This Week in Cybersecurity: Progress's Mystery ShareFile Shutdown, Microsoft's Record-Breaking Patch Tuesday Zero-Days, and AI-Written Malware Hits Power Grids in Three Countries

Explore this content with AI:

ChatGPT | Perplexity | Claude | Google AI Mode

Progress orders ShareFile customers to physically shut down servers over a threat it still won't name

On July 10, 2026, Progress Software emailed every ShareFile customer running an on-premises Storage Zone Controller — the component that lets organizations keep files on their own storage while still using ShareFile's cloud for authentication and sharing — instructing them to manually power off the Windows server hosting the controller. The incident became public after a customer posted Progress's email to r/sysadmin on July 10. As of 5 pm ET on July 12, Progress restored cloud access for affected accounts, but Storage Zone Controllers must stay powered off while the investigation continues. The company says it has no evidence yet of unauthorized access to any customer account or data — but it has not disclosed what the threat is, whether it involves a zero-day, or who is behind it.

Why it matters: Progress is the same company behind MOVEit, whose 2023 mass-exploitation became one of the most damaging supply chain incidents on record. A "credible" but undisclosed threat against another of the company's on-premises file products warrants urgent attention, regardless of official confirmation. If you run a ShareFile Storage Zone Controller, don't wait for a CVE number: shut it down now per Progress's instructions, and treat "no confirmed compromise yet" as a statement about detection, not proof of safety.

Read more at SecurityWeek

The Langflow flaw behind last week's JADEPUFFER attack lands on CISA's KEV list — but nobody agrees on how severe it is

We mentioned Langflow last week as the platform JADEPUFFER's AI agent exploited to gain initial access. This week, a second and separate Langflow vulnerability made news: CISA added CVE-2026-55255, an insecure direct object reference (IDOR) flaw in Langflow's /api/v1/responses endpoint, to its Known Exploited Vulnerabilities catalog on July 7, giving federal agencies until July 10 to patch. The bug lets an authenticated attacker execute another user's AI workflow simply by supplying that user's flow ID — Sysdig's Threat Research Team traced in-the-wild exploitation back to June 25, roughly two weeks before the KEV listing. A single operator chained the IDOR with a second flaw, CVE-2026-33017, in a sustained campaign running June 22–25 to achieve remote code execution and harvest embedded secrets — LLM provider API keys, cloud credentials, and database secrets — from other users' flows.

The oddity worth flagging: CISA's own KEV entry scores this vulnerability at CVSS 6.1, while independent databases KEVIntel and CIRCL rate the same flaw 9.9. Langflow shipped a fix in version 1.9.2 that adds an ownership check the original endpoint lacked.

Why it matters: Two Langflow stories in two consecutive weeks — a different exploited flaw each time — signal sustained attacker interest in AI agent tooling as it proliferates through developer and enterprise environments. The CVSS disagreement isn't academic: a 6.1 and a 9.9 land in very different places in most patch-prioritization queues. Patch to 1.9.2 regardless of which score you trust, and if you ran an unpatched Langflow instance between June 22–25, rotate every LLM provider key, cloud credential, and database secret that any flow on that instance touched.

Read more at Help Net Security

Aflac Japan discloses breach of 4.38 million customer records, all through one compromised account

Aflac's Japan operations disclosed that hackers accessed its policyholder portal between June 15 and June 25, 2026, using a single compromised account to browse numerous customer profiles before the company traced the activity and shut down the affected systems. Aflac says the exposed data includes names, addresses, phone numbers, dates of birth, gender, security information, and insurance account details for more than 4.38 million customers and sales agents, with premium transfer account information for roughly 230,000 people also exfiltrated. No credit card data was accessed. Aflac detected the intrusion on June 25 after noticing unusual data-processing load on the portal, and at least five customer-facing services have been disrupted as a result of the containment response.

Why it matters: Ten days of undetected browsing through a single authenticated account is a detection-gap story, not a credential-theft story — the account itself was presumably legitimate or looked legitimate enough not to trigger alerts. If your fraud or security monitoring is built primarily around anomalous logins rather than anomalous data-access volume, this is a good week to add bulk-record-access alerting for portals handling customer PII, even for accounts that authenticate normally.

Read more at The Record

BlackField ransomware gang auctions 2TB of stolen Nidec data with a pay-to-delay pricing menu

Nidec Corporation confirmed that its Taiwanese subsidiary, Nidec Chaun Choung Technology Corporation, suffered a ransomware attack on June 22, 2026, that forced it to shut down the targeted server and disconnect it from the network. The BlackField ransomware group claims to have stolen roughly 2 terabytes of data — employee records, financial data, procurement, manufacturing, legal, and IT files — and is demanding $2 million from Nidec directly, while separately offering the company a $5,000-per-day fee to delay publication and offering any third party the option to buy the entire dataset outright for $400,000. Nidec says the subsidiary's network is operationally independent and that the incident has not affected the parent company or other Nidec Group entities; it has not publicly responded to the ransom demands, and it remains unclear whether negotiations are underway.

Why it matters: BlackField's tiered pricing — ransom, delay fee, outright sale — treats extortion as a menu of products rather than a binary pay-or-don't negotiation, which is an increasingly common structure among newer ransomware operators. Nidec's assurance that the subsidiary's network is "independent" is exactly the kind of claim that should be validated through an actual segmentation audit rather than taken at face value, especially for any organization managing overseas subsidiaries on separate infrastructure.

Read more at BleepingComputer

Armored Likho: a newly identified APT uses AI-generated malware to target power grids in three countries

Kaspersky researchers this week identified Armored Likho, a previously undocumented threat group that conducts cyber-espionage against government agencies and power-sector operators in Russia, Kazakhstan, and Brazil. The group reaches targets through spear-phishing lures tailored to each environment — ranging from official government notices to humanitarian aid applications — and deploys obfuscated remote access trojans, a Python-based infostealer called BusySnake Stealer, and a tunneling tool named Go2Tunnel. What sets the campaign apart is the malware's origin: Kaspersky found loader samples containing verbose inline comments, bullet-point emoji, and redundant code blocks — stylistic patterns consistent with large-language-model output and inconsistent with how individual human developers typically write code. Kaspersky assesses that Armored Likho's targeting is driven by access to valuable government and power-sector networks rather than a unified national interest across the three countries.

Why it matters: Human malware authors leave stylistic fingerprints — quirks, habits, reused code — that researchers have long used for attribution. AI-generated code erases those fingerprints because its style reflects training data rather than any individual's habits, meaning attribution work will need to lean more heavily on infrastructure and behavioral indicators going forward, rather than code analysis alone. Threat intel teams should treat this as an early signal to shift detection investment toward TTP and infrastructure tracking now, before AI-authored malware becomes the default rather than the novelty.

Read more at TechTimes

Microsoft ships the largest Patch Tuesday on record — and one of its two actively exploited zero-days scored only "moderate"

On July 14, 2026, Microsoft released its July Patch Tuesday updates, patching more than 600 vulnerabilities in a single release — trackers disagree on the exact count (Microsoft and several vendor summaries put it at 569; The Hacker News, Malwarebytes, and other aggregators tally 621–622 once cumulative and third-party CVEs are folded in), but every count agrees it's the largest Patch Tuesday Microsoft has ever shipped. Two of the flaws were already being exploited as zero-days before the patch landed: CVE-2026-56155, an Active Directory Federation Services elevation-of-privilege bug that lets an attacker gain administrator privileges over the network, and CVE-2026-56164, a SharePoint Server elevation-of-privilege flaw that requires no existing privileges and no user interaction. Microsoft rates the SharePoint bug only "moderate," with a CVSS of 5.3 — despite confirming it's already being exploited in the wild.

Why it matters: A moderate CVSS score didn't stop CVE-2026-56164 from being used in real attacks before Microsoft even shipped a fix — the same lesson this week's Langflow story teaches from the opposite direction: CVSS is a starting point for patch prioritization, not a substitute for checking whether a flaw is already being exploited. Patch both zero-days today regardless of their severity rating, and don't let a "moderate" label push SharePoint or ADFS updates to the bottom of this month's queue.

Read more at The Hacker News

AsyncAPI's own CI pipeline gets hijacked to push credential-stealing malware to 2.9 million weekly npm downloads

At 05:08 UTC on July 14, 2026, an attacker began opening pull requests against the AsyncAPI generator repository, exploiting a GitHub Actions workflow triggered on pull_request_target — a trigger that runs with full repository-secret access even when it checks out code from an external, unreviewed pull request. One of 37 pull requests, PR #2155, contained obfuscated JavaScript that exfiltrated the npm publish token to a paste site, and the attacker used that token to republish five trojanized package versions across four AsyncAPI packages — @asyncapi/generator, @asyncapi/generator-components, @asyncapi/generator-helpers, and both the alpha and stable builds of @asyncapi/specs — which together see roughly 2.9 million weekly downloads. Unlike prior npm worms that hide payloads in postinstall scripts, this campaign embeds the malicious code directly inside first-party source files, so it runs the moment Node.js loads the infected module, then quietly fetches a full credential-stealing remote access trojan from IPFS that targets browser data, SSH keys, npm and GitHub tokens, cloud credentials, and cryptocurrency wallets. Researchers who traced the campaign's self-identified "miasma-train-p1" tasking framework link the payload to the Miasma RAT used in June's Red Hat supply chain incident.

Why it matters: The attacker didn't steal a maintainer's password or phish anyone — they found an unreviewed gap in how the project's CI trusted external pull requests, the exact "pwn request" pattern GitHub has warned about for years. Any team maintaining npm packages should audit every workflow triggered by pull_request_target (or similar) for code paths that touch secrets before human review. Any team consuming the affected AsyncAPI packages at the versions above should treat every credential their build environment can access as compromised and rotate it.

Read more at Socket

Final thoughts

Every story in this edition has an asterisk. Progress can't say what's threatening ShareFile. CISA and independent researchers can't agree on how dangerous the Langflow flaw is. Aflac didn't catch a breach through its account activity — only through a spike in server load. BlackField is selling the same stolen data three different ways depending on who's buying. Armored Likho's malware is engineered specifically to deny researchers the certainty attribution usually depends on. Even Microsoft's own Patch Tuesday numbers don't agree from one tracker to the next, and one of its two exploited zero-days shipped with a CVSS score that undersold it. And AsyncAPI's maintainers didn't lose a password — they lost a CI trigger they didn't know was dangerous.

None of that is an excuse to wait for clarity before acting. Shut down the ShareFile controller. Patch Langflow to 1.9.2 regardless of which CVSS score you believe. Add bulk-access alerting to customer portals. Verify subsidiary network segmentation instead of assuming it. Patch both actively exploited Microsoft zero-days today, regardless of severity tier. And if your build pipeline touches any of the affected AsyncAPI packages, rotate every credential your CI environment can see. The organizations that get hurt the worst this year are consistently the ones that waited for a confirmed number before responding to a credible warning.

Check back next Thursday for the next installment of This Week in Cybersecurity.