Security Signal Weekly: July 18-24, 2026

Overview

This edition is landing a bit late because I was on vacation last Friday. The July 18-24 window was defined by a familiar but uncomfortable pattern: security and management platforms became the attack path. SharePoint, firewall consoles, VPN gateways, IT service management, AI workflow builders, routers, and product lifecycle systems all demanded more than a routine patch checkbox.

Reality check: When the vulnerable product controls identity, policy, remote access, support workflows, or engineering data, patching is only step one. Verify the fixed version, review exposure, and look for evidence that somebody arrived first.

Top 10 Security Signals

1. Attackers used a new SharePoint RCE to steal machine keys

What happened: Attackers began exploiting CVE-2026-50522 shortly after public proof-of-concept code appeared. The critical deserialization flaw affects on-premises SharePoint Server 2016, 2019, and Subscription Edition; Microsoft’s July security update fixes it, while CERT-EU says observed attacks stole machine keys that can support continued access after patching.

Why it matters: This is another reminder that a SharePoint update is not an incident-response plan. If machine keys or authentication material were taken, an attacker may be able to forge trusted tokens and return through an apparently legitimate path.

Action:

• Install the July SharePoint security updates across every farm server and run the required configuration steps, then verify the resulting build numbers.
• Assess any internet-exposed server for compromise, including suspicious requests, child processes, files, and machine-key access before returning it to normal service.
• Rotate exposed credentials and IIS or SharePoint key material as appropriate, and remove direct internet exposure where the business does not require it.

2. Check Point patched a SmartConsole zero-day that grants full admin access

What happened: Check Point disclosed CVE-2026-16232, an authentication bypass in the SmartConsole login process that can let an unauthenticated attacker obtain an application token and authenticate with full administrative privileges. The vendor published hotfix and investigation guidance, and CISA added the flaw to KEV on July 22 after Check Point observed attacks against a small number of internet-exposed management environments.

Why it matters: A firewall management server is a control plane. Administrative access can expose policy, objects, logs, and the ability to weaken the very gateways defenders expect to stop lateral movement and data theft.

Action:

• Apply the Check Point July security update or the documented Jumbo Hotfix Accumulator to every affected management server.
• Restrict Trusted Clients and management access to approved IP addresses and dedicated administration paths instead of the public internet.
• Use the vendor’s audit-log query and indicators to look for application-token authentication and unexpected policy or administrator changes.

3. ServiceNow’s AI Platform RCE moved from patched to exploited

What happened: ServiceNow addressed CVE-2026-6875, a critical sandbox-escape flaw that can allow unauthenticated code execution in the ServiceNow AI Platform. The vendor patched hosted instances and issued fixes for self-hosted deployments in KB3137947; on July 20, the Canadian Centre for Cyber Security updated its alert after open-source reporting indicated exploitation in the wild.

Why it matters: ServiceNow often connects support, asset, identity, security, and automation workflows. Code execution in that platform can put integration credentials, tickets, configuration data, and downstream actions in reach.

Action:

• Confirm hosted instances received the vendor update and upgrade self-hosted instances to one of the fixed family patches ServiceNow lists.
• Review platform and integration logs for unexpected code execution, new accounts, unusual API activity, or outbound connections around the disclosure window.
• Rotate secrets exposed to the platform if compromise is suspected and review which integrations can perform privileged actions without a second approval.

4. Clop turned the Windchill and FlexPLM flaw into a data-theft campaign

What happened: The Clop extortion group began contacting organizations after apparent attacks against PTC Windchill and FlexPLM systems using CVE-2026-12569. PTC’s active advisory provides patches and web-shell indicators, while Ransom-ISAC and BleepingComputer linked the July 24 extortion wave to the enterprise software campaign.

Why it matters: Product lifecycle systems hold engineering designs, manufacturing records, supplier data, and retail product information. Data theft from that tier can create intellectual-property, regulatory, and supply-chain consequences even when ransomware never encrypts a server.

Action:

• Apply PTC’s patches for every supported Windchill and FlexPLM release and place externally reachable instances behind trusted access controls.
• Hunt for the documented hex-named JSP web shells, unusual POST requests under the login path, malicious headers, and the latest network indicators.
• If indicators are present, isolate the system, preserve forensic evidence, rotate exposed credentials, and scope data access before restoration.

5. Palo Alto confirmed attacks against a GlobalProtect authentication bypass

What happened: Palo Alto Networks says it observed limited exploit attempts against unpatched PAN-OS devices affected by CVE-2026-0257. The GlobalProtect advisory describes an authentication-cookie weakness that can let an attacker establish an unauthorized VPN connection when authentication override is enabled with a vulnerable certificate configuration.

Why it matters: VPN gateways are supposed to narrow remote access. A bypass turns that trust boundary into an attacker-controlled entry point, and partial upgrades can leave mixed portal and gateway behavior that is easy to misread as remediated.

Action:

• Inventory every GlobalProtect portal and gateway, determine whether authentication override cookies are enabled, and upgrade all linked components to fixed PAN-OS versions.
• Use a dedicated certificate for authentication override cookies or disable the feature until the full environment can be upgraded safely.
• Review the Unit 42 indicators and authentication logs for unexpected VPN sessions, then re-enable strict HMAC validation after a phased upgrade is complete.

6. CISA flagged an exploited Langflow flaw that can execute code as root

What happened: CISA added CVE-2026-0770 to its Known Exploited Vulnerabilities catalog on July 21. The NVD record and Zero Day Initiative advisory describe an unauthenticated flaw in Langflow’s validate endpoint where attacker-controlled input can reach code execution in the context of the service, potentially as root.

Why it matters: AI workflow builders frequently store model keys, database credentials, cloud tokens, and internal service connections. A small public demo instance can therefore become a bridge into much more valuable systems.

Action:

• Find internet-facing Langflow instances, upgrade beyond affected releases to the current supported security release, and remove public exposure where it is unnecessary.
• Review requests to validation and code-execution endpoints, container or host process activity, and access to environment variables and stored credentials.
• Run the service as a non-root identity with minimal network reach and rotate API keys or tokens from a clean host if exploitation may have occurred.

7. A botnet revived a 2021 DD-WRT router bug

What happened: CISA added CVE-2021-27137 to KEV on July 21 after active exploitation surfaced. Fortinet’s analysis says the C0XMO Gafgyt variant uses the DD-WRT UPnP stack-buffer overflow to spread, launch denial-of-service attacks, and remove competing malware; NVD notes that builds before 45724 are vulnerable when UPnP is enabled.

Why it matters: Old router firmware can disappear from normal vulnerability programs while remaining powered on for years. Once compromised, those…