Ernst & Young, a global accounting and professional services firm, has disclosed a data breach stemming from a compromised third-party IT support platform. The incident potentially exposed sensitive information, including client documents, tax details, and employee data, which had been submitted in support tickets.
In a separate supply chain attack, Jscrambler, a JavaScript code-protection package with over 15,000 weekly downloads, was compromised after an attacker used stolen npm publishing credentials to distribute malicious releases. These packages deployed malware designed to steal developer, cloud, browser, cryptocurrency, and messaging credentials. Jscrambler has since removed the affected versions.
Coca-Cola’s US dairy subsidiary, Fairlife, confirmed a ransomware attack that temporarily disrupted production across the United States. The company stated that attackers accessed systems supporting manufacturing operations, prompting the activation of incident response and business continuity procedures. Coca-Cola has not confirmed whether data was exfiltrated during the attack.
Japan’s largest taxi operator, Nihon Kotsu, suffered a malware attack following unauthorized access to its internal network. The company responded by shutting down affected systems, which led to disruptions in taxi dispatches, telephone services, bookings, reservations, and car rentals starting July 11. Nihon Kotsu has not confirmed any theft of customer or corporate information.
Researchers have identified a China-linked campaign that leveraged AI tools, specifically Claude Code and DeepSeek, to automate various attack stages against government and financial organizations. The AI tools were used to generate scripts, adapt failed exploits, create credential-harvesting pages, and execute commands. Confirmed compromises include government systems in Thailand and Afghanistan, as well as organizations in Taiwan.
Further AI-related security concerns emerged with xAI’s Grok Build coding assistant, which researchers found could upload entire Git repositories when processing debugging requests. This included unopened files and complete commit histories, potentially exposing API keys, credentials, and and proprietary source code. Initial privacy controls did not prevent these uploads until a server-side restriction was implemented. Additionally, a weakness was verified in Anthropic’s Claude for Chrome extension, allowing malicious browser extensions to impersonate Claude and operate through authenticated user sessions. This could expose information from services like Gmail, Google Drive, or GitHub via Claude’s permissions. Anthropic has released fixes, though researchers noted a potential bypass remains.
Microsoft released 622 patches in its July Patch Tuesday, marking its largest monthly release to date. Two of these vulnerabilities were under active exploitation: CVE-2026-56164 in SharePoint Server and CVE-2026-56155 in Active Directory Federation Services, both of which could allow attackers to elevate privileges.
WordPress issued emergency updates for two critical vulnerabilities, CVE-2026-63030 and CVE-2026-60137, collectively dubbed "wp2shell." These flaws allow unauthenticated remote code execution and website takeover. Affected versions include 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, with fixes available in versions 6.9.5 and 7.0.2.
SonicWall released a hotfix for CVE-2026-15409 and CVE-2026-15410, two critical vulnerabilities impacting SMA 1000 Series gateways. These flaws enable unauthenticated attackers to execute system commands on vulnerable appliances, and active exploitation has been linked to Inc ransomware.
