[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPcYVO1KttC-D3FrxTN0Mj6MIq63bU3kRM6suzR39LNU":3},{"article":4,"iocs":55,"watch_terms":61,"solutions":62,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"19a315c0-a7ee-4a55-8770-e6bf5645382a","⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More","weekly-recap-sharefile-threat-citrix-bleed-2-ransomware-ai-coding-attacks-and-mo-ad3e33","Somewhere right now, a security tool is quietly finding bugs faster than any human can fix them. That's supposed to be the good news. The catch is that the attackers have the same tools, pointed the other way, and they don't file tickets. That's the shape of this week. Trusted code turns on the people who installed it. Old bugs from last year are still landing because the fix sat in a queue too","This week's security recap covers several significant threats, including a credible external threat to Progress ShareFile's Storage Zone Controllers, urging customers to shut them down. The Jscrambler npm package was compromised, distributing a Rust-based information stealer targeting developer secrets across multiple operating systems. Microsoft detailed GigaWiper, a new destructive backdoor with wiper capabilities, potentially linked to an Iran-nexus threat actor. Additionally, a large-scale operation named SHELLSTORM exploited 27 WordPress plugin CVEs to deploy web shells on over 1.4 million domains.","Weekly recap highlights ShareFile threat, Citrix Bleed 2 ransomware, and AI coding attacks.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fweekly-recap-sharefile-threat-citrix.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjuCIplQpj7CGra4jEeX4qO6DfR9_OazwL_c55clD60cy9pWK42qAsCmqrwe0YBUmPq0cg_6Gt52VlqoOGuigf4qwI8lazIdogbl8pjBDfprTbktGn96fxMbtCh06kyGFF9qCXg9PgMhSXu8V02QBxTmBArc-84ZI3jXwmoDQdj-SCp-_JY7z5XqrQR2IlP\u002Fs1600\u002Fmonday-recap.jpg","2026-07-13T15:05:57+00:00","2026-07-13T16:00:06.562856+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"ShareFile Storage Zone Controllers","product",{"name":21,"type":22},"Progress","vendor",{"name":24,"type":19},"Jscrambler npm package",{"name":26,"type":19},"GigaWiper",{"name":28,"type":22},"Microsoft",{"name":30,"type":31},"WordPress plugins","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56,58],{"type":52,"value":26,"context":57},"New post-compromise backdoor with destructive capabilities.",{"type":52,"value":59,"context":60},"BLUERABBIT","Backdoor with similar artifacts to GigaWiper, assessed to be the work of an Iran-nexus threat actor.",[28,18,24],{"controls":63,"vendors":147},[64,93,121],{"slug":65,"name":66,"problem":67,"products":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":94,"name":95,"problem":96,"products":97},"patch-management","Automated patch management","Known holes get closed in days, not months.",[98,106,113],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":94,"product_name":110,"url":111,"description":112},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":122,"name":123,"problem":124,"products":125},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":143,"product_name":144,"url":145,"description":146},"jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[148],{"slug":149,"name":28,"logo_path":150,"roles":151},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":168},"multi-vector-week-supply-chain-compromise-plugin-cve-exploits-and-destructive-malware-surge","Multi-Vector Week: Supply Chain Compromise, Plugin CVE Exploits, and Destructive Malware Surge","This week's threats illustrate how attackers simultaneously exploit unpatched software, compromised developer toolchains, and vulnerable third-party plugins to maximize impact across organizations. The Jscrambler npm compromise demonstrates that supply chain attacks targeting developer environments can silently exfiltrate secrets before any defender notices. The SHELLSTORM campaign exploiting 27 WordPress CVEs across 1.4 million domains underscores the danger of leaving known vulnerabilities unpatched at scale. Together, these incidents show that vulnerability management must span not just internal systems but also open-source dependencies, CMS plugins, and vendor-managed infrastructure like ShareFile Storage Zones — because attackers are actively chaining these gaps.",[158,159,160,161,162,163,164,165,166,167],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST SI-2: Flaw Remediation","NIST SA-12: Supply Chain Protection","NIST SR-11: Component Authenticity","OWASP A06:2021 – Vulnerable and Outdated Components","NIST CSF DE.CM-8: Vulnerability Scans","GDPR Article 32: Security of Processing (for EU-facing deployments storing personal data)",{}]