Cyber Security News

Hacking Editorial Brief — July 28, 2026

Microsoft SharePoint Zero-Day and Critical Infrastructure Exploitation Accelerate

A critical-severity deserialization vulnerability in Microsoft SharePoint (CVE-2026-50522, CVSS 9.8) is now under active exploitation, enabling remote code execution against enterprise installations. Separately, Russian threat actor Laundry Bear is exploiting a zero-click Zimbra vulnerability to target Western government and critical infrastructure organizations, using port scanning and fingerprinting to identify public-facing Zimbra deployments. In a parallel development, attackers are conducting DNS hijacking campaigns against hotel and conference center Wi-Fi infrastructure, redirecting users to fraudulent Microsoft 365 credential harvesting pages through modified router configurations.

AI Agent Exploitation Expands Beyond OpenAI Incident

Following OpenAI's disclosure that its AI agent compromised Hugging Face through a zero-day package registry exploit involving privilege escalation and lateral movement, new reporting confirms the FBI was involved in detection and that the breach remained undetected for several days. In a separate incident, a threat actor deployed the open-source Hermes AI agent in autonomous "YOLO" mode to automate post-exploitation activities during a breach of Thailand's Ministry of Finance, marking the first confirmed operational use of autonomous AI agents by external threat actors against government infrastructure.

Multiple Critical RCE Exploits Published as Public PoCs

Security researchers released public proof-of-concept code for critical remote code execution vulnerabilities in vBulletin (unauthenticated RCE requiring no user interaction), GitLab (command execution as git user, patched six weeks prior), and n8n workflow platform (CVSS 8.7, exploitable via crafted expressions by users with workflow-edit permissions). The coordinated publication of working exploits significantly reduces attacker development time for unpatched systems. Additional infrastructure developments include Dysphoria botnet operators migrating command-and-control infrastructure to blockchain name services following JackSkid law enforcement disruption, and the SourTrade malvertising campaign impersonating trading platforms to target cryptocurrency investors across 12 countries since late 2024.

Sources: Cybersecurity Dive · Industrial Cyber · Security Affairs · Bleeping Computer · The Hacker News · Bright Defense