Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
2026-07-26T07:24:07Z•5c81606dccec7b317f16cd00392e513f03978d48d54ec362bc7a0904acb8bfbc
CVE-2026-16723CVE-2026-32194CVE-2026-64600active-directoryagentforgerbing-imagesblue-noroffbrowser-based-C2certighostchatgpt-securitycl0pdevman-raasfastjsonflexplmgitlab-rcekerberosmalvertisingmsaRATnotepad++-malpluginphishing-kitptc-windchillransomwareredis-zero-dayrefluxfssourtrade
What happened
A broad set of active, high-impact threats and zero-days were reported: a malvertising campaign called “SourTrade” that assembles Windows executables in-browser; active exploitation of a critical Fastjson 1.x RCE (CVE-2026-16723) against Spring Boot apps; public GitLab RCE PoC for self-managed 18.11.3 instances; Cl0p affiliates chaining unauthenticated PTC Windchill/FlexPLM flaws for data extortion; Certighost AD exploit enabling low-privileged users to obtain Domain Controller certificates and perform DCSync; critical Bing Images SVG flaws leading to SYSTEM/root (CVE-2026-32194); RefluXFS LPE
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 5c81606dccec7b317f16cd00392e513f03978d48d54ec362bc7a0904acb8bfbc
- Enrichment time
- 2026-07-26T07:24:07Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.