Morning Review in IT Security — July 14, 2026

The threat landscape continues to evolve across multiple attack vectors this morning, with state-sponsored actors targeting critical infrastructure, active exploitation campaigns against web platforms, and supply-chain compromises affecting both commercial and open-source software ecosystems. Organizations face mounting pressure to patch vulnerabilities and strengthen access controls as adversaries leverage misconfigured systems and trusted integrations.

Officials Once Again Warn Defenders That Russian Hackers Are Targeting Network Devices

State-sponsored attackers affiliated with Russian intelligence services are conducting sustained campaigns against critical infrastructure networks spanning defense, communications, energy, finance, government, and healthcare sectors. The threat actors are exploiting misconfigured and unpatched network devices to establish persistent access within target environments. Source: Officials once again warn defenders that Russian hackers are targeting network devices

The campaign leverages known vulnerabilities including CVE-2008-4128 and CVE-2018-0171, underscoring the persistent risk posed by legacy systems and delayed patching cycles. Organizations operating critical infrastructure must prioritize network device inventory assessment and accelerate remediation efforts for identified vulnerabilities.

CISA Warns of Actively Exploited RCE Flaws in Joomla Extensions

The U.S. Cybersecurity and Infrastructure Security Agency has issued an urgent warning regarding active exploitation of remote code execution vulnerabilities in popular Joomla extensions. Threat actors are leveraging flaws in the iCagenda and Balbooa Forms extensions to achieve arbitrary file uploads and execute malicious code on affected web servers. Source: CISA warns of actively exploited RCE flaws in Joomla extensions

The vulnerabilities CVE-2026-48939 and CVE-2026-56291 are being actively weaponized in the wild, making immediate patching a critical priority for Joomla administrators. Organizations running these extensions should apply available security updates without delay to prevent compromise of their web applications and underlying systems.

Defending SaaS-Based Applications Against ShinyHunters OAuth Abuse

Microsoft Threat Intelligence has identified threat actor activity consistent with ShinyHunters, a group employing sophisticated social engineering and supply-chain compromise techniques to target SaaS-based applications. The threat actors are utilizing voice phishing, misconfigured guest access controls, and OAuth token abuse to gain unauthorized access to cloud environments. Source: Defending SaaS-based applications against ShinyHunters OAuth abuse

The campaign demonstrates the evolving sophistication of identity-based attacks targeting cloud infrastructure. Organizations must strengthen access governance policies, implement conditional access controls, and monitor for suspicious OAuth token activity to defend against this persistent threat.

Hackers Backdoor Jscrambler npm Package With Infostealer Malware

A malicious version of the Jscrambler npm package has been distributed through the Node Package Manager repository, containing infostealer malware designed to exfiltrate sensitive data from compromised systems. The backdoored package has been downloaded approximately 1,500 times before discovery and removal. Source: Hackers backdoor Jscrambler npm package with infostealer malware

This incident underscores the ongoing risks within open-source software supply chains, where trusted packages can be compromised to distribute malware at scale. Development teams should audit their dependency chains, verify package integrity, and implement software composition analysis tools to detect and prevent installation of malicious packages.

The morning's threat briefing reflects a coordinated assault across infrastructure, web platforms, cloud services, and software dependencies. Organizations must adopt a layered defense strategy encompassing vulnerability management, identity governance, supply-chain verification, and continuous monitoring to effectively counter these multifaceted threats.