🛡️ Cybersecurity Vulnerability Watch

Week of: July 5–11, 2026 Reporting window: Most recently completed Sunday–Saturday (excludes the in-progress week).

1. Top Action Item

Shut down ShareFile Storage Zone Controllers immediately. Progress Software has confirmed a "credible external security threat" against the Windows servers running ShareFile Storage Zone Controllers and has temporarily disabled affected accounts. If you operate a ShareFile Storage Zone Controller, power it down now and await official patching guidance from Progress.

2. Exploited This Week

jscrambler npm package — compromised 8.14.0 release

• Source: The Hacker News
• Link: The Hacker News
• Severity: Critical
• What's happening: The jscrambler 8.14.0 npm package was compromised with a preinstall hook that drops and executes a Rust-based infostealer on Windows, macOS, and Linux systems upon installation.
• Fix: Do not install or use jscrambler 8.14.0. If installed, treat the machine as compromised. Socket flagged the release within six minutes of publication.

Injective Labs GitHub compromise — @injectivelabs/sdk-ts@1.20.21

• Source: The Hacker News
• Link: The Hacker News
• Severity: Critical
• What's happening: Unknown threat actors compromised the Injective Labs SDK GitHub repository and published a malicious npm package (version 1.20.21) that exfiltrates cryptocurrency wallet private keys and mnemonic seed phrases via fake telemetry.
• Fix: Remove version 1.20.21 of @injectivelabs/sdk-ts immediately. Rotate any cryptocurrency wallet keys that may have been exposed.

3. Critical Patch Roundup

Zimbra Classic Web Client — unpatched stored XSS (no CVE yet)

• Source: The Hacker News
• Link: The Hacker News
• Severity: Critical
• What's happening: A stored cross-site scripting vulnerability in the Zimbra Classic Web Client allows specially crafted emails to execute arbitrary code in a user's session.
• Fix: Apply the latest Zimbra updates as urged by the vendor. Monitor for a CVE assignment.

Chromium browser vulnerabilities (multiple CVEs)

• Source: Microsoft MSRC
• Link: Microsoft MSRC
• Severity: See source (multiple high-severity issues)
• What's happening: Microsoft Edge (Chromium-based) ingests Chromium updates addressing 12 vulnerabilities including use-after-free, insufficient validation, and incorrect security UI issues in Dawn, ANGLE, Omnibox, Extensions, Autofill, Credential Management, WebView, and other components.
• Fix: Update Microsoft Edge and Google Chrome to the latest versions. See Google Chrome Releases for specific version numbers.

WolfSSL, GeoVision, VTK-DICOM vulnerabilities

• Source: Cisco Talos
• Link: Cisco Talos
• Severity: See source
• What's happening: Cisco Talos disclosed three vulnerabilities in WolfSSL, 14 in GeoVision, and one in VTK-DICOM.
• Fix: Apply patches from respective vendors as they become available.

OpenClaw AI assistant — three high-severity flaws (GHSA-hjr6-g723-hmfm and others)

• Source: The Hacker News
• Link: The Hacker News
• Severity: High (CVSS 8.8)
• What's happening: Three now-patched vulnerabilities in the OpenClaw personal AI assistant could enable credential theft, privilege escalation, and arbitrary code execution on the host, including a WhatsApp-to-host attack chain.
• Fix: Update OpenClaw to the latest patched version.

U-Boot bootloader — six new flaws

• Source: The Hacker News
• Link: The Hacker News
• Severity: High
• What's happening: Binarly researchers found six flaws in U-Boot; four can crash devices, and two allow arbitrary code execution at boot time if a malicious image is loaded.
• Fix: Apply U-Boot updates from device vendors. This affects home routers, smart cameras, and server management chips.

XQUIC (Alibaba's QUIC/HTTP/3 library) — unpatched XRING flaw

• Source: The Hacker News
• Link: The Hacker News
• Severity: High
• What's happening: A single-line variable error in XQUIC lets any remote client crash HTTP/3 servers with ~260 bytes of ordinary QPACK traffic. No patch is available.
• Fix: No patch exists. Monitor for updates from Alibaba; consider rate-limiting or disabling HTTP/3 on affected servers.

4. Home / SOHO Impact

• Update your browser immediately. Microsoft Edge and Google Chrome both received security updates this week addressing 12 vulnerabilities. Restart your browser to apply the patch.
• If you use Zimbra email (self-hosted or through a provider), apply the latest update to fix a critical stored XSS vulnerability that lets malicious emails run code in your session.
• Do NOT install jscrambler 8.14.0 if you're a developer or use npm packages. The compromised version drops an infostealer on your computer.
• If you own a Tangem cryptocurrency wallet card, be aware that a laser attack can reset the password, but this requires physical access and specialized equipment. No action needed for most users.
• Be cautious with free Android VPN apps. A study of 281 popular free VPN apps found traffic leaks, unencrypted data, and tracking in many of them. Avoid free VPNs or research thoroughly before installing.
• Check your home router for U-Boot updates from the manufacturer, as six new bootloader flaws could allow attackers to crash or take over devices at boot time.

5. Enterprise Impact

• Shut down ShareFile Storage Zone Controllers immediately. Progress Software has confirmed a credible external security threat against these Windows servers. Power them down and await official patching guidance.
• Audit npm supply chain. Two supply-chain attacks hit this week (jscrambler and Injective Labs). Review any use of these packages and scan for the malicious versions. Treat any machine that installed jscrambler 8.14.0 as compromised.
• Patch Zimbra servers urgently. The unpatched stored XSS in the Classic Web Client allows arbitrary code execution via crafted emails. Apply vendor updates as soon as available.
• Update all Chromium-based browsers (Edge, Chrome, Brave, Opera) across the enterprise. The 12 CVEs include use-after-free and insufficient validation issues that could be exploited via web content.
• Review exposure to XQUIC/HTTP/3. The unpatched XRING flaw can crash servers with minimal traffic. If you use Alibaba's XQUIC library, consider disabling HTTP/3 or implementing rate limiting until a patch arrives.
• Monitor for The Gentlemen ransomware activity. Unit 42 reports this ransomware operation is growing rapidly through an affiliate model. Ensure backups are offline and tested.
• Patch OpenClaw AI assistants if deployed in your environment. Three high-severity flaws enable a WhatsApp-to-host attack chain leading to credential theft and code execution.

6. What To Patch First

1. ShareFile Storage Zone Controllers — Shut down immediately (credible external security threat, no patch yet)
2. jscrambler 8.14.0 — Remove and treat machine as compromised (supply-chain infostealer, exploited in the wild)
3. @injectivelabs/sdk-ts 1.20.21 — Remove and rotate wallet keys (supply-chain wallet theft, exploited in the wild)
4. Zimbra Classic Web Client — Apply latest updates (critical stored XSS, arbitrary code execution)
5. Microsoft Edge / Google Chrome — Update to latest version (12 CVEs including use-after-free, exploited in the wild)
6. OpenClaw AI assistant — Update to latest version (three high-severity flaws, CVSS 8.8)
7. WolfSSL, GeoVision, VTK-DICOM — Apply vendor patches (multiple vulnerabilities)
8. U-Boot devices — Apply firmware updates from device vendors (six flaws, code execution at boot)

Sources

• Chromium: CVE-2026-14428 Insufficient validation of untrusted input in Dawn — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14428
• Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install — https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html
• Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions — https://thehackernews.com/2026/07/critical-zimbra-flaw-could-let-crafted_0483473395.html
• No Manners Here: The Ruthless Rise of The Gentlemen Ransomware — https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/
• URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat — https://thehackernews.com/2026/07/urgent-progress-tells-sharefile.html
• Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages — https://thehackernews.com/2026/07/injective-labs-github-compromise-pushes.html
• Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot — https://thehackernews.com/2026/07/six-new-u-boot-flaws-could-let.html
• Laser Attack Resets Tangem Wallet Passwords on Cards That Can't Be Patched — https://thehackernews.com/2026/07/laser-attack-resets-tangem-wallet.html
• Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws — https://thehackernews.com/2026/07/researcher-details-whatsapp-to-host.html
• Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers — https://thehackernews.com/2026/07/unpatched-xring-flaw-in-xquic-lets.html
• Study of 281 Free Android VPN Apps Finds Traffic Leaks, Unencrypted Data, and Tracking — https://thehackernews.com/2026/07/study-of-281-free-android-vpn-apps.html
• WolfSSL, GeoVision, VTK vulnerabilities — https://blog.talosintelligence.com/wolfssl-vulnerabilities/