (CVE-2026-50522), WordPress (CVE-2026-63030, CVE-2026-60137), PAN-OS (CVE-2026-0257), and SonicWall SMA1000 across all instances.
  • Hunt for compromise indicators: Scan for webshells, unauthorized SharePoint machine key usage, and PAN-OS authentication anomalies in June-July 2026 timeframe.
  • Isolate suspected breaches: Quarantine SharePoint servers and VPN appliances showing signs of exploitation pending investigation.
  • Regenerate SharePoint keys: Replace machine keys on all SharePoint servers after patching to invalidate stolen credentials.

Near-term (24-72 hours)

  • Audit GitHub dependencies: Review all repositories downloaded in recent months for FakeGit campaign indicators; validate repository authenticity before integration.
  • Deploy detection rules: Implement monitoring for SmartLoader, HollowGraph, and wp2shell exploitation patterns in EDR and SIEM platforms.
  • Secure IoT devices: Inventory internet-connected cameras near sensitive facilities; implement network segmentation and restrict management access.
  • Review Microsoft 365 activity: Audit calendar operations and Graph API usage for anomalous patterns, particularly events dated far in the future.

This week

  • Update 7-Zip: Deploy version 26.02 or later to address heap overflow vulnerability (CVE-2026-14266) in XZ archive handling.
  • Patch Zimbra: Upgrade to version 10.1.20 to address critical SNMP command injection and XSS vulnerabilities; disable SNMP notifications if immediate patching is not feasible.
  • Assess AI tool risks: Inventory AI development tools (Cursor, Gemini CLI, AWS Kiro) and evaluate sandbox escape vulnerabilities; apply available patches.
  • Strengthen developer security: Conduct training on supply chain threats, repository verification, and risks of AI-assisted IDEs processing untrusted content.
  • Implement backup validation: Test restoration procedures for critical systems, particularly AI training datasets and model repositories.

Watch List

  • Windows LegacyHive zero-day: Monitor for official Microsoft CVE assignment and patch release; evaluate unofficial patches if immediate mitigation is required in high-risk environments.
  • Apple Hide My Email: Verify all Apple devices are updated to versions released after July 3, 2026; notify users of potential email address exposure in mail logs.
  • Estée Lauder breach: Monitor for additional details on Oracle E-Business Suite exploitation; assess exposure if using similar HR systems.
  • Ostium cryptocurrency theft: Organizations in DeFi and cryptocurrency sectors should review off-chain infrastructure security following the $23.75 million theft.
  • Hugging Face breach: AI organizations should assess exposure if using Hugging Face repositories; monitor for disclosure of compromised credentials or datasets.
  • SleeperGem RubyGems: Audit Ruby projects for malicious dependencies (git_credential_manager, Dendreo); implement dependency scanning in CI/CD pipelines.

Sources

  • BleepingComputer: Multiple articles on SharePoint RCE, WordPress wp2shell, Qilin ransomware, SonicWall zero-days, Kratos PhaaS takedown, and AI agent threats
  • The Hacker News: Coverage of CVE-2026-50522 exploitation, PAN-OS vulnerability, Zimbra patches, FakeGit campaign, HollowGraph malware, Russian intelligence camera compromise, 7-Zip vulnerability (CVE-2026-14266), and SleeperGem supply chain attack
  • Arctic Wolf Labs: Qilin ransomware exploitation of PAN-OS authentication bypass
  • Rapid7: AI-assisted phishing toolkit discovery
  • Netherlands AIVD/MIVD: Advisory on Russian intelligence camera compromise (July 10, 2026)
  • Group-IB: HollowGraph malware analysis

---

*This report synthesizes open-source threat intelligence as of July 22, 2026. Organizations should validate findings against their specific environments and consult vendor advisories for detailed remediation guidance.*