Cybersecurity Radar — 2026-07-04

🔴 Critical Alerts

CVE-2026-45659: SharePoint Server RCE Added to CISA KEV — Active Exploitation Confirmed

CISA has added CVE-2026-45659, a Microsoft SharePoint Server remote code execution vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog following confirmed in-the-wild attacks. U.S. federal agencies must patch by July 4, 2026 (today). This vulnerability allows unauthenticated attackers to execute arbitrary code on affected systems. Apply Microsoft's latest SharePoint security updates immediately if you run any on-premises or hybrid SharePoint deployments.

Oracle E-Business Suite Actively Exploited Before Public POC Release

Attackers began targeting a critical Oracle E-Business Suite vulnerability (CVE details pending disclosure) before public exploit code was released, suggesting threat actors reverse-engineered Oracle's patch. This represents a dangerous shift in attack timelines. Organizations running Oracle E-Business Suite should prioritize applying the latest critical patches immediately.

Threat Landscape

AI Agent Weaponizes Langflow RCE to Automate Ransomware Deployment

Sysdig researchers discovered a threat actor group called JADEPUFFER using CVE-2025-3248 (a Langflow remote code execution flaw) to deploy an AI agent that automates the entire ransomware attack lifecycle: intrusion, credential theft, file encryption, and data wipe. This marks a significant escalation in attack automation and demonstrates how AI is being integrated into ransomware operations to maximize impact across compromised networks.

"Industrialized" Ransomware Attacks Warned by Researchers; FBI Issues Alert

Security researchers and the FBI are warning of unprecedented ransomware threats emerging from formal partnerships between gangs like TeamPCP and VECT. Arctic Wolf reports these groups are abusing Citrix Bleed 2 vulnerabilities, BYOVD (Bring Your Own Vulnerable Driver) techniques, and compromised supply chain credentials (from Trivy and LiteLLM attacks) to deploy ransomware at scale across victim networks. The formalized collaboration represents a shift toward "industrialized" ransomware operations.

Avalon Modular Malware Framework Distributed via Multi-Stage Phishing

Cybersecurity researchers have discovered a previously undocumented modular malware framework called Avalon that bypasses traditional security controls through sophisticated multi-stage phishing chains. The framework's modular design allows attackers to customize payloads post-infection, making detection difficult. Organizations should review recent phishing campaigns and endpoint logs for signs of Avalon deployment.

Vulnerabilities & Patches

Undisclosed Zero-Days Released in "Exploitarium" Repository

An anonymous researcher published a repository containing over 30 proof-of-concept exploits for undisclosed zero-day vulnerabilities without prior vendor notification. At least two of the disclosed flaws are already under active attack. This irresponsible disclosure violates coordinated vulnerability disclosure practices and puts organizations worldwide at risk. Security teams should scan their environments for signs of exploitation related to the released POCs.

AI-Generated Browser Ransomware Abuses Chromium File System API

Researchers discovered AI-generated browser-based ransomware that exploits the Chromium File System Access API after gaining user permission to encrypt files without deploying a native payload. This malware targets Windows, Linux, macOS, and Android, representing a novel attack vector that requires user interaction but avoids traditional malware detection. Users should be cautious when granting file access permissions to web applications.

1 sources

infosecurity-magazine.com

infosecurity-magazine.com

Breaches & Incidents

ShinyHunters Continue Active Data Breach Campaign

ShinyHunters, a persistent threat group, continues to conduct cascading data breaches affecting multiple organizations. Recent victims have had sensitive data exposed via the group's leak site. The group's operational tempo remains high, with multiple breaches reported during the June 26–July 2 period.

Industry & Policy

June 2026 Cybersecurity Assessment Reveals Critical Gaps Between Awareness and Resilience

A comprehensive cybersecurity assessment of 1,200 IT and security professionals found significant gaps in organizational readiness. The study highlighted three critical vulnerabilities: Shadow AI deployments lacking visibility, living-off-the-land (LOTL) techniques bypassing traditional defenses, and mounting pressure to disclose breaches within aggressive timelines. Many organizations report awareness of these risks but lack the resources or processes to mitigate them effectively.

What to Watch

• July 4 federal patching deadline: U.S. agencies must deploy CVE-2026-45659 SharePoint fixes today; monitor your CISA alerts for additional KEV additions
• Supply chain vulnerability chaining: Threat actors are linking multiple supply chain compromises (Trivy, LiteLLM) to ransomware deployment; audit third-party software dependencies immediately
• AI-powered attack automation: Expect continued evolution of AI agents in ransomware operations; JADEPUFFER's Langflow exploitation sets a precedent for similar automated attacks

Reader Action Items

1. Patch SharePoint immediately: Apply all critical Microsoft SharePoint Server updates to remediate CVE-2026-45659 and verify successful patching within 48 hours.

2. Audit AI and SaaS applications: Conduct an inventory of all Shadow AI tools and Langflow deployments in your environment; disable or isolate any instances not approved by InfoSec.

3. Review phishing and LOTL logs: Search endpoint logs and email gateways for signs of Avalon malware or living-off-the-land activity; check for unusual PowerShell/cmd execution and privileged credential use over the past 7 days.

Freshness Notice: This report covers threats and advisories published between July 2–4, 2026. Federal agencies: your CVE-2026-45659 patching deadline is today (July 4, 2026). Do not delay.