# Today's Top Stories

Public exploits have been released for the critical 'wp2shell' remote code execution vulnerabilities in WordPress Core, dramatically raising the risk for the millions of sites running the platform. The availability of public exploit code means automated mass exploitation is likely imminent, making immediate patching non-negotiable for administrators.

7-Zip version 26.02 patches a remote code execution vulnerability triggered by opening maliciously crafted archive files. Given 7-Zip's ubiquity across enterprise and consumer environments, security teams should prioritize deployment of the update and consider blocking untrusted archive files at the perimeter.

A critical-severity SharePoint vulnerability allowing remote authenticated attackers to execute arbitrary code is already being actively exploited in the wild shortly after public disclosure. Organizations running on-premises SharePoint should treat this as an emergency patch, as authenticated RCE in SharePoint has historically been a high-value target for ransomware operators and nation-state actors.

UK courts sentenced Scattered Spider members Thalha Jubair and Owen Flowers to 66 months in jail for leading cyberattacks attributed to the Com hacker collective. Jubair alone was linked to at least 120 attacks by U.S. authorities, making this one of the more significant law enforcement actions against the prolific social-engineering group responsible for major breaches at MGM Resorts, Caesars, and others.

The HollowByte vulnerability enables unauthenticated attackers to cause a denial-of-service condition on OpenSSL servers using a payload of just 11 bytes, potentially enabling memory bloat at scale. OpenSSL's widespread deployment in TLS infrastructure across virtually every enterprise makes this a high-priority patching event for security and infrastructure teams.

ACR Stealer, an infostealer active since 2024, is being delivered via ClickFix lures that trick users into pasting malicious commands into the Windows Run dialog. Microsoft's Defender Experts team documented two delivery chains showing the malware exfiltrating saved browser passwords, live session tokens, PDFs, and Microsoft 365 documents including files synced from OneDrive and SharePoint.

Checkmarx researchers discovered seven malicious npm packages (campaign dubbed ViteVenom) targeting the Vite frontend ecosystem as an extension of the ChainVeil supply chain attack, which uses a four-tier blockchain-based C2 infrastructure spanning the Tron network to deliver a remote access trojan. The use of blockchain C2 makes takedowns significantly harder and represents a sophisticated escalation in supply chain attack tradecraft.

Ernst & Young is notifying customers of a data breach stemming from the compromise of a third-party IT support ticket system used by its personnel. Third-party support systems are a recurring breach vector, and the incident is notable given EY's role handling sensitive financial and audit data for major global enterprises.

Kaspersky researchers, who uncovered the activity in February 2026, have documented GoSerpent, a previously undocumented Go-based malware targeting government and diplomatic entities across Southeast Asia since late 2025 with a focus on long-term stealthy access and intelligence collection. The malware's regional targeting pattern and espionage focus are consistent with nation-state activity, though attribution was not publicly confirmed.

Armenia detained Russian tourist Aleksandr Ermakov on June 28 at Yerevan's Zvartnots airport on a U.S. extradition request for a REvil ransomware suspect of the same name, but the detainee's legal team claims the wrong man was arrested. The case underscores ongoing international cooperation in pursuing REvil members and the complications of cross-border cybercrime extradition where name-matching alone may be insufficient.