CISA Left Its Own Passwords Public for 6 Months — Plus 570 Windows Patches
Thursday, July 16, 2026 · 5-minute read
A campaign called PhantomEnigma turned more than 20 official Brazilian .gov.br websites into traps that delivered malware to visitors. Attackers dressed up their lures as fake police documents — the kind of official-looking notices most people would trust and click. Because the links came from real government addresses, standard security filters mostly waved them through.
Researchers at ANY.RUN connected the dots across hundreds of separate analysis sessions before realising this was one coordinated operation targeting banks and public agencies. The scale was hidden in plain sight.
↗ The Hacker NewsA powerful piece of state-sponsored malware called Daxin has been found active again — this time inside a Taiwan manufacturing company. Daxin had been publicly documented back in 2022, with roots going back to 2013, making it one of the longest-running known rootkits in use today. Alongside it, researchers found a brand-new, never-before-seen backdoor called Stupig, disguised as a harmless Windows keyboard file.
The fact that this toolset is still operational four years after public exposure shows how hard it is to fully evict a sophisticated attacker from a network.
↗ The Hacker News / SymantecDutch police arrested multiple suspects tied to an investment fraud scheme that stole over €100 million from tens of thousands of victims. Days earlier, Spanish police took down a separate cybercrime ring that made €140 million ($160 million) through fake investment platforms and money laundering. Both operations used online fraud to lure victims with promises of high returns, then vanished with their money.
↗ BleepingComputerA financially motivated Russian group tracked as UAT-11795 is distributing trojanized versions of popular video-call apps. If you download what looks like Zoom or WebEx from an unofficial source, you may actually be installing Starland RAT — a remote access trojan that steals passwords and drains cryptocurrency wallets. The fake installers look and work like the real thing, so most people never notice anything is wrong.
A newly discovered ransomware group called Spirals broke into a company, stole its data, and encrypted the entire network — start to finish — in less than one day. That's unusually fast. Most ransomware gangs take days or weeks moving quietly through a network before striking. Spirals' speed leaves almost no window for security teams to catch and stop the attack before the damage is done.
This flaw in Microsoft SharePoint is already being actively exploited in the wild. An attacker who finds your SharePoint server exposed to the internet can use this bug to gain elevated control over the system — no password needed. CISA has ordered all US federal agencies to patch it, and anyone running SharePoint on their own servers should treat this as urgent.
Status: Patch available — part of Microsoft's July 2026 Patch Tuesday. Apply immediately.
BitLocker is supposed to protect your data if someone steals your laptop. This flaw means someone with physical access to your device can bypass that protection and read your encrypted files without knowing your password. Microsoft says it hasn't seen active exploitation yet, but the method is already publicly described online — meaning attackers could start using it at any time.
Status: Patch available via July 2026 Patch Tuesday. Update Windows now.
SonicWall makes network security devices that many businesses use to let employees connect remotely. Two newly discovered flaws in its SMA1000 product are already being exploited in real attacks. These are zero-days, meaning SonicWall only just released fixes — attackers were ahead of the patch.
Status: Patches released. SonicWall is urging customers to update immediately.
A security researcher found that pulling a digital certificate off a Shark RV2320EDUS robot vacuum lets someone send commands to any Shark vacuum in the same Amazon cloud region — including watching the built-in camera, driving the robot around, reading the floor map of someone's home, and grabbing the Wi-Fi password in plain text. The researcher reported this to SharkNinja in March. It is still unpatched as of today.
Status: No patch available. If you own a Shark robot vacuum, consider disabling its cloud features or Wi-Fi connection until a fix is released.
Researchers from Seoul National University, the University of Illinois, and Largosoft have formally described a new type of attack called Agent Data Injection (ADI). It works by slipping malicious instructions into content that an AI agent is already reading — like a planted product review, a fake GitHub comment, or a spoofed sender name. The agent can't tell the difference between the attacker's planted text and real data, so it carries out the attacker's command while appearing to do exactly what you asked.
This matters because AI agents are being built into browsers, coding tools, shopping apps, and email clients right now. Unlike older prompt injection attacks that try to override the AI's instructions directly, ADI disguises itself as ordinary data — making it much harder for current defenses to detect. The paper was posted on July 6 and is already drawing attention from developers building AI-powered tools.
Microsoft's July Patch Tuesday fixed a staggering 570 vulnerabilities — nearly triple last month's record. Microsoft openly credited AI tools for the surge, saying AI can now scan more code, find more issues, and do it faster than human researchers working alone. On one hand, this is good news: bugs get found and fixed before attackers can exploit them. On the other hand, 570 patches in a single month is an enormous workload for every IT team on the planet to process and apply.
Here's a sentence that shouldn't exist: the US government's own cybersecurity agency left its internal passwords and cloud server keys sitting in a public internet repository for nearly six months before anyone told them. Today, CISA published a postmortem explaining how it happened — and what it got wrong in its response.
The story starts in November 2025, when a CISA contractor accidentally uploaded a 844-megabyte folder to a public GitHub account. Inside were files with names like "importantAWStokens" and "AWS-Workspace-Firefox-Passwords.csv" — exactly what those names suggest. The folder contained cloud access keys for three Amazon GovCloud servers and plaintext usernames and passwords for dozens of internal CISA systems. It sat there, publicly searchable, for months. The security firm GitGuardian sent nine automated alerts to CISA. All nine went unanswered. It took a reporter — Brian Krebs of KrebsOnSecurity — getting involved in May 2026 for CISA to finally act. Even then, it took over 48 hours to cancel the exposed keys.
CISA's own postmortem admits the agency's internal reporting channels were poorly defined. When GitGuardian tried to report a leak about CISA, they had to try multiple routes — emailing the contractor directly, using CISA's public vulnerability reporting platform (meant for external software bugs, not internal CISA incidents), and eventually going to a journalist. For regular people and organisations, the lesson is uncomfortable: even the experts responsible for telling everyone else how to stay secure can slip up on the basics. Leaving secrets in public code repositories is one of the most common — and most avoidable — mistakes in cybersecurity.
CISA says it's now fixing its reporting channels and improving how it rotates credential management. GitGuardian's researcher summed it up well: "Letting nine notification emails go unanswered is how a one-day incident becomes a six-month exposure." Watch to see whether CISA follows through — and whether other government agencies quietly audit their own public repositories in response.