Cybersecurity News — 2026-07-10

Generated: 2026-07-10 | Sources: The Hacker News, BleepingComputer, SecurityWeek, Dark Reading, Security Affairs, Interpol

1. Four Maximum-Severity Bugs in Popular Website Software Were Exploited Within Hours of Being Disclosed

CISA added four newly-disclosed flaws to its official "actively exploited" list on July 9: a path-traversal bug in Adobe ColdFusion (a platform many older business websites and customer portals run on), a file-upload flaw in a Joomla page-builder plugin, a similar flaw in another Joomla plugin, and a bug in Langflow, a tool used to build AI chatbots. Three of the four score a perfect 10 out of 10 on the severity scale, meaning an attacker with no login at all can take full control just by sending the site a crafted request. Security researchers recorded real attackers exploiting the ColdFusion flaw less than two hours after the technical details became public — before most site owners had even heard there was a problem to fix.

Why it matters for your business: if a web developer or agency built your website, ask them directly whether it runs ColdFusion or Joomla, and if so, whether it's been patched this week specifically — "we patch regularly" isn't good enough when attackers moved in under two hours. The lesson beyond these four bugs: for software your business's website runs on, find out who is responsible for patching it and confirm they update within days, not months, once a fix ships.

2. A Widely-Used Microsoft SharePoint Server Had a Break-In Flaw Sitting Unpatched for Months

Microsoft SharePoint Server — used by many businesses to run internal document libraries and intranets on their own hardware rather than in the cloud — had a severe flaw that let anyone who could log in with even a low-level account (no admin rights needed) trick the server into running attacker-controlled code. Microsoft fixed it back in May, but the patch was accidentally left out of the month's headline security bulletin, so many IT teams that rely on that bulletin to prioritise work never flagged it as urgent. CISA has now confirmed real attackers are exploiting it and ordered US federal agencies to patch immediately.

Why it matters for your business: if your business runs its own SharePoint server (rather than the cloud-hosted Microsoft 365 version, which is unaffected), ask whoever manages it to confirm the May update is installed — don't assume "we're on Patch Tuesday" covers it, since this exact fix slipped through that net. If you're unsure which version you're on, that uncertainty is itself worth resolving this week.

3. Researchers Say They've Found the First Ransomware Attack Run Entirely by an AI, Start to Finish

Security firm Sysdig documented a ransomware attack, nicknamed JadePuffer, where — for the first time researchers can confirm — an artificial-intelligence agent carried out the entire break-in on its own: breaking in through a known software flaw, stealing login credentials, spreading to other computers, and encrypting files, all without a human operator typing commands in real time. When one step failed, the AI adjusted and tried again, much like a human hacker would — in one case going from a failed login to a working way in within 31 seconds. It targeted a database management tool and destroyed over 1,300 pieces of configuration data before demanding payment.

Why it matters for your business: this doesn't change what you need to do, but it changes the maths for attackers — running a ransomware attack no longer requires a skilled human, just the cost of renting an AI agent, which is falling toward zero. That means more attacks, faster, against smaller and less "interesting" targets than before, since AI doesn't need a target to be worth a skilled hacker's time. Patching promptly and keeping tested, disconnected backups matters more, not less, as the attacker's cost of trying drops.

4. Stolen Firewall Passwords From Last Week's Story Are Now Confirmed Fuel for Ransomware Gangs

Following on from the FortiBleed credential-theft campaign reported last week, researchers have now linked the stolen Fortinet firewall passwords directly to two active ransomware operations, INC and Lynx. The campaign turns out to be larger than first understood — researchers now put the number of affected FortiGate firewalls at over 430,000 worldwide, with roughly 19,000 of those having had traffic-sniffing tools secretly installed to intercept further logins as they happen, not just steal what was stored.

Why it matters for your business: if your business or IT provider uses a Fortinet firewall or VPN and hasn't yet reset admin and VPN passwords since this story broke, do it now — this update confirms the stolen credentials are actively being handed to ransomware crews, not sitting unused. Turning on multi-factor authentication for remote logins means a cracked password alone still isn't enough to get an attacker in.

5. An Insurance Company Lost Nearly 7 Million People's Driver's Licences After One Employee's Account Was Hacked

US insurer AssuranceAmerica has confirmed that a single compromised employee login gave an attacker access to systems holding data on almost 7 million people — names, contact details, insurance policy information, and driver's licence numbers. The company detected the intrusion in mid-March but took three months to fully work out what had been taken, with notification letters only going out this week. One stolen password, reused or phished from one member of staff, was enough to expose records at a scale that would sink a small business's reputation overnight.

Why it matters for your business: the entry point here wasn't a clever hack — it was one person's login being compromised, the same way most small-business breaches start. Multi-factor authentication on every account that touches customer data turns a stolen password from "game over" into a dead end, and it costs nothing to switch on for most email and cloud software your business already uses.

6. Phishing Emails Are Now Smart Enough to Show Windows Users One Trap and Mac Users Another

Anti-phishing researchers at Cofense have documented phishing campaigns that detect what device and operating system a victim is using — Windows, Mac, or Android — and serve a different attack accordingly. A Windows user might be pushed toward installing a fake remote-access tool, while a Mac or Android user visiting the exact same link instead sees a password-harvesting page. The emails themselves are also more tailored and convincing than the generic "spray and pray" messages of a few years ago, built around narratives relevant to the specific target.

Why it matters for your business: "we use Macs so we're safer from phishing" is no longer a safe assumption — these campaigns are built to have a working trap for whatever device opens the link. Train staff to be suspicious of the message itself (urgency, unexpected attachments or links, requests to install something) rather than relying on any one device or platform feeling immune, and make sure phishing awareness training covers phones and Macs, not just Windows PCs.

7. Ransomware Reports From UK Small Businesses Are Up 50% in a Year

UK police and the national Report Fraud service disclosed that 323 organisations reported a ransomware attack in the twelve months to March 2026, and more than half of those (175) were small and medium-sized businesses — with SME losses totalling around £270,000, a 50% increase on the year before. Businesses with fewer than 25 employees were flagged as the single most commonly targeted group, and police forces including Northamptonshire have launched local awareness campaigns specifically aimed at smaller firms who often assume they're too small to be a target.

Why it matters for your business: the data says the opposite of "we're too small to be worth attacking" — smaller firms are being hit more, not less, likely because attackers assume (often correctly) that they have weaker defences and no dedicated IT security staff. If you haven't already, report any incident to Action Fraud/Report Fraud even if nothing was paid or lost — it's how this kind of picture gets built, and it can connect your case to a wider investigation.

8. A Consulting Giant That Manages IT for Thousands of Businesses Was Breached

Accenture, one of the world's largest IT and business-consulting firms, confirmed a breach after a hacker claimed on a cybercrime forum to be selling roughly 35 GB of stolen data, including source code, private encryption keys, and cloud access credentials for Microsoft Azure. Accenture called it an "isolated matter" and said it has "remediated" the affected system, but has not said how the attacker got in or confirmed exactly what was taken. Source code and cloud access keys are especially valuable to attackers because, if not revoked in time, they can be used to unlock other systems downstream — including those of Accenture's own clients.

Why it matters for your business: you likely don't work with Accenture directly, but the pattern is the one that matters — a breach at any IT provider, consultancy, or software vendor your business relies on can become a breach of your own systems through no fault of yours. Ask any third party with access to your accounts or data (web developers, IT support, accounting software vendors) what they'd tell you if they were breached, and make sure any access they hold can be revoked quickly if needed.

9. A Global Crackdown Made a Dent in the Scam Economy — 5,811 Arrests, $293 Million Recovered

Interpol's "Operation First Light 2026," a four-month operation across 97 countries, resulted in 5,811 arrests and the recovery of $293 million in stolen funds tied to romance scams, fake investment schemes, sextortion, and business email compromise (where criminals impersonate a supplier or executive to trick a company into wiring money to the wrong account). Over 142,000 victims were identified, and 31,000 bank accounts used to launder scam proceeds were frozen. One case alone traced $122.5 million in romance-scam money through a single 20-year-old's crypto wallet.

Why it matters for your business: business email compromise — a fake "urgent" email or call appearing to be from your supplier, bank, or even your own boss asking for a payment or bank-detail change — is one of the scams this operation targeted, and it's one of the most common ways small businesses lose real money to fraud. Put a simple rule in place: any request to change payment details or make an urgent wire transfer gets verified by phone, using a number you already have on file, never one supplied in the email itself.

Sources

• The Hacker News — CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV
• BleepingComputer — Max severity Adobe ColdFusion flaw now exploited in attacks
• The Hacker News — SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
• SecurityWeek — CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability
• BleepingComputer — JadePuffer ransomware used AI agent to automate entire attack
• Dark Reading — JadePuffer: The First Successful LLM-Driven Ransomware Attack
• BleepingComputer — FortiBleed credential-theft campaign linked to Lynx ransomware
• BleepingComputer — AssuranceAmerica data breach exposes records of 6.9 million drivers
• Dark Reading — Crafty Phishing Campaigns Auto-Adapt to Victim's Device, OS
• Northamptonshire Police — New national cyber security campaign warns businesses of the increased risk from ransomware
• Help Net Security — Accenture acknowledges security incident following 35GB data theft claim
• SecurityWeek — Accenture Confirms Data Breach After Hacker Claims Source Code Theft
• Interpol — Over 5,800 arrests, USD 293 million intercepted in global fraud bust