Today’s stories split cleanly into two camps: infrastructure that’s still catching up to disclosed bugs, and a ransomware crew turning up the pressure on a breach first reported a week ago. A public proof-of-concept turned a patched SharePoint flaw into an active machine-key heist within hours, a two-bug WordPress Core chain lets anyone run code on a stock install with no plugins and no login, Anubis ransomware put a name and a deadline on the Fairlife/Coca-Cola attack, and Google DeepMind shipped an AI model built specifically to find, exploit, and patch vulnerabilities on its own. Here’s what changed since yesterday’s digest.
Vulnerability watch: Public PoC turns SharePoint CVE-2026-50522 into active machine-key theft
Security firm watchTowr spotted a public proof-of-concept for CVE-2026-50522 — a CVSS 9.8 deserialization flaw in on-premises Microsoft SharePoint Server, patched in this month’s Patch Tuesday — on July 20. Within hours, watchTowr’s honeypot network, Attacker Eye, captured live exploitation attempts using that exact PoC. Attackers with Site Owner-level access can send a single crafted request to steal SharePoint’s machine keys outright, which lets them forge valid authentication tokens and keep impersonating users and accessing sites and documents even after the server is patched. This is now the fourth distinct SharePoint vulnerability exploited in the past month’s wave of attacks. BleepingComputer · The Hacker News · Security Affairs
Patching this one is necessary but not sufficient — stolen machine keys survive the update. If you run on-prem SharePoint Server, apply the July patch and then rotate machine keys and any credentials the server had access to; treat “we installed the update” and “we’re no longer compromised” as two separate facts to verify.
Vulnerability watch: wp2shell chain lets anonymous attackers run code on default WordPress installs
WordPress shipped emergency updates (6.9.5 and 7.0.2, plus a 6.8.6 backport) on July 17 for a vulnerability chain researchers are calling wp2shell — the first unauthenticated critical RCE in WordPress Core in nearly a decade. CVE-2026-63030 is a REST API batch-route confusion bug in WP_REST_Server::serve_batch_request_v1(); CVE-2026-60137 is a SQL injection in the author__not_in parameter of WP_Query. Chained together, an anonymous request with no valid account and no plugins installed can reach full remote code execution on any site running WordPress 6.9.0–6.9.4 or 7.0.0–7.0.1. Public PoCs began circulating within days of the patch, and Wordfence and Cloudflare both confirmed active exploitation attempts by July 18-20; WordPress.org has forced automatic updates onto affected sites given the severity. The Hacker News · SecurityWeek · Rapid7
A default, unmodified WordPress install being enough for pre-auth RCE is a rare and serious combination — no plugin misconfiguration or weak password required. If you manage WordPress sites, confirm auto-updates actually applied (don’t assume the forced push reached every site), and check access logs for the July 17-20 window for unusual REST API batch requests hitting /wp-json/.
Ransomware watch: Anubis claims the Fairlife breach, threatens to leak 1TB of stolen data
A week after Coca-Cola disclosed that a ransomware attack had halted US production at its Fairlife dairy unit, the Anubis ransomware-as-a-service gang added Fairlife to its dark web leak site on July 20, claiming credit for the attack and alleging it stole roughly 1 terabyte of corporate data. Anubis says it first breached Fairlife and encrypted its Nutanix infrastructure about a week before the company’s public July 16 disclosure, and is giving Coca-Cola until the end of this week to open negotiations before the stolen data is published. Neither Coca-Cola nor Fairlife has confirmed the data theft claim or commented on the group’s identity. BleepingComputer · SecurityWeek
The gap between “we detected an incident” and “here’s who did it and what they took” is where most organizations are flying blind, and Fairlife’s timeline shows attackers were inside for roughly a week before the production outage forced disclosure. If your incident response plan assumes you’ll know the scope of a breach as soon as you see the operational impact, this is a reminder that data theft often precedes — and outlasts — the moment encryption becomes visible.
AI security watch: Google ships an AI model that finds, exploits, and patches vulnerabilities on its own
Google DeepMind released Gemini 3.5 Flash Cyber on July 21 alongside two other Flash models, built specifically to autonomously discover software vulnerabilities, write exploit code to validate them in a sandbox, and generate patches — all without a human in the loop. Integrated into Google’s CodeMender agent, multiple 3.5 Flash Cyber instances work in parallel and merge their findings into a single report, scoring 83.2% on the CyberGym benchmark using as few as five model calls per report — competitive with far larger, more expensive frontier agents from OpenAI and Anthropic that cluster between 83% and 85.6%. Google says the model has produced a 100%-reliable remote-code-execution exploit that bypasses ASLR and W^X mitigations. For now, access is limited to governments and trusted partners through CodeMender, with Google saying it plans to extend the capability toward red-teaming and end-to-end enterprise defense. The Hacker News · Help Net Security
The same capability that finds and patches a bug for a defender works identically for an attacker looking for one to weaponize — the only difference is who holds the model and what they do with the output. If AI-assisted vulnerability discovery is heading toward broader availability, the practical takeaway today is that your own patch cadence needs to assume the gap between disclosure and working exploit code keeps shrinking, not stay tuned to how fast it used to move.
Final thought
Every story today is really about the same lag: SharePoint and WordPress both had working exploit chains in the wild within days of a patch or PoC going public, Fairlife’s attackers operated undetected for roughly a week before the outage forced disclosure, and Google’s new model exists specifically to compress the time between “vulnerability exists” and “vulnerability is exploited or fixed.” None of this rewards slow patch cycles or breach investigations that start only after something breaks visibly. If you want a second opinion on whether your patch rotation would catch a same-week exploit chain, or whether your incident response plan accounts for data theft that predates any visible outage, see our guide to AI-driven cyberattacks facing Israeli businesses or book a discovery call.