Welcome to Issue #28 of the CosmicBytez Labs Weekly Digest — your curated rundown of what mattered in cybersecurity this week.
This was a week defined by convergence: AI-driven attacks became real (not theoretical), supply chain trust in GitHub was weaponized at an almost incomprehensible scale, and ransomware gangs continued exploiting perimeter devices before patches could land. Three separate stories this week touched AI infrastructure — attackers have clearly identified it as high-value territory, and the security posture of most organizations running AI stacks has not kept up.
Patch queues are heavy right now. Read on, then go check your VPN firmware version.
Top Stories
FakeGit Campaign Uses 7,600 GitHub Repos to Push SmartLoader Malware
A large-scale supply chain campaign called FakeGit seeded 7,600 malicious GitHub repositories that collectively racked up over 14 million downloads before detection. The repos mimicked legitimate developer tools, game utilities, and automation scripts — then bundled SmartLoader, a multi-stage malware loader that installs the StealC infostealer.
StealC targets browser saved passwords, cookies, crypto wallet files, and application credentials. For developers, a StealC infection is particularly dangerous: stolen credentials can include npm tokens, cloud provider keys, and code signing certs — turning a personal infection into a supply chain incident.
What to do: Audit any GitHub downloads from the past several months. Prefer official package managers over direct GitHub releases. Scan executables before running them — even from seemingly reputable repos.
New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack
Sysdig researchers tracked JADEPUFFER — an AI-agent-driven threat operator — returning to a previously compromised Langflow server to deploy ENCFORGE, a Go-based ransomware purpose-built for AI infrastructure. Rather than encrypting documents and databases, ENCFORGE targets model weights (.bin, .pt, .safetensors, .gguf), vector indexes, training datasets, and Langflow pipeline definitions.
The extortion leverage is severe: model weights represent months of compute investment, and curated training data is often irreplaceable. Organizations running self-hosted Langflow instances should treat this as urgent — patch the RCE vulnerability and isolate AI pipeline servers behind VPN or zero-trust access immediately.
What to do: Update Langflow now. Maintain offline, versioned backups of model weights. AI infrastructure should never be internet-facing without strong authentication.
Critical Palo Alto VPN Bug Now Exploited by Qilin Ransomware Gang
Qilin ransomware (also tracked as Agenda) is actively exploiting a critical authentication bypass in PAN-OS GlobalProtect to breach enterprise networks without credentials, according to Arctic Wolf. Qilin is a cross-platform RaaS group with proven ESXi-targeting capability — meaning a successful intrusion can result in mass VM encryption across entire virtual infrastructure estates.
VPN gateways are a nightmare initial access vector: they're internet-facing by design, trusted by the internal network, and commonly under-monitored. With mass scanning tools trivially identifying exposed GlobalProtect portals, unpatched organizations are running out of time.
What to do: Treat this as a P0. Patch GlobalProtect now. Before patching, review auth logs for anomalous activity that may indicate prior exploitation. Restrict management interface access to trusted IP ranges.
Hugging Face Breached by Autonomous AI Agent
Hugging Face — host to 45,000+ models used by 50,000+ organizations — disclosed a breach of its production infrastructure. The attacker deployed an autonomous agent framework that executed thousands of actions across short-lived sandboxes, gaining initial access through chained vulnerabilities in the data-processing pipeline (template injection + a malicious dataset loader).
Internal datasets and cloud credentials were compromised. Public models and the software supply chain were verified clean. This is the first confirmed real-world incident where an agentic AI system was used offensively against a major platform. The forensic challenge is significant: ephemeral sandboxes fragment artifact trails, and C2 traffic staged on public services blends with legitimate web requests.
Key takeaway from Hugging Face: Maintain a capable model you can run on your own infrastructure — during an incident at a hosted AI provider, you lose visibility into whether sensitive prompts or data are being exfiltrated.
SonicWall Zero-Days Exploited for Weeks Before Patch
Threat actor UTA0533 exploited two SonicWall zero-days (CVE-2026-15409 and CVE-2026-15410) to deliver custom malware against organizational targets — weeks before patches were available. Volexity's analysis indicates the custom tooling was engineered specifically for SonicWall's platform architecture, suggesting a sophisticated, well-resourced threat actor with pre-attack knowledge of the platform.
This is part of an accelerating pattern: nation-state and advanced criminal actors exploiting perimeter security devices (Fortinet, Ivanti, Palo Alto, and now SonicWall again) because they're internet-facing, trusted, and infrequently monitored with proper EDR.
What to do: Apply SonicWall patches for both CVEs immediately. Review management logs for anomalous authentication and unexpected outbound connections. Implement zero-trust architecture so perimeter device compromise doesn't equal network access.
Security Corner
Several critical advisories published this week demand attention:
-
CVE-2026-13439 — CVSS 9.8. WordPress Easy Form Builder unauthenticated privilege escalation. The password reset flow uses a publicly-visible session ID as the reset token — any unauthenticated attacker can reset admin passwords and achieve full site takeover. Update or deactivate immediately.
-
CVE-2026-12761 — Review the full advisory for details on the affected product and remediation guidance.
-
CVE-2026-10081 — Review the full advisory for scope and patch availability.
-
CVE-2026-16235 — Additional advisory published this week; check the full writeup for affected versions and mitigations.
-
CVE-2026-16228 and CVE-2026-16227 — Two advisories with overlapping scope; review both.
Browse the full Security Advisories archive to stay current.
Quick Takes
-
Nigeria deepens cybersecurity investment as cybercriminal revenues continue rising (read more) — interesting signal for organizations expanding African operations.
-
July Patch Tuesday raised the triage bar significantly this month (read more) — if your patch queue isn't prioritized by now, this week's exploit activity is the wake-up call.
-
Critical nginx vulnerability can crash workers and may allow RCE (read more) — if you run nginx in front of anything, check your version.
-
SleepGem used three malicious RubyGems packages to target developer machines (read more) — another supply chain hit this week, this time via the Ruby ecosystem.
-
Anubis ransomware claimed the Coca-Cola Fairlife attack with threats to leak data (read more) — major consumer brand, significant data exposure risk.
-
Estée Lauder disclosed a data breach via an Oracle E-Business Suite flaw (read more) — ERP systems as breach vectors continue to appear.
-
WordPress WP2Shell exploitation is accelerating as a public exploit fuels mass scanning (read more) — if you run WordPress, this week was a bad one.
Upcoming
Next issue (Issue #29): We'll be watching for follow-up reporting on the JADEPUFFER AI-agent threat actor as Sysdig continues their investigation, additional Qilin GlobalProtect victims as the patch window closes, and the Hugging Face breach forensic findings.
On the Labs: New how-to guides and training modules are in progress. Check the training index for newly published content, and the howto library for practical guides on hardening the systems making headlines this week.
Stay sharp. The frequency of critical-severity exploitation is not slowing down — and AI-driven attacks have officially moved from theoretical to documented. Your patch cadence and your AI infrastructure security posture both need scrutiny this week.
Issue #28 — July 21, 2026. Published weekly by CosmicBytez Labs. To receive this digest by email, subscribe here.