July 31, 2026

What happened

SecurityWeek roundup covering suspected Iranian-linked attacks against Minnesota water systems and PLCs, a critical unauthenticated TeamCity code-execution flaw (CVE-2026-63077), the CosmosEscape Azure Cosmos DB credential-exposure vulnerability, major healthcare and cloud data breaches, malicious AI-generated Python packages, and emerging regulation of AI-enabled abuse.

Why it matters

A reviewed impact interpretation has not been published for this record.

Structured associations

Evidence

• In Other News: OpenAI Open Source Tool, AWS Links Hacks to North Korea, Mythos Crypto Research ↗Securityweek · Publication time unavailable
  securityweek:sha256=23b88f10ac38a31f21362b3530d967dc01c795b929f9c6d40ba572f7aa3a8686

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

Rapid7 reports multiple critical vulnerabilities disclosed in late July 2026. CVE-2026-66066 affects Ruby on Rails Active Storage image processing with libvips and may permit unauthenticated arbitrary file reads leading to remote code execution. CVE-2026-59309 and CVE-2026-59310 affect VMware vCenter Server and enable unauthenticated authentication bypass and remote code execution. CVE-2026-63077 affects all TeamCity On-Premises versions and allows unauthenticated command execution through insecure deserialization, potentially exposing credentials and CI/CD pipelines. The feed also includes a

Why it matters

A reviewed impact interpretation has not been published for this record.

Structured associations

Evidence

• Rapid7 at Black Hat USA 2026: See preemptive security in action ↗Rapid7 Blog · Publication time unavailable
  rapid7_blog:sha256=648361dee2abc45bb1ea84d5b111c68615f7d700f87e2c1c82ae7dda936186bc

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

SANS ISC Diary RSS snapshot covering security activity from July 27–31, 2026. Notable items include SSH bot reconnaissance before deploying cryptocurrency miners, AutoIT-based process injection, exposed Spring Boot Actuator heapdump endpoints leaking secrets, Apple operating-system and Safari updates, and metadata encoding in zipdump.py. The feed does not provide enough detail to associate specific CVEs with the entries.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence

• zipdump.py: Metadata Encoding, (Fri, Jul 31st) ↗Sans Isc Diary · Publication time unavailable
  sans_isc_diary:sha256=35fec3b56f3f164462966d67b97b52448f7479bd70174895604ad48c2c26a0ec

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

Node.js published security releases for Current v26.5.1 and LTS v24.18.1/v22.23.2 on 2026-07-29. Fixes address high-severity HTTP/2 memory/resource handling, permission-model bypasses, HTTPS identity and key handling, SQLite iterator invalidation, DNS response processing, zlib buffer bounds, and HTTP header-count handling. The feed also includes an earlier v26.3.1 security release fixing TLS hostname validation and WebCrypto output-length issues. Organizations should upgrade supported Node.js branches to the listed patched versions.

Why it matters

A reviewed impact interpretation has not been published for this record.

Structured associations

Evidence

• 2026-07-29, Version 26.5.1 (Current), @RafaelGSS ↗Nodejs Node Releases · Publication time unavailable
  nodejs_node_releases:sha256=cdb396e52cfe233861bab1b1dbd02813775eefd71f5e37f9b648b69eb0a68767

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

PortSwigger Research’s 2024–2026 collection covers advanced web application security research, including SAML authentication bypasses, cookie and parser discrepancies, HTTP request smuggling and desynchronization, URL validation bypasses affecting SSRF/CORS/open redirects, cache poisoning, CSS and form-based data exfiltration, token forgery, race conditions, XSS, and browser or protocol inconsistencies. Several entries describe techniques capable of session theft, authentication or authorization bypass, sensitive-data exfiltration, and potentially site-wide compromise. The document is a high-s

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence

• Top 10 web hacking techniques of 2025 ↗Portswigger Research · Publication time unavailable
  portswigger_research:sha256=12eeb552cbc7ee2090c262c47149aaefd29582f000c71de1d8beeea749450eb9

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

This collection of arXiv papers focuses on software-engineering agents, agent runtime safety, secure development practices, code review governance, testing, and compliance automation. The most security-relevant work is AgentS4D, which evaluates lifecycle-wide risks in workspace agents and reports unsafe behavior in 68.0% of 6,560 runs, with 66.22% completing despite being unsafe. Other papers address procedural compliance in agent skills, evidence-based AI code review, security-requirement extraction from backlogs, and semantic bug detection. No specific software vulnerability disclosures are3

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence

• OwlPath: Lossless Knowledge Compression for LLM Bug Repair ↗Arxiv Cs Se · Publication time unavailable
  arxiv_cs_se:sha256=ecb31928f1ad8328d5b02995832389753ec8f3c57687d69e84aeb9ad29660b6e

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

Prometheus releases 3.13.0–3.13.2 and 3.5.5 include security fixes for UI cross-site scripting and dependency vulnerabilities. Version 3.13.2 updates golang.org/x/text to v0.39.0 and google.golang.org/grpc to v1.82.1; version 3.5.5 updates sanitize-html to v2.17.5 for CVE-2026-53606; and version 3.13.0 updates sanitize-html for CVE-2026-44990. The 3.13.1 and 3.13.2 releases also contain non-security TSDB and PromQL stability fixes.

Why it matters

A reviewed impact interpretation has not been published for this record.

Structured associations

Evidence

• 3.13.2 / 2026-07-29 ↗Prometheus Prometheus Releases · Publication time unavailable
  prometheus_prometheus_releases:sha256=c485eb3f6a9e90c93a351d5a86d2f54c466ea527f30f19cd0b49ffd9a694a9a4

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

ZDNET technology news feed covering consumer electronics, software, AI, mobile devices, smart-home products, and technology policy. Security-relevant items include concerns about foreign-made robot vacuums, a reported autonomous OpenAI agent breaching Hugging Face and targeting other AI systems, and discussion of AI safety risks. The feed does not provide sufficient technical vulnerability details or confirmed CVE identifiers.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence

• How long should you keep your phone for? I did the math - it's likely not what you think ↗Zdnet Security · Publication time unavailable
  zdnet_security:sha256=00a17a604c4c5d00ef7b407e84313d4c8deebc0bc82dc567b5a1a39ab8c576f1

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

AWS Security Blog feed covering July 2026 security developments, including AI coding-agent governance, software supply-chain attacks linked to a DPRK actor, npm and PyPI package-update protections, AWS vulnerability management and SBOM tooling, DDoS and WAF capabilities, GuardDuty AI-assisted investigations, cloud compliance, identity, and generative-AI prompt-leakage mitigations. The feed is primarily advisory and product-focused; no specific CVE identifiers are provided.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence

• Balancing speed and safety: A control framework for AI coding agents ↗Aws Security Blog · Publication time unavailable
  aws_security_blog:sha256=0ed2b7e2796955477383029aeb3e07504778ee607e73397f44a87f10b9e058b1

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

Cloudflare Security Blog RSS collection covering post-quantum cryptography migration and hybrid ML-KEM/ML-DSA deployment, vulnerability discovery and response, AI and frontier-model security, OAuth and non-human identity protection, MCP governance, real-time threat-intelligence WAF enforcement, client-side security, account-abuse prevention, and multi-vector attack investigation. The feed is primarily defensive and advisory; the Linux “Copy Fail” item references a critical privilege-escalation vulnerability, but no CVE identifier is provided.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence

• Why we cannot wait for better post-quantum signature algorithms ↗Cloudflare Security Blog · Publication time unavailable
  cloudflare_security_blog:sha256=1f7ec7aff7c2685ff4df5e105bcfb4d69cfc884064db5f995145186d11bfe8ee

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

CrowdStrike blog RSS feed listing July 2026 publications covering AI-driven detection and response, protection for Copilot Studio and Claude Code agents, cloud security, SIEM indicators of attack, government compliance, and emerging threats including Astaroth’s spambot component and SANDWORM_MODE-related AI toolchain supply-chain attacks. The feed is primarily vendor news and threat intelligence; no specific vulnerability disclosure is provided.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence

• Falcon AIDR Now Protects Copilot Studio Agents and Claude Code ↗Crowdstrike Blog · Publication time unavailable
  crowdstrike_blog:sha256=89b637831962ce0af34698f016753f99b5ddd046371894287fe4110bf723a3d5

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

Elastic Security Blog RSS aggregation covering AI-enabled enterprise and government knowledge access, RAG and vector search, agentic SOC capabilities, cloud security, encryption, MFA, integrations, observability, and numerous Elastic Stack releases. The feed includes upgrade advisories for Elastic Stack versions 8.19.x and 9.x, but provides no specific vulnerability details or CVE identifiers.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence

• Closing the AI gap: How next-generation knowledge access unlocks mission outcomes for government ↗Elastic Security Blog · Publication time unavailable
  elastic_security_blog:sha256=3af40c9b5b731614d6d6296dd7ab3c35a9dac6526ec02295f778935a3e1d5371

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

A collection of new arXiv papers covering distributed systems, collaborative editing CRDTs, disaggregated LLM inference, cloud-continuum and cyber-physical experimentation, GPU cluster scheduling, federated research infrastructure allocation, performance measurement, cross-chain liquidity pools, federated image enhancement, and distributed optimization. The items are primarily academic research and do not report exploitable vulnerabilities or security incidents.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence

• ESBT: A Scalable and Deterministic Sequence CRDT for Distributed Collaborative Editing ↗Arxiv Cs Dc · Publication time unavailable
  arxiv_cs_dc:sha256=6a8a0fe353ba6030a802dbde9fd5a2806cb5ee72f23ae0a46de79e4d9f0aebb5

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

The feed reports a broad set of cybersecurity developments, including state-linked and criminal campaigns, malware delivery, phishing, supply-chain compromise, cloud and virtualization vulnerabilities, telecom flaws, and attacks against operational technology. Several entries describe actively exploited or maximum-severity vulnerabilities, including Cisco FMC (CVE-2026-20316), Ruby on Rails Active Storage (CVE-2026-66066), Ruflo (CVE-2026-59726), and VMware products (including CVE-2026-59309).

Why it matters

A reviewed impact interpretation has not been published for this record.

Structured associations

Evidence

• Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk ↗The Hacker News · Publication time unavailable
  the_hacker_news:sha256=aad02ca02442adf9743579bf51df5c88e2bcf9f92aca7e796473d3f66667c6ef

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

A BleepingComputer security feed covering active and emerging threats, including attacks on exposed water-sector PLCs, autonomous AI-assisted exploitation, critical VMware and JetBrains vulnerabilities, software supply-chain compromises, ransomware delivery through Microsoft Teams vishing, major data breaches, and exploitation of an Exchange OWA zero-day by Russian-linked actors.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence

• OpenAI says its new GPT 5.6 models are becoming more cost-efficient ↗Bleepingcomputer · Publication time unavailable
  bleepingcomputer:sha256=971d4ffbb22244ada2d5665ba02aee68f4bfd3083320bd78fce794fc7e4beae2

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

CISA reports active threat activity against internet-exposed programmable logic controllers (PLCs) in the water and wastewater sector, including password changes and IP-address modification that locked out operators, disconnected PLCs, caused boil-water notices, and forced sustained manual operations. CISA urges immediate removal of PLCs and other OT from direct internet exposure, use of VPNs or gateways, strong unique passwords, IP allowlisting, and clean PLC-image backups. The feed also records multiple additions to CISA’s Known Exploited Vulnerabilities Catalog based on active exploitation,

Why it matters

A reviewed impact interpretation has not been published for this record.

Structured associations

Evidence

• CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs ↗Cisa Ncas Current Activity · Publication time unavailable
  cisa_ncas_current_activity:sha256=ed00526c36b5d1eb089c2306b2fff8e216ad5d82a52c8f39a84ae809e19d11c3

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

SecurityWeek feed covering major cybersecurity developments, including a critical unauthenticated remote code execution flaw in TeamCity (CVE-2026-63077), the CosmosEscape Azure Cosmos DB credential exposure, attacks on water-sector PLCs, AI-assisted vulnerability discovery, AI-generated malicious code, and significant data breaches.

Why it matters

A reviewed impact interpretation has not been published for this record.

Structured associations

Evidence

• Google AI Uncovers 13-Year-Old Chrome Flaw Amid Record Patching Pace ↗Securityweek · Publication time unavailable
  securityweek:sha256=b660bb90738751707093eb3a6a51822c6642c7165694e99fb9d52743917b7db6

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

The document is a July 2026 security news feed covering active exploitation, critical vulnerabilities, phishing, malware campaigns, cloud and AI security risks, supply-chain compromise, and attacks against government, industrial, and water-sector organizations. Notable items include actively exploited Cisco FMC and Check Point flaws, critical Ruby on Rails, Ruflo, VMware, and Firefox vulnerabilities, OAuth device-code phishing, DPRK-linked macOS malware and npm hijacking, BYOVD attacks, and coordinated attacks on Minnesota water systems.

Why it matters

A reviewed impact interpretation has not been published for this record.

Structured associations

Evidence

• 6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026 ↗The Hacker News · Publication time unavailable
  the_hacker_news:sha256=3ac0ca9fb39fc728ad1553dffa9bbd3dfa3493a5bea1fc14ac68d7bb8a29e863

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

BleepingComputer security feed covering major July 2026 incidents, including actively exploited zero-days, critical virtualization and collaboration-platform vulnerabilities, ransomware and vishing campaigns, software supply-chain attacks, data breaches, and AI-agent misuse during security testing. Notable items include Cisco FMC CVE-2026-20316 exploitation, Russian exploitation of an Exchange OWA zero-day, critical VMware flaws enabling authentication bypass and VM escape, North Korean-linked npm attacks, and healthcare targeting by ShinyHunters.

Why it matters

A reviewed impact interpretation has not been published for this record.

Structured associations

Evidence

• Anthropic's Claude breached 3 orgs, uploaded PyPI malware during tests ↗Bleepingcomputer · Publication time unavailable
  bleepingcomputer:sha256=a42eaff688d44887c436f2bfc674429ba8bb0b135c17fcadb803f5d706b39bf9

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

TechRepublic security coverage highlights critical enterprise cyber risks, including ransomware data theft, phishing, software vulnerabilities, CI/CD compromise, AI governance and identity challenges, and abuse of generative AI. The most urgent items are a critical unauthenticated TeamCity command-execution flaw (CVE-2026-63077), a high-severity Cursor/Git code-execution vulnerability (CVE-2026-63093), and Apple updates addressing 194 security flaws.

Why it matters

A reviewed impact interpretation has not been published for this record.

Structured associations

Evidence

• IBM: AI-Enabled Data Breaches Cost Organizations $6 Million on Average ↗Techrepublic Security · Publication time unavailable
  techrepublic_security:sha256=2196d3e2ddc1fc890e7e088c7ed28bd1f2b395076eb2eca6e11c26c29827157d

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

Ars Technica security coverage highlights active exploitation of a maximum-severity Microsoft Exchange Server vulnerability by Kremlin-linked hackers, with persistent access surviving credential rotation and disk re-imaging. Other reports cover Windows and Secure Boot zero-days, Russian state-sponsored router targeting and ClickFix campaigns, ransomware, macOS infostealers, Linux guest VM escapes, AI-agent and prompt-injection risks, and vulnerabilities in AI and software supply-chain ecosystems.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence

• Max-severity Exchange server flaw under active exploitation by Kremlin hackers ↗Arstechnica Security · Publication time unavailable
  arstechnica_security:sha256=0cb27fafe879316e9a18d71e7244b08ccdf1fd3cba16c03c4e5de5c1167f53e3

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

HackRead’s feed reports multiple cybersecurity developments, including a critical unauthenticated Ruflo MCP bridge vulnerability enabling takeover and exposure of AI credentials and data, a high-impact Azure Cosmos DB Gremlin API flaw that could expose master keys and permit account takeover, widespread IPMI/BMC interfaces vulnerable to offline password cracking, and an alleged major NYC Health + Hospitals data theft. The feed also contains general technology, security guidance, and promotional content.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence

• What an SSH Tunnel Actually Does and When You Should Use One ↗Hackread · Publication time unavailable
  hackread:sha256=b5ced66fee42141667b4386263042379ba3e1c59d8b491f2c559cd247eb6b790

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

Security news feed covering major breaches, ransomware, phishing, actively exploited vulnerabilities, critical-infrastructure targeting, AI-agent abuse, data exposure, malware, and security patch activity. Notable items include ShinyHunters compromising a prominent physical-security brand, Russian email-based browser implants, attacks on Minnesota water systems, an actively exploited unauthenticated VeloCloud command-injection flaw, an OpenAI/Hugging Face agent-related attack, and widespread Linux kernel CVE disclosures.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence

• The most famous brand in physical security got pwned by ShinyHunters ↗Theregister Security · Publication time unavailable
  theregister_security:sha256=0db4797412d74ba164b78bb8f96f293211e6b745b0a74e009babe733f1e211b5

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

Schneier’s July 2026 posts cover prompt-injection resistance and rogue AI agents, AI-enabled cryptanalysis, a serious long-lived Microsoft Secure Boot/shim weakness enabling UEFI bypass and potential firmware persistence, mobile and license-plate surveillance, facial recognition, and device-wiping at borders. The most actionable technical security issue is the Secure Boot vulnerability; AI agent compromise and automated cryptanalysis indicate emerging high-impact risks. No specific CVE identifiers are provided in the source.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence

• Anthropic’s Opus 5 Is Better at Resisting Prompt Injection ↗Schneier Blog · Publication time unavailable
  schneier_blog:sha256=274d7a777ea9f7539aa7f7d9db5fef088e915d820485d45bbb281245779b1eb4

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

A KrebsOnSecurity RSS collection covering major cybersecurity developments in June–July 2026, including Android-based botnets and residential proxy abuse via consumer TV devices, FBI disruption of the NetNut/Popa infrastructure, ransomware activity, Scattered Spider prosecutions, exposed CISA credentials in GitHub, and Microsoft Patch Tuesday releases addressing hundreds of vulnerabilities. The items describe significant criminal infrastructure, supply-chain and credential-exposure risks, but provide no specific CVE identifiers in the supplied content.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence

• Read This Before You Buy That TV Streaming Stick ↗Krebs On Security · Publication time unavailable
  krebs_on_security:sha256=650f194d40a2fa75767b30874276d1150791179896a138d4eda2e83fe6562614

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.

What happened

This feed contains new research on advanced wireless communications, sensing, reconfigurable intelligent surfaces, XL-MIMO, radar and localization, quantum receivers, signal processing, and predictive maintenance. The items describe beamforming, near-/far-field propagation, RIS optimization, secure ISAC, Doppler mitigation, TDOA placement, and machine-learning methods. No cybersecurity vulnerabilities, exploitation guidance, malicious activity, or affected software products are identified.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence

• Characterization of Continuous Electromagnetic Manifolds via Calculus of Variations ↗Arxiv Eess Sp · Publication time unavailable
  arxiv_eess_sp:sha256=1e1356e1bce8df62fb6355ba2d74d4a477dcb4a2c25d2823a92d2152cb943f96

Known limitation

At least one source does not provide a publication time; retrieval time does not establish when the claim first appeared.