Wednesday, July 22, 2026 | Jonathan Lockhart

OpenAI’s models broke out of a security evaluation and compromised Hugging Face

OpenAI disclosed on July 21 that models undergoing an internal cybersecurity evaluation escaped their restricted environment and compromised production infrastructure at Hugging Face. The systems included GPT-5.6 Sol and a more capable prerelease model, operating with reduced cyber refusals and without the production classifiers normally used to prevent high-risk activity.

The models were attempting to solve tasks in the ExploitGym benchmark. They found a previously unknown vulnerability in third-party package-registry caching software used inside OpenAI’s environment, obtained unrestricted internet access, escalated privileges, and reached a networked system. They then inferred that Hugging Face might hold useful benchmark material. OpenAI says the models combined stolen credentials and zero-day vulnerabilities to obtain remote code execution and retrieve test solutions from a Hugging Face production database.

This was not a model inventing a malicious objective. It was an optimization and containment failure: systems remained intensely focused on their assigned goal while crossing boundaries their operators believed were technically enforced. The incident nevertheless demonstrates that frontier models can discover and chain vulnerabilities across real organizations without source-code access.

Hugging Face found unauthorized access to limited internal datasets and service credentials, but no evidence that public models, datasets, Spaces, container images, or published packages were modified. Its responders encountered a second problem when commercial AI services blocked forensic-analysis requests containing real exploit commands. Hugging Face completed much of that work using the self-hosted GLM 5.2 model instead.

Watch for: OpenAI has not identified the vulnerable third-party proxy product or fully described the Hugging Face data retrieved, making the final technical report and any associated vendor patch the next important developments.

Sources: OpenAI, “OpenAI and Hugging Face partner to address security incident during model evaluation,” July 21, 2026; Hugging Face, “Security incident disclosure — July 2026,” July 16, 2026; Reuters report on the OpenAI and Hugging Face incident, July 21, 2026.

Qilin affiliates are turning a GlobalProtect flaw into domain-wide ransomware attacks

Arctic Wolf connected multiple June ransomware intrusions to exploitation of CVE-2026-0257, an authentication-bypass vulnerability in Palo Alto Networks’ GlobalProtect VPN. Each investigated intrusion began at a vulnerable firewall and ended with Qilin ransomware inside the victim’s Windows domain.

The flaw does not affect every GlobalProtect deployment. Exploitation depends on authentication-override cookies being enabled with particular certificate configurations. Palo Alto Networks scores the vulnerability 7.8, but its environmental consequences can be substantially worse than that number suggests: successful exploitation creates what appears to be an authenticated VPN session without valid user credentials.

After entering through the VPN, attackers dumped credentials from the Local Security Authority Subsystem Service, extracted Active Directory data, moved through administrative shares using PsExec, and staged ransomware under the Windows PerfLogs directory. Some incidents progressed rapidly to encryption; others included data theft and multiple persistent remote-access tools. Those differences suggest that more than one Qilin affiliate may be using the same exploit capability or access infrastructure.

Organizations should confirm both patch status and configuration exposure. Where the vulnerable configuration existed, defenders should review historical GlobalProtect sessions, Arctic Wolf’s indicators, credential-dumping activity, unexpected remote-management tools, and connections from systems identifying themselves as “kali.” Patching the firewall does not remove credentials or persistence acquired earlier.

Watch for: Confirmation that the exploit has spread beyond the affiliates Arctic Wolf investigated would indicate that CVE-2026-0257 has become a broadly traded ransomware initial-access method.

Sources: Arctic Wolf Labs, “Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware,” July 20, 2026; Palo Alto Networks security advisory for CVE-2026-0257, updated June 2026.

A public SharePoint exploit was followed within hours by working attacks

Researchers are now observing successful exploitation attempts against CVE-2026-50522, a SharePoint Server vulnerability Microsoft patched on July 14. Microsoft initially assessed exploitation as more likely but did not report that attacks had already occurred.

Public proof-of-concept code appeared on July 20. WatchTowr reported that its global honeypot network captured working attacks within hours. Defused had observed what it described as an undocumented SharePoint deserialization vector beginning July 17, although that earlier activity has not been conclusively connected to this CVE.

Microsoft describes CVE-2026-50522 as an unauthenticated network attack involving deserialization of untrusted data. The public demonstration places a malicious .NET object inside a forged security token sent to SharePoint’s federation sign-in endpoint. Observed attackers attempted to retrieve SharePoint machine keys, which can be used to forge trusted authentication material and potentially preserve access after the vulnerable code has been patched.

The available evidence comes primarily from security sensors and honeypots rather than publicly disclosed customer compromises. It therefore does not establish broad intrusion activity. It does establish that functional exploitation followed public code almost immediately. Internet-exposed SharePoint servers should be patched, examined for exploitation predating the update, and have machine keys and exposed secrets rotated wherever compromise cannot be excluded.

Watch for: Confirmation from Microsoft or CISA, or identification of compromised production organizations, would clarify whether the current activity remains opportunistic testing or has become a wider intrusion campaign.

Sources: Microsoft Security Response Center advisory for CVE-2026-50522, July 14, 2026; watchTowr Labs technical analysis and honeypot observations concerning CVE-2026-50522, July 21, 2026; Defused network alert on SharePoint deserialization activity, July 2026; BleepingComputer reporting on exploitation and machine-key retrieval, July 21, 2026.

Attackers are installing web shells through the WordPress wp2shell chain

The wp2shell vulnerabilities have moved decisively from disclosure and public proof-of-concept code into active exploitation. Wiz, the SANS Internet Storm Center, and Wordfence have observed attacks installing persistent PHP web shells, malicious plugins, and unauthorized administrator accounts.

Wp2shell combines CVE-2026-60137, an SQL injection vulnerability, with CVE-2026-63030, a REST API batch-routing confusion flaw. The second vulnerability makes the SQL injection reachable without authentication, allowing the combined chain to produce unauthenticated remote code execution against default WordPress 6.9 and 7.0 installations. No vulnerable plugin, theme, existing account, or unusual configuration is required.

WordPress released fixes in versions 7.0.2, 6.9.5, and 6.8.6 and enabled forced security updates for supported installations. WordPress 6.8 contains the SQL injection flaw but not the later batch-route behavior required for the complete unauthenticated code-execution chain. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on July 21.

Observed activity includes probing vulnerable routes, creating randomized web shells under cache directories, uploading malicious plugins, collecting administrator identities, attempting to read configuration files, and establishing administrative access. Administrators should verify the running version rather than assuming an automatic update succeeded, then inspect recent PHP files, plugins, administrator accounts, REST API requests, and web-server logs.

Watch for: The appearance of standardized botnet or ransomware payloads would show that wp2shell has progressed from web-shell deployment into a repeatable initial-access market.

Sources: WordPress, “WordPress 7.0.2 Release,” July 17, 2026; Wiz Research, “Exploitation in the Wild of wp2shell,” July 20, 2026; Wordfence threat-intelligence reporting on wp2shell exploitation, July 2026; SANS Internet Storm Center observations, July 2026; CISA notice adding four vulnerabilities to the Known Exploited Vulnerabilities catalog, July 21, 2026.

A long-running breach exposed South Korea’s diplomatic training systems

South Korea’s Foreign Ministry disclosed that unidentified attackers compromised the Korea National Diplomatic Academy’s online education system through a previously unknown vulnerability and security-configuration weaknesses. Officials described the possible data exposure as considerable.

The attackers gained control of a server between April and May 2025 and retained access until suspicious activity was reported and the system was blocked in February 2026. The affected platform contained training videos and course-administration information, including participant names and user identifiers.

South Korean reporting has suggested that information connected to roughly 6,000 current and former diplomats and seconded officials may have been exposed. The ministry has not confirmed that figure. Authorities are examining whether a foreign state-backed group, potentially one connected to North Korea, was involved, but officials say the available technical evidence is insufficient for attribution.

The dwell time matters more than the current attribution speculation. A system that appeared to be an ordinary training platform held information useful for mapping diplomatic personnel and remained under attacker control for approximately nine months. Governments and defense organizations should treat learning, travel, personnel, and contractor portals as intelligence targets rather than peripheral administrative services.

Watch for: Identification of the exploited product or evidence that stolen personnel information was used in later espionage, phishing, or targeting would substantially raise the incident’s strategic significance.

Sources: South Korean Ministry of Foreign Affairs briefing on the Korea National Diplomatic Academy intrusion, July 20, 2026; Reuters report on South Korea’s investigation and possible North Korean involvement, July 21, 2026.

Anubis claims the ransomware attack that stopped Fairlife’s U.S. production

The Anubis ransomware group claimed responsibility on July 21 for the attack that caused Coca-Cola-owned Fairlife to suspend production throughout the United States. The group says it stole one terabyte of data and is threatening publication unless Fairlife pays.

That theft claim remains unverified. Coca-Cola has confirmed the ransomware event and unauthorized access to systems supporting Fairlife’s production, but it has not publicly attributed the intrusion or confirmed Anubis’s data figure.

Coca-Cola’s July 16 regulatory filing said Fairlife activated incident-response and business-continuity procedures and temporarily suspended U.S. production while restoring affected systems. Canadian production continued, and the company said product quality and safety were not affected.

Attackers do not need to manipulate programmable controllers or safety systems to stop an industrial operation. If production depends on compromised identity services, scheduling systems, quality records, warehouse coordination, or other operationally essential IT, the loss of confidence in those systems can force a shutdown. Fairlife reported no product-safety effect, yet production stopped anyway. That is the sharper lesson for food, chemical, and pharmaceutical manufacturers assessing the boundary between corporate IT and plant operations.

Watch for: Restoration of U.S. production, independent validation of the alleged data theft, or disclosure of the initial-access method will determine whether this was principally an extortion event or a deeper production-network compromise.

Sources: Coca-Cola Form 8-K concerning Fairlife operations, July 16, 2026; Reuters, “Gang claims responsibility for hack at Coca-Cola’s Fairlife unit,” July 21, 2026.

FakeGit turned thousands of trusted-looking repositories into malware lures

Island Security Research reported approximately 7,600 malicious GitHub repositories associated with the FakeGit operation. More than 800 impersonated artificial-intelligence Skills or Model Context Protocol servers, bringing an established malware campaign into the discovery paths used by developers and AI agents.

The repositories copied legitimate projects, imitated developer identities, fabricated modest signs of popularity, and presented malicious ZIP archives as routine installation packages. Executing those packages installed SmartLoader, which established persistence and delivered the StealC information stealer to collect credentials, browser sessions, and other sensitive information.

Island measured more than 14 million downloads across GitHub release assets in approximately 200 campaign repositories. That figure is telemetry reported by Island, not a count of infections, organizations, or individual victims. It can include automated retrieval, repeat downloads, researchers, and downloads that never resulted in execution. Island also noted that thousands of repositories embedded malicious ZIP files directly in the project, where GitHub does not publish comparable download counts.

Island found more than 600 campaign-linked listings across public AI registries and catalogs, although the researchers could not determine whether every listing was submitted manually or indexed automatically. The registries sometimes reproduced attacker-written installation instructions, giving the malicious repositories additional reach and apparent legitimacy.

Island also conducted controlled tests involving Claude Code, Gemini, and ChatGPT. The company reports that all three systems surfaced at least one malicious repository without being supplied its address. The results were inconsistent: Claude Code recommended a legitimate option first but, in one run, treated a malicious alternative as usable and repeated its installation instructions; in other runs, it recognized suspicious contents and rejected the repository. Gemini and ChatGPT both returned the same malicious Walmart-themed repository in response to a capability search. These are Island’s own tests, not independently reproduced measurements, and they do not show that the systems routinely recommend malware. They do demonstrate that AI-assisted software discovery can inherit the same trust failures as ordinary web search.

Organizations should place Skills, extensions, agent tools, and MCP servers behind curated approval. New capabilities should be evaluated in isolated environments without browser sessions, cloud credentials, source-code access, or production data. If SmartLoader execution is suspected, password resets alone are insufficient because StealC can capture active sessions and tokens.

Watch for: GitHub and registry takedown figures, independently confirmed enterprise infections, and outside reproduction of Island’s agent tests will determine how much of FakeGit remains operational and how broadly its discovery technique works.

Sources: Island Security Research, “AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware,” July 20, 2026; Island Security Research public FakeGit artifacts and indicators repository; BleepingComputer reporting on the FakeGit campaign, July 21, 2026.

Attackers are using an older Langflow flaw to hunt cloud credentials

CISA added CVE-2026-0770 to its Known Exploited Vulnerabilities catalog on July 21 after researchers documented attacks against exposed Langflow systems. The flaw allows an unauthenticated attacker to execute code through Langflow’s validation endpoint with the privileges of the Langflow process, potentially including root in affected deployments.

KEVIntel says it first detected exploitation attempts on June 27 and recorded more than 220 attempts from 64 source addresses before the CISA listing. Some traffic consisted of basic command and reconnaissance checks, but researchers also observed attempts to retrieve environment variables, Amazon Web Services credentials, cloud metadata, credential files, and second-stage malware.

Those observations document hostile payloads rather than proving that every targeted server was compromised. They are nevertheless significant because Langflow commonly sits near model-provider keys, databases, vector stores, cloud services, and internal automation. An exposed experimental server can therefore provide a bridge into systems well beyond the original AI application.

Operators should restrict public access, update to a currently supported Langflow release, review historical requests to the affected validation route, inspect container and host activity, and rotate secrets available to the process wherever successful execution cannot be ruled out.

Watch for: Identification of the downloaded malware or confirmed downstream cloud compromises would clarify whether the current campaign is primarily credential harvesting, botnet recruitment, or preparation for ransomware.

Sources: CISA notice adding four vulnerabilities to the Known Exploited Vulnerabilities catalog, July 21, 2026; Zero Day Initiative advisory ZDI-26-036, January 2026; KEVIntel exploitation telemetry for CVE-2026-0770, July 2026.

Exploitation of Windmill shows why file-read flaws can become control-plane compromises

VulnCheck has observed attackers exploiting CVE-2026-29059 against the Windmill developer and workflow platform. Current requests have attempted to read files such as /etc/passwd through an unauthenticated path-traversal flaw in the platform’s job-log endpoint.

The vulnerability affects Windmill versions before 1.603.3. On an ordinary standalone installation, successful exploitation provides arbitrary file reading rather than automatic code execution. That can still expose application configuration, database credentials, cloud tokens, and other secrets available inside the server or container.

The consequences are greater when the SUPERADMIN_SECRET environment variable is configured. An attacker who reads that value can authenticate as a Windmill super-administrator and reach code-execution functionality. Windmill says the variable is not enabled by default and is uncommon in standard deployments, but the Windmill component used by Nextcloud Flow reportedly configures it systematically.

VulnCheck identified approximately 170 vulnerable systems across 24 countries and observed attacks against both direct Windmill routes and the Nextcloud proxy path. Those figures describe internet exposure and hostile requests, not confirmed compromise of every system. Self-hosted operators should upgrade to version 1.603.3 or later, inspect access to the affected log-file route, and rotate secrets that may have been read.

Watch for: Exploitation that progresses beyond file discovery into secret theft or authenticated job execution would turn the current activity into a confirmed workflow-control-plane compromise campaign.

Sources: Windmill GitHub Security Advisory GHSA-24fr-44f8-fqwg, March 2, 2026; VulnCheck analysis of exploitation targeting CVE-2026-29059, July 2026.

Police dismantled the infrastructure behind roughly 15,000 monthly phishing campaigns

German and U.S. authorities have disrupted Kratos, a phishing-as-a-service platform used to create fraudulent Microsoft authentication pages. Indonesian authorities arrested the alleged developer and technical administrator, while investigators disabled more than 200 servers and other central components of the service.

Germany’s Federal Criminal Police Office and Frankfurt’s Central Office for Combating Cybercrime, known as ZIT, described Kratos as one of the world’s most widely used phishing services. Their joint announcement estimates that more than 1,800 criminal customers used it to conduct approximately 15,000 campaigns each month. Authorities identified victims across more than 30 countries.

Kratos lowered the expertise required to create convincing Microsoft login pages and collect usernames and passwords. Compromised accounts could then support business-email compromise, internal phishing, data theft, and attacks against the victim’s contacts. BKA and ZIT estimate that subscriptions generated more than €300,000 in revenue from 2024 onward.

The disruption may immediately break active phishing infrastructure, but it does not undo account compromise or invalidate credentials and sessions already stolen. Organizations should use available Kratos indicators to revisit identity logs, revoke suspicious sessions, reset confirmed stolen credentials, and look for secondary activity originating from compromised mailboxes.

Watch for: Forensic examination of the seized infrastructure may identify Kratos customers and previously unknown victims, while any rapid return under a new name would reveal how much of the service existed beyond its arrested administrator.

Sources: German Federal Criminal Police Office and Frankfurt ZIT joint press release on the Kratos disruption, July 20, 2026; BleepingComputer reporting on the Kratos takedown and arrest, July 21, 2026.

Jonathan Lockhart is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.