Weekly CTI Roundup — Week of July 26, 2026

TLP: CLEAR

Week of July 20–26, 2026 | Author: [Owen Finn / Security Analyst/Threat Researcher]

A weekly pulse on the vulnerabilities, actors, malware, and emerging risks defenders should have on their radar. This week showed a clear pattern: attackers are leaning heavily on cloud-native C2, AI-assisted social engineering, and internet-exposed enterprise software as entry points. Defenders need to treat SaaS telemetry and identify signals as first-class detection sources

TL;DR

● CVE of the Week: CVE-2026–50522 — an unauthenticated deserialization RCE in on-prem SharePoint, and the wave of scanning around it looks a lot like the early stage of exploitation, not just curiosity.

● Threat Actor/Campaign: Iran-linked actors are inside US water and energy PLCs, and in at least one case they didn’t just look around — they rewrote ladder logic to disable safety shutdowns.

● Malware/Tooling: HollowGraph turns a compromised Microsoft 365 calendar into a C2 dead-drop, hiding tasking and exfil inside calendar invites dated in the year 2050.

● Identity/Cloud: Cl0p-linked actors are chaining two flaws in PTC’s Windchill and FlexPLM to get unauthenticated RCE on internet-facing PLM systems, then going straight to extortion.

● AI Threat: APT42 is using generative AI to research targets, build personas, and write code — and the result is phishing that doesn’t look like phishing anymore.

Bottom line: Patch your SharePoint farms this week, and if you’re running OT, manufacturing PLM, or M365 as core infrastructure, assume the attack surface conversation now includes “internet-exposed enterprise software” as much as it includes endpoints.

1. Top CVE of the Week — CVE-2026–50522 (SharePoint Unauthenticated RCE)

CVSS Score: 9.8 | Exploitation Status: Not officially confirmed, but honeypot telemetry suggests otherwise | Confidence: Medium (active exploitation), High (severity/impact)

Affected Products: SharePoint Enterprise Server 2016 (< 16.0.5561.1001), SharePoint Server 2019 (< 16.0.10417.20175), SharePoint Server Subscription Edition (< 16.0.19725.20434) — on-prem, x64 only

Description

This one’s a deserialization bug, which by now is basically its own genre in SharePoint’s 2026 patch history. A newly disclosed vulnerability, tracked as CVE-2026–50522, allows unauthenticated attackers to remotely execute code on on-premises Microsoft SharePoint servers. No login required, no user interaction — just a crafted serialized object sent to a vulnerable endpoint, and you’ve got code execution in the context of the SharePoint server itself.

What makes this one worth flagging specifically is the confusion it’s created. The same July patch cycle fixed a second bug, CVE-2026–58644, which needs Site Owner permissions before it can be triggered. Microsoft has confirmed CVE-2026–58644 is being actively exploited and it’s already in CISA’s KEV catalog — but CVE-2026–50522, the fully unauthenticated one, isn’t officially confirmed as under attack yet. Here’s the part that should keep you up at night: researchers watching honeypot traffic have picked up an undocumented .NET deserialization payload hitting SharePoint sign-in endpoints with zero authentication material attached. That fingerprint lines up much better with CVE-2026–50522 than with the Site Owner–gated bug, which suggests analysts may currently be under-attributing in-the-wild activity to the wrong CVE.

Add to that: independent tracking from Check Point and Censys puts north of 10,000 internet-facing SharePoint servers still exposed globally, and the EPSS score sits around 19.7% — high enough that I wouldn’t bet on this staying quiet for long.

Why It Matters

Full server takeover, web shell deployment, theft of application secrets, and a foothold for lateral movement — all without needing a single valid credential. If you’ve got SharePoint on-prem facing the internet in any capacity, this is a “patch this week, not this quarter” situation.

MITRE ATT&CK Mapping

Tactic Technique ID

• Initial Access Exploit Public-Facing Application T1190
• Execution Deserialization of Untrusted Data (related) T1055
• Persistence Web Shell T1505.003
• Credential Access Unsecured Credentials (app secrets) T1552

Detection — Sigma Rule

title: Potential SharePoint Deserialization Exploitation - CVE-2026-50522
id: 8e2f1c4a-6d3b-4e77-9a1f-2b7c5d9e0a12
status: experimental
description: Detects unauthenticated requests to SharePoint endpoints consistent
  with CVE-2026-50522 exploitation attempts
references:
    - https://cybersecuritynews.com/sharepoint-rce-exploited-in-the-wild/
author: Owen Finn
date: 2026/07/26
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026-50522
logsource:
    category: webserver
    product: sharepoint
detection:
    selection:
        cs-uri-stem|contains:
            - '/_layouts/'
            - '/_vti_bin/'
        c-ip|exists: true
    unauth_indicator:
        sc-status: 200
        cs-method: POST
    condition: selection and unauth_indicator
falsepositives:
    - Legitimate authenticated automation (verify auth headers/session tokens)
level: high

Detection — KQL (Sentinel / IIS logs)

// Hunt for unauthenticated POSTs to SharePoint sign-in/layouts endpoints
W3CIISLog
| where TimeGenerated > ago(7d)
| where csUriStem has_any ("/_layouts/", "/_vti_bin/", "/_forms/default.aspx")
| where csMethod == "POST"
| where isempty(csUsername) or csUsername == "-"
| summarize RequestCount = count(), Hosts = make_set(csHost) by cIP, bin(TimeGenerated, 1h)
| where RequestCount > 3
| order by RequestCount desc

Mitigation / Recommendations

• Apply Microsoft’s July 2026 cumulative update across every SharePoint farm member
• Restrict internet exposure of on-prem SharePoint where at all feasible
• Retire unsupported SharePoint deployments that can’t take the fix
• Hunt for anomalous unauthenticated traffic to sign-in/layouts endpoints
• Check CISA’s KEV catalog for the paired CVE-2026–58644 entry under BOD requirements

Source: Cyber Security News — Critical SharePoint Remote Code Execution Vulnerability Actively Exploited in the Wild (cybersecuritynews.com/sharepoint-rce-exploited-in-the-wild)

2. Threat Actor / Campaign Update — Iran-Linked Actors in US Water & Energy PLCs

Attribution Confidence: Medium (per joint US government advisory) | Motivation: Disruption/destructive | Target Sectors: Water & Wastewater, Energy, Government Services (US)

Campaign Summary

This is the story that should worry critical infrastructure defenders more than any CVE this week. CISA, the FBI, NSA, and the Department of Energy updated an advisory warning that Iranian-affiliated actors are targeting internet-connected operational technology devices, including programmable logic controllers, and that these actions have disrupted PLCs across several US critical infrastructure sectors through malicious project file changes and manipulation of HMI/SCADA displays, causing operational disruption and financial loss.

This isn’t a new campaign so much as an expanding one. Back in April, the same agencies had flagged Iranian actors specifically going after Rockwell Automation controllers — the updated advisory widens that to include Schneider Electric and Siemens equipment too. The access pattern is straightforward: attackers reach exposed devices over OT ports (44818, 2222, 102, 502) and modems via SSH, then use vendor engineering tools like Studio 5000, EcoStruxure Control Expert, and TIA Portal to pull down PLC project files. From there, they’re not just looking — they modify or delete project logic including Add-On Instructions, manipulate what’s shown on HMI/SCADA displays, and disable shutdown and alarm functions so systems can drift into unsafe states without operators getting any warning.

The most concrete example in the advisory is genuinely unsettling. At one US victim, the FBI observed the actors download a malicious project file to a PLC that retained the original ladder logic for downstream function but added logic overriding the instruction sets responsible for maintaining safe operating parameters — since at least March 2026, this Iranian-affiliated group has been disrupting PLC function across Government Services, Water and Wastewater, and Energy sector organizations, some of which experienced real operational disruption and financial loss.

Worth keeping in context: this sits alongside a broader pattern of Iran-linked activity since the February conflict escalation — everything from the Handala group’s device-wiping at Stryker to a disputed claim against a California water utility. Some of it’s espionage, some of it’s destructive, and this PLC campaign looks like it’s aiming squarely at the second category.

TTPs (MITRE ATT&CK)

Tactic Technique ID

• Initial Access Exploit Public-Facing Application (internet-exposed PLCs) T1190
• Initial Access External Remote Services (SSH on OT modems) T1133
• Collection Automated Collection (PLC project file exfiltration) T1119
• Impact Data Manipulation (project logic / AOI tampering) T1565
• Impact Manipulation of Control (ATT&CK for ICS) T0855 / T0838

Detection — Sigma Rule

title: Suspicious OT Port Access Consistent with Iranian PLC Targeting Advisory
id: 4a7d2e91-1c8b-4f3a-9e6d-7c1a3b5f8d02
status: experimental
description: Detects inbound connections to known ICS/OT ports from external
  or unexpected sources
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a
author: Owen Finn
date: 2026/07/26
tags:
    - attack.initial-access
    - attack.t1190
    - attack.impact
logsource:
    category: firewall
    product: network
detection:
    selection:
        dst_port:
            - 44818
            - 2222
            - 102
            - 502
        src_zone: 'external'
    condition: selection
falsepositives:
    - Legitimate vendor remote support (verify against approved maintenance windows)
level: high

Detection — KQL (Firewall logs via Sentinel)

// Flag external traffic to ICS/OT ports (Rockwell/Schneider/Siemens targeting)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (44818, 2222, 102, 502)
| where SourceZone == "external" or isnotempty(SourceIP)
| where not(ipv4_is_private(SourceIP))
| summarize ConnectionCount = count(), Destinations = make_set(DestinationIP)
    by SourceIP, DestinationPort, bin(TimeGenerated, 1h)
| where ConnectionCount > 1
| order by ConnectionCount desc

Analyst Notes

The technique that stands out here isn’t the initial access — internet-exposed OT has been a known problem for years — it’s the AOI tampering. Modifying instruction sets that govern safety shutdowns while preserving the visible/downstream logic is a level of ICS-specific tradecraft that suggests real engineering-software familiarity, not just IT pivoting into OT. If you operate any of the named vendor equipment and it has any internet-facing path (even indirect, via a modem or jump box), this is worth an out-of-band check this week, not at the next maintenance window.

Recommendations

• Remove PLCs from direct internet access — use secure gateways/firewalls, no exceptions
• Rockwell users specifically: set controllers to Run mode per CISA guidance
• Monitor OT ports (44818, 2222, 102, 502) and SSH (22) for external-originating connections
• Baseline and alert on unexpected project file downloads/uploads via engineering software
• If you suspect compromise, contact CISA/FBI and the equipment vendor directly

Sources: Security Affairs (securityaffairs.com/195991) | CISA Advisory AA26–097A

3. Malware / Tooling Update — HollowGraph Abuses M365 Calendar for C2

Type: Modular C2 implant / dead-drop resolver | First Seen: June 3, 2026 | Associated Actors: Likely Cavern Manticore (Iran-nexus); low-confidence overlap with Lyceum/Hexane

Description

This is one of the more creative dead-drop mechanisms I’ve seen written up this year. HollowGraph is malware that abuses the Microsoft 365 calendar for C&C communication, likely part of a larger toolkit and linked to Cavern Manticore, an Iran-nexus threat actor Check Point detailed earlier this month — it relies on the Microsoft Graph API and a compromised 365 account in Israel to hide its C&C traffic inside legitimate-looking traffic.

The mechanics are genuinely clever. Using the Graph API, it treats the compromised mailbox’s calendar as a two-way dead-drop: operators plant tasking as calendar events, and the implant exfiltrates stolen files by creating its own events with encrypted data attached. Payloads are attached to events as files, and the events are dated far in the future — May 13, 2050 — specifically to avoid alerting the mailbox owner, with hybrid RSA and AES encryption securing the data. There’s also a fallback channel: HollowGraph retains DNS tunneling as a secondary channel to refresh its configuration and Entra ID credentials.

Get Owen F’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Group-IB identified 12 victims, three of which were actively communicating with attacker infrastructure at time of writing, and the pattern of an Israeli mailbox used for exfiltration alongside samples uploaded from Israel points to a focused interest in Israeli entities rather than opportunistic spraying. Command-wise it’s minimal but effective — HollowGraph never calls out to attacker infrastructure directly for delivery; it supports only ‘send’ (generate calendar appointments with attached files) and ‘get’ (search for operator-planted appointments and pull new instructions) — and its hardcoded configuration, including tenant ID, client ID/secret, target mailbox, C&C domain, and RSA keys, gets written to disk as logAzure.txt.

TTPs (MITRE ATT&CK)

Tactic Technique ID

• Command and Control Web Service (legitimate M365/Graph API abuse) T1102
• Command and Control Dead Drop Resolver T1102.001
• Command and Control DNS (fallback config/credential refresh) T1071.004
• Defense Evasion Use of Valid Accounts (compromised 365 tenant) T1078.004
• Exfiltration Exfiltration Over C2 Channel (calendar events) T1041

Detection — Sigma Rule

title: HollowGraph - Suspicious Calendar Events with Encrypted Attachments
id: 6b3e9f12-2a4c-4d81-b7f5-9e2a1c6d4b03
status: experimental
description: Detects Graph API calendar events with far-future dates and
  attached binary payloads, consistent with HollowGraph C2 tradecraft
references:
    - https://www.group-ib.com/blog/hollowgraph-microsoft-365/
author: Owen Finn
date: 2026/07/26
tags:
    - attack.command-and-control
    - attack.t1102.001
logsource:
    product: m365
    service: graph_api
detection:
    selection:
        EventType: 'CalendarEventCreated'
        EventStartDate|re: '^2026'
    attachment:
        HasAttachment: true
    condition: selection and attachment
falsepositives:
    - Legitimate test/placeholder events with far-future dates (rare)
level: high

Detection — KQL (M365 / Entra ID via Sentinel)

// Detect calendar events dated implausibly far in the future with attachments
OfficeActivity
| where TimeGenerated > ago(7d)
| where Operation in ("New-CalendarEvent", "UpdateCalendarEvent")
| extend EventStart = todatetime(parse_json(Parameters)["StartTime"])
| where EventStart > datetime(2040-01-01)
| project TimeGenerated, UserId, ClientIP, Operation, EventStart
| order by TimeGenerated desc

Recommendations

• Hunt for calendar events dated more than a few years in the future tenant-wide
• Review Graph API app registrations/OAuth grants for anomalous scopes (Calendars.ReadWrite, Mail.Read)
• Look for the file logAzure.txt on endpoints as a potential HollowGraph config artifact
• Monitor for DNS tunneling patterns from hosts with M365 client access
• If in Israel or adjacent verticals with Iran-nexus targeting history, prioritize this hunt

Sources: SecurityWeek (securityweek.com/new-hollowgraph-malware…) | Group-IB Research

4. Identity / Cloud Threat Trend — Cl0p Affiliates Chaining Flaws in Internet-Exposed PLM Systems

Trend: Extortion actors chaining pre-auth info disclosure + RCE against internet-facing enterprise apps (PTC Windchill/FlexPLM) | Platforms: PTC Windchill, FlexPLM

Description

Cl0p doesn’t really do smash-and-grab — they find one under-patched enterprise application category and work it methodically, and this week it’s PLM software. Threat actors linked to the Cl0p ransomware campaign — also tracked as Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest — are exploiting flaws in internet-exposed PTC Windchill and FlexPLM deployments as part of a new data extortion campaign.

The chain itself is the interesting part technically: attackers combine a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet, enabling fully unauthenticated remote code execution and deployment of hex-named JSP web shells under /Windchill/login/. Once they’ve got a foothold, they conduct file system enumeration, stage engineering and design data, and move to double extortion. Manufacturing, automotive, aerospace, and retail sectors are the named targets — which tracks, since PLM systems are where a lot of proprietary design data lives.

The suspected vulnerability being exploited is CVE-2026–12569 (CVSS 9.3), which CISA added to its KEV catalog late last month, and it’s chained with a separate pre-auth info-disclosure defect in the FlexPLM WSDL endpoint (CVSS 7.5) to make the whole thing exploitable without any credentials at all. PTC itself has been vocal about it — the vendor confirmed “continued reports of heightened threat activity” with attackers deploying JSP web shells against vulnerable systems.

I’m filing this under identity/cloud rather than pure vulnerability news because of how the extortion plays out afterward: the extortion emails appear to originate from previously compromised accounts and get sent to hundreds of users within an impacted organization — meaning account compromise and internal trust abuse become part of the blast radius even though the initial entry was a straight RCE chain. ReliaQuest has echoed the same tradecraft assessment: the observed behavior looks consistent with past Cl0p enterprise-application campaigns (Accellion, GoAnywhere, MOVEit, Oracle EBS) even though attribution to Cl0p specifically hasn’t been formally confirmed yet.

TTPs (MITRE ATT&CK)

Tactic Technique ID

• Initial Access Exploit Public-Facing Application T1190
• Discovery File and Directory Discovery T1083
• Persistence Web Shell T1505.003
• Collection Data Staged T1074
• Exfiltration Exfiltration Over Web Service T1567
• Impact Financial Theft / Extortion via compromised accounts T1657

Indicators of Compromise

Type Value Context

• IP 216.152.148[.]54 Associated exploitation infrastructure
• IP 216.152.151[.]204 Associated exploitation infrastructure
• IP 104.243.35[.]63 Associated exploitation infrastructure
• IP 5.180.41[.]35 Associated exploitation infrastructure

Detection — Sigma Rule

title: PTC Windchill/FlexPLM - Suspected Cl0p Exploitation Chain
id: 9c4a7e15-3b6d-4f92-8a1c-5d7e0b3f9c14
status: experimental
description: Detects requests to FlexPLM WSDL endpoints followed by Windchill
  login servlet activity, consistent with the reported unauthenticated RCE chain
references:
    - https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html
author: Owen Finn
date: 2026/07/26
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    category: webserver
    product: windchill
detection:
    wsdl_probe:
        cs-uri-stem|contains: '/FlexPLM/services'
    webshell_deploy:
        cs-uri-stem|re: '/Windchill/login/[a-f0-9]{8,}\.jsp'
    condition: wsdl_probe or webshell_deploy
falsepositives:
    - Legitimate SOAP client integrations against FlexPLM (verify source/auth)
level: critical

Detection — KQL (Web server / WAF logs)

// Detect requests to Windchill login servlet paths (JSP web shell deployment)
W3CIISLog
| where TimeGenerated > ago(7d)
| where csUriStem has "/Windchill/login/"
| where csUriStem matches regex @"/[a-f0-9]{8,}\.jsp$"
| project TimeGenerated, cIP, csUriStem, csMethod, scStatus
| order by TimeGenerated desc

Recommendations

• Patch PTC Windchill and FlexPLM against CVE-2026–12569 immediately — it’s KEV-listed
• Hunt for hex-named .jsp files under /Windchill/login/
• Block or monitor the four IPs above at your perimeter
• Force credential resets/session revocation for accounts that sent unexpected bulk internal emails
• Remove FlexPLM/Windchill from direct internet exposure where feasible

Sources: The Hacker News (thehackernews.com/2026/07/cl0p-affiliates…) | Ransom-ISAC/eCrime.ch/DEFUSED joint advisory

5. AI-Related Threat Trend — APT42’s AI-Assisted Phishing + TAMECAT

Trend: State-linked actor using generative AI across the full social engineering lifecycle — research, persona-building, translation, and code — not just to write phishing emails.

Description

This is the one I keep coming back to this week, because it’s less about a flashy new AI capability and more about AI quietly making an already-good phishing operation harder to catch. APT42, an Iran-linked cyber espionage group, has expanded its phishing operations with AI-assisted research, convincing personas, and a more resilient version of its TAMECAT malware, targeting senior government and defense officials, policy experts, and in some cases family members connected to high-value individuals.

What stands out is the patience. Rather than relying on high email volume, the group builds trust through realistic invitations, extended conversations, and messages sent across personal email, corporate accounts, and WhatsApp, and per DarkAtlas’s research, generative AI is used to research targets, create believable identities, translate messages, develop code, and improve social-engineering lures. Operators reportedly spent days or weeks building rapport before ever sending a malicious link — which is exactly the kind of thing that defeats “look for bad grammar” style user training.

The delivery chain itself abuses a familiar Windows feature in a fairly elegant way: victims are directed to a page that triggers the Windows search-ms handler and asks them to open File Explorer, which then connects to an attacker-controlled WebDAV share where a shortcut file disguised as a PDF waits for execution — the shortcut launches Command Prompt, downloads a batch file, and uses PowerShell to retrieve further components.

TAMECAT itself has grown into a fairly full-featured tool. It can collect browser cookies and credentials, search for files, capture screenshots, access Outlook mailbox data, run commands, and exfiltrate packaged data through multiple channels including HTTPS, Discord, and Telegram. That cookie-theft capability matters more than it might sound — it creates a serious identity risk because a password reset alone may not remove attacker access, so organizations need to revoke active sessions and refresh tokens, review browser-stored credentials, and investigate suspicious sign-ins after any suspected infection. APT42 also runs parallel credential-harvesting pages that imitate cloud document services like OneDrive, using a benign hosted PDF first to build trust before a later link redirects to the actual credential-harvesting page.

Relevant TTPs / Mapping

Framework Technique ID/Reference

• MITRE ATLAS LLM-Assisted Social Engineering (research/personas) AML.T0048 (analogous)
• MITRE ATT&CK Phishing via Multiple Channels T1566
• MITRE ATT&CK User Execution: Malicious File (LNK) T1204.002
• MITRE ATT&CK Signed Binary Proxy Execution / WebDAV abuse T1218
• MITRE ATT&CK Steal Web Session Cookie T1539
• MITRE ATT&CK Exfiltration Over Alt. Protocol (Discord/Telegram) T1048

Detection / Defensive Angle

Endpoint monitoring should focus on the connected sequence: a browser opening search-ms, rundll32.exe using davclnt.dll to create WebDAV access, a remote LNK file launching cmd.exe, and curl or PowerShell retrieving content — that chain is a much stronger signal than any single hash or domain viewed alone.

Detection — Sigma Rule

title: APT42 TAMECAT - search-ms/WebDAV LNK Delivery Chain
id: 2d8f6a13-5c9e-4b71-8d3a-6f1e9c4b7a25
status: experimental
description: Detects the search-ms handler to WebDAV to LNK to cmd.exe delivery
  chain associated with APT42/TAMECAT
references:
    - https://darkatlas.io/blog/apt42-ai-assisted-phishing-tamecat-analysis
author: Owen Finn
date: 2026/07/26
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    webdav_access:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains: 'davclnt.dll'
    lnk_execution:
        ParentImage|endswith: '\explorer.exe'
        Image|endswith: '\cmd.exe'
        CommandLine|contains:
            - '.pdf.lnk'
            - '\\\\'
    condition: webdav_access or lnk_execution
falsepositives:
    - Legitimate internal WebDAV file share usage (verify destination is external)
level: high

Detection — KQL (Defender for Endpoint)

// Detect TAMECAT-style chain: search-ms -> WebDAV -> LNK -> cmd.exe -> PowerShell
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (FileName =~ "rundll32.exe" and ProcessCommandLine has "davclnt.dll")
    or (FileName =~ "cmd.exe" and InitiatingProcessFileName =~ "explorer.exe"
        and ProcessCommandLine has ".lnk")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
    InitiatingProcessFileName
| order by Timestamp desc

Analyst Notes

The AI angle here isn’t a novel exploitation technique — it’s an efficiency and believability multiplier on tradecraft APT42 already had. That’s honestly the more important takeaway than any single IOC: your phishing detection program needs to stop leaning on “does this look poorly written” as a signal, because that signal is dying fast. The stronger controls are the boring ones — phishing-resistant MFA (FIDO2/passkeys) for high-risk users, disabling legacy auth, and watching for session-token reuse and new OAuth grants after any suspicious contact, regardless of how convincing the conversation leading up to it was.

Sources: Cyber Security News (cybersecuritynews.com/apt42-uses-ai-assisted-phishing-and-tamecat-malware) | DarkAtlas Research

Key Takeaways

1. Patch SharePoint now — the confusion between CVE-2026–50522 and CVE-2026–58644 is exactly the kind of gap attackers exploit while defenders argue about which CVE they’re actually seeing.

2. If you touch OT/ICS in water or energy, this week’s advisory is not routine — AOI tampering that silently disables safety shutdowns is a different threat model than typical espionage access.

3. Legitimate cloud services (M365 calendar, Graph API, WebDAV, OneDrive lookalikes) keep showing up as the delivery and C2 mechanism of choice across unrelated campaigns this week — build detections around that pattern, not any single IOC.

4. Enterprise PLM/engineering software is now squarely in ransomware-affiliate crosshairs alongside the usual MFT suspects — inventory what’s internet-facing beyond the obvious targets.

5. AI-assisted social engineering is here in production use by state actors, and it’s changing the “spot the phish” playbook — invest in behavioral/session-based detections, not just email content filtering.

References

1. Cyber Security News — Critical SharePoint Remote Code Execution Vulnerability Actively Exploited in the Wild (cybersecuritynews.com/sharepoint-rce-exploited-in-the-wild)

2. Security Affairs — Iran-Linked Actors Breach Are Targeting US Water and Energy Control Systems (securityaffairs.com/195991)

3. SecurityWeek — New HollowGraph Malware Abuses Microsoft 365 Calendar for C&C Communication (securityweek.com/new-hollowgraph-malware…)

4. The Hacker News — Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE (thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed)

5. Cyber Security News — APT42 Uses AI-Assisted Phishing and TAMECAT Malware to Target Government and Defense Officials (cybersecuritynews.com/apt42-uses-ai-assisted-phishing-and-tamecat-malware)

Disclaimer: Indicators and detection rules are provided for hunting and detection purposes only — validate and test in a non-production environment before deployment. Confidence levels reflect the author’s assessment based on available open-source reporting.