The week of July 18 is one of the busiest security weeks of 2026 — Microsoft Patch Tuesday with record numbers, critical WordPress and OpenSSL vulnerabilities, supply-chain attacks via GitHub/PyPI/FakeGit, and the first documented use of LLMs in botnet development.

Two record-breaking patch days in three weeks—the testing window before rollout is thus becoming the real bottleneck. (Quelle: The Hacker News on the 622-CVE Patch Day)

Deep Dive: Patch Management Is Critical

Microsoft Patch Tuesday: 622 CVEs, Two Zero-Days

Microsoft closed 622 security vulnerabilities in its July update—a new record. Among them were two actively exploited zero-days: a privilege escalation bug in the Windows kernel and an RCE vulnerability in Exchange Server. Patching is urgently required for self-hosted infrastructure (Exchange, Windows Server).

WordPress Core "wp2shell": RCE with Public Exploits

Two critical RCE vulnerabilities in WordPress Core (CVE-2026-63030, CVE-2026-60137) allow attackers to install webshells and load malicious plugins—without authentication. Public exploits have been available since July 18. Immediate patching is required.

HollowByte: OpenSSL DDoS with a Payload of Just 11 Bytes

A vulnerability (“HollowByte”) allows unauthenticated attackers, to trigger a memory overflow on OpenSSL servers using a payload of just 11 bytes, thereby causing a DoS condition. Affects all OpenSSL versions with the compression handshake enabled—relevant for anyone running TLS termination on their own servers.

7-Zip: RCE via Malicious Archives

7-Zip Version 26.02 patches an RCE vulnerability that allows attackers to execute arbitrary code via specially crafted archives. Updating to 26.02 is strongly recommended—7-Zip is in use on nearly every workstation and many servers.

Deep Dive: AI in the Crosshairs

TuxBot v3: LLM-Powered Botnet Development

The next evolution of the TuxBot IoT botnet exhibits code patterns that suggest LLM-generated development. The botnet leverages newer exploits for routers and IoT devices and demonstrates accelerated feature development—an indication that attackers are actively using AI tools.

Agent Data Injection: Tricking AI Agents into Making Erroneous Clicks

Researchers have presented a new attack vector that can trick AI agents into, to make erroneous clicks or execute attacker commands. The attack exploits data injection into the AI agent’s context—highly relevant for anyone using AI agents in production workflows.

Cursor IDE: RCE Vulnerability in "Run on Clone" (CVSS 9.8)

The AI code editor Cursor contained a critical vulnerability (CVSS 9.8): In cloned repositories, a malicious .cursor/rules command could lead to code execution on Windows. The "Run on Clone" feature automatically executed commands before the user had even seen the code. Patched in Cursor >= 1.5.x.

Digest: Other Important News

Security

Windows LegacyHive Zero-Day: Privilege escalation on current systems — Attackers gain admin privileges on fully patched Windows systems. Unofficial patch available.
GitHub and PyPI: Time-Based Defenses Against Supply-Chain Attacks: New packages must undergo a waiting period before they are accepted as dependencies.
Microsoft warns of a sharp increase in ACR Stealer attacks: The malware steals browser passwords, authentication tokens, and sensitive documents from enterprise environments.
11 legacy Microsoft-signed Linux UEFI shims can bypass Secure Boot: Outdated shims allow attackers to bypass Secure Boot on affected systems.
ShareFile Storage Zone Controllers: Immediate shutdown recommended: Progress has strongly advised ShareFile customers to shut down their Storage Zone Controllers immediately.

AI & Development

OpenAI Accidentally Deletes Hugging Face Model: OpenAI admitted that its AI models accidentally deleted a Hugging Face repository during a sandbox test.
Debian votes on LLM usage: The Debian project is discussing a general resolution on the use of LLMs within the project—ranging from a complete ban to pragmatic acceptance.

Enterprise IT

Ernst & Young: Data breach following a hack of the support system: The auditing firm confirmed a data breach following the compromise of a third-party support system.
Windows KB5121767: OOB update fixes shutdown bug on Dell PCs: Microsoft has released an emergency update that fixes a bug from the July 2026 security update.
Zeiss is expanding German EUV lithography production by 25,000+ m²: The investment ensures European independence in lithography technology for semiconductor production.

Compiled on July 18, 2026. Sources: Ars Technica, The Hacker News, BleepingComputer, heise.de, Cloudflare Blog, GitHub Blog.

IT News Week 28/2026: Microsoft's Record-Breaking Patch, WordPress RCE, OpenSSL HollowByte