Threat Advisories

On August 4, 2026, a sophisticated software supply chain attack dubbed ChainDrop struck the npm ecosystem through the compromise of a maintainer's GitHub account for the widely used Keyv and Cacheable open-source packages. The resulting self-propagating worm spread to over 2251 versions of 452 unique packages with approximately 2 billion monthly downloads, affecting organisations including Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan.

A critical vulnerability was discovered by N-Able in it's product N-Central, a remote management appliance used for IT administration.

The "wp2shell" exploit chain represents a critical security event targeting the fundamental architecture of the WordPress ecosystem. This is a pre-authentication Remote Code Execution (RCE) vulnerability residing entirely within WordPress Core. It requires no third-party plugins, themes, or authenticated access to execute. A single crafted HTTP request against a default, "stock" installation can result in unauthenticated attacker gaining full system control.

Check Point has disclosed and patched a critical zero-day vulnerability, CVE-2026-16232, affecting its SmartConsole management platform. The flaw is an authentication bypass vulnerability that enables unauthenticated remote attackers to obtain a valid application login token and authenticate with administrator-level privileges under specific conditions. Check Point confirmed that the vulnerability is being actively exploited and has impacted a limited number of customers.

Security researchers have observed increased activity involving ACR Stealer, an information-stealing malware family associated with the Amatera Stealer ecosystem. The activity was particularly prevalent from late April through mid-June 2026 and has successfully compromised enterprise environments.

Ubiquiti has released security updates addressing seven critical vulnerabilities across multiple UniFi products. The flaws could allow attackers with network access to perform remote command execution (RCE), privilege escalation, unauthorised device modifications, and server-side request forgery (SSRF). Several vulnerabilities carry CVSS scores between 9.0 and 10.0, representing a significant risk to organisations using affected UniFi deployments.

Security researchers have identified an ongoing campaign operated by a threat actor known as Lurking Lizard, which distributes trojanized versions of the popular 7-Zip archiving software. Victims who download installers from the malicious domain 7zip[.]com instead of the legitimate 7-zip[.]org unknowingly install malware that converts their systems into residential proxy nodes.

Microsoft has disclosed CVE-2026-50656, a high-severity elevation of privilege vulnerability affecting the Microsoft Malware Protection Engine used by Microsoft Defender. The vulnerability, publicly referred to as "RoguePlanet," can allow a local attacker to obtain SYSTEM-level privileges on affected Windows systems.

Researchers have recently disclosed a large-scale campaign, referred to as “FortiBleed,” involving the compromise and exposure of credentials associated with Fortinet FortiGate firewalls and SSL VPN devices across global environments.

A critical vulnerability (CVE-2026-20253) has been identified in Splunk Enterprise that allows unauthenticated attackers to perform arbitrary file operations and achieve remote code execution (RCE). The flaw stems from missing authentication controls in a PostgreSQL sidecar service endpoint.