Cyber Security News

Hacking Editorial Brief — July 20, 2026

Active Exploitation Underway Against Gitea, WordPress, and Windows Systems

Threat actors are actively probing CVE-2026-20896, a critical flaw in Gitea Docker images, with first exploitation attempts detected just 13 days after public disclosure. Separately, the WordPress wp2shell vulnerability previously reported has been confirmed as a pre-authentication remote code execution flaw affecting default installations, allowing anonymous attackers to compromise sites without valid credentials. Microsoft systems face a new threat as security researcher Nightmare Eclipse released a Windows zero-day exploit called LegacyHive that grants attackers admin privileges on fully patched Windows systems—no patch is currently available.

AI-Powered Attack Surfaces Expand as Hugging Face Breached by Autonomous Agent

Open-source AI platform Hugging Face confirmed unauthorized access to internal datasets and service credentials after compromise by an autonomous AI agent system. During incident response, the security team encountered operational friction when unnamed US frontier LLM guardrails blocked threat analysis queries, forcing responders to pivot to Chinese language models to continue investigation work. The breach highlights emerging attack vectors in AI infrastructure, where automated agent systems can execute multi-step intrusion campaigns. Meanwhile, Russian government agencies are being targeted through compromised ViPNet VPN software, leveraging the platform's widespread deployment across high-value organizations to maintain persistent access.

Sources: The Hacker News · GB Hackers · Bleeping Computer · The Stack · WIU Cybersecurity Center · Bleeping Computer