The week of July 25 brings renewed ClickFix attacks by Sandworm, three Cloudflare infrastructure updates, a local root vulnerability in Ubuntu’s snap-confine, and the launch of Passkey at GMX and Web.de.

No software exploit required: The user executes the command themselves—which is why technical filtering is largely ineffective here. (Quelle: The Hacker News on the ClickFix campaign)

Deep Dive: ClickFix as a Preferred Attack Vector

Sandworm Uses ClickFix for Targeted Malware Distribution

The Russian Sandworm group uses ClickFix social engineering to distribute malware in targeted attacks. Victims are tricked into executing PowerShell commands through fake error messages and CAPTCHA prompts. Ukraine’s CERT issued a warning about the campaign.

Steam Forums as a ClickFix Vector: 8,000 PCs Infected

Cybercriminals are exploiting Steam discussion forums for ClickFix attacks. Fake solutions trick users into running PowerShell commands that install an XMRig cryptominer and set up a Defender exception.

Both cases follow the same pattern: The attacker tricks the victim into pasting and executing the command themselves. No exploit, no vulnerability—which is why a patch won’t work. What helps is explaining to the team that a website never has a reason to offer PowerShell commands to copy.

Deep Dive: Cloudflare Infrastructure Updates

BGP ORIGIN: ~70% of Paths Manipulated

Cloudflare researchers have found that ~70% of BGP paths have their ORIGIN attribute rewritten by transit providers to gain traffic advantages. The study argues for the deprecation of ORIGIN in route selection—a relevant topic for network operators and hosting providers.

Cache Response Rules: Overriding Set-Cookie/Cache-Control at the Edge

A new feature allows Set-Cookie and Cache-Control headers from the origin to be overridden at the edge. This is useful for applications whose caching behavior cannot be corrected at the origin.

Internal DNS: Authoritative + Recursive for Private Networks

Cloudflare’s Internal DNS is generally available: authoritative and recursive DNS for private networks, integrated with Zero Trust. Those who have been running their own internal DNS will now have an alternative—with the well-known trade-off that internal name resolution is handled by an external provider.

Digest: Other Important News

Security

Ubuntu: Root via snap-confine: A race condition in snap-confine allows any local user to gain root privileges on default installations of Ubuntu Desktop 24.04, 25.10, and 26.04 (CVE-2026-8933, CVSS 7.8). Ironically, the vulnerability was caused by a hardening measure—the switch from setuid-root to a capabilities model. Qualys describes the exploit via a FUSE filesystem and symlinks. Update snapd.
GitLab RCE PoC Published: A working proof-of-concept for remote code execution—relevant for anyone self-hosting GitLab.
GitHub Dependabot Cooldown: Dependabot now waits 3 days by default for version update PRs to give maintainers time and slow down supply chain attacks.
GitHub Bug Bounty Reorganization: Focus on high-impact vulnerabilities, improved researcher experience, new VIP program.

Network & Hardware

NetBird v0.75 Desktop App: The WireGuard-based mesh network tool is getting a completely new desktop app built on Wails3/React, featuring MDM policy enforcement and localization in 10 languages.

Enterprise IT

GMX and Web.de Roll Out Passkeys: Since July 23, passwordless login has been available to approximately 38 million users in Germany, Austria, and Switzerland—with no waiting list and at no cost. The existing password continues to work in parallel. A passkey is tied to the domain and simply does nothing on fake login pages, which makes phishing attacks against these accounts significantly more difficult. heise provides context on this move.

Compiled on July 25, 2026. Sources: The Hacker News, BleepingComputer, Cloudflare Blog, GitHub Blog, Qualys, GMX Newsroom, heise.de.

IT News Week 29/2026: Sandworm ClickFix, Cloudflare BGP, snap-confine