Dolphin X: The Infostealer That Uses AI to Pick Its Victims
Varonis Threat Labs has disclosed Dolphin X, a new infostealer that goes beyond conventional credential harvesting by incorporating AI behavioral profiling to score and prioritize victims based on installed software and system activity.
The malware targets over 300 applications — browser password stores, cryptocurrency wallets, SSH keys, AWS and GCP tokens, and developer toolchains. What sets it apart is the triage layer: rather than exfiltrating everything from every machine, Dolphin X uses behavioral analysis to identify high-value targets and focus attacker effort accordingly.
For organizations with developer machines connected to production environments, this is a significant escalation. A single Dolphin X infection on an engineer's workstation could hand attackers live cloud credentials, private SSH keys, and access to internal repositories — the keys to an entire infrastructure.
Defensive posture: Endpoint detection focused on behavioral anomalies matters more here than signature-based AV. Segment developer machines, enforce short-lived credentials, and audit SSH key usage.
2.2 Million Car Anti-Theft Devices Exposed by Hardcoded Bluetooth Key
Security researchers discovered a fundamental flaw in KARR and Secure Wireless Detection Systems (SWDS) aftermarket anti-theft units manufactured by Acrisure — devices installed in at least 2.2 million vehicles, predominantly through dealerships in Southern California.
The vulnerability: a hardcoded Bluetooth key embedded in the device firmware. Any attacker within approximately 5 yards can use the key to remotely unlock vehicle doors. Acrisure has released patches, though the vendor characterized the flaw as "highly complex" with "low risk" in real-world conditions — a framing security researchers are unlikely to share given that hardcoded credentials are among the most well-understood classes of vulnerability.
This follows a familiar pattern in automotive IoT: the physical security promise of an aftermarket device completely undermined by a software shortcut taken during development.
Mitigation: Check with your dealership or the Acrisure website for firmware update availability for affected KARR and SWDS units.
432 Linux Kernel CVEs in a Single Day
In a development that has overwhelmed vulnerability management teams, 432 CVEs were published against the Linux kernel in a 24-hour window in mid-July 2026. This is an unprecedented single-day volume and has created acute triage pressure across enterprises, cloud providers, and embedded Linux deployments.
No single catastrophic vulnerability anchors the release — the volume reflects accumulated upstream security fixes being formally enumerated rather than a coordinated disclosure event. That said, the sheer count strains automated patch management pipelines and vulnerability scanner capacity.
Security teams are advised to:
- Prioritize by kernel version and configuration — not all 432 CVEs apply to all kernels.
- Use vendor advisories (Red Hat, Ubuntu, SUSE) to identify which CVEs affect your specific distributions.
- Avoid treating the count itself as a severity signal — assess individual CVE impact ratings.
Siemens ROX II: Three Chained Zero-Days in Industrial Switches
Unit 42 researchers disclosed a chain of three zero-day vulnerabilities in Siemens ROX II industrial switches used in operational technology (OT) environments:
- CVE-2025-40948 — Arbitrary file disclosure, enabling intelligence gathering
- CVE-2025-40947 — Command injection via privilege escalation
- CVE-2025-40949 — Web management scheduler flaw enabling code execution that persists across reboots
Chained together, these vulnerabilities enable an attacker to achieve persistent root-level access on network switches controlling industrial processes. The persistence mechanism is particularly concerning in OT environments where reboots are infrequent and monitoring is often limited.
Siemens has published patches and mitigations in coordination with ICS-CERT.
Russian Laundry Bear APT Exploits Zimbra for Zero-Click Espionage
CISA, in coordination with international partners, has issued an advisory on Laundry Bear, a Russian state-sponsored threat actor exploiting CVE-2025-66376 in Zimbra Collaboration Suite.
The attack is zero-click: a malicious email triggers the exploit automatically upon being opened, immediately exfiltrating the victim's inbox. Targets span Western government entities and commercial organizations. Zimbra has patched the vulnerability; organizations running unpatched Zimbra instances should treat this as an emergency update.
Stadler Rail Ransomware Extortion
The Everest ransomware group claimed responsibility for stealing technical data from Stadler Rail's shared supplier platform in mid-July 2026, demanding approximately 10 million Swiss francs (~$12M USD). Stadler refused to pay and confirmed no critical security, personal data, or production operations were affected.
The incident highlights ongoing ransomware targeting of manufacturing and critical infrastructure supply chains — even when the primary target proves resilient, supplier platforms can serve as entry points.