TL;DR
Windows targeted by malvertising campaign assembling malware in-browser; GitLab RCE exploit published; Cl0p affiliates exploiting unauthenticated PTC manufacturing flaws for data extortion.
Executive Summary
- A malvertising campaign dubbed SourTrade is fragmenting malicious executables and using legitimate Bun runtime to reconstruct them in-browser, evading traditional URL-based detection on Windows systems.
- Researchers published working exploit code for an authenticated GitLab RCE on July 24, affecting self-managed instances running 18.11.3 and prior versions; patch available since June 10.
- Cl0p-linked threat actors are chaining pre-authentication information disclosure flaws in internet-exposed PTC Windchill and FlexPLM to achieve unauthenticated remote code execution as part of a data extortion campaign.
- GitHub and PyPI have deployed time-based defenses in Dependabot to limit supply-chain attack impact.
- Vatican's official prayer app exposed numerous+ users' personally identifiable information via a porous API endpoint.
Top Threats Today
1. SourTrade Malvertising – Browser-Based Malware Assembly on Windows
Severity: HIGH Affected: technology
A malvertising operation dubbed SourTrade is using a novel technique to evade traditional endpoint defenses on Windows: fragmenting executable payloads and instructing compromised browsers to assemble the final malicious binary in-memory using a legitimate Bun runtime [1]. Rather than serving a complete malware file from a fixed URL, the campaign delivers code fragments through fake Solana, Luno, and TradingView webpages containing malicious JavaScript [2]. Confiant reported the technique on July 23, 2026 [1].
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Block advertisement networks and domains associated with the SourTrade campaign (IoCs available from Confiant reports).
- Deploy endpoint detection rules tuned to memory-based executable assembly and suspicious Bun runtime usage patterns.
- Educate users on avoiding click-through from unsolicited online advertisements, particularly financial and trading-related content.
- Monitor browser process memory for anomalous code injection and runtime compilation activity.
2. GitLab RCE Exploit Published – Unauthenticated Escalation via Git Command Injection
Severity: HIGH Affected: technology
Security researchers at depthfirst published working exploit code on July 24, 2026 for a GitLab remote code execution flaw that allows authenticated users to run ⚠ arbitrary commands as the git user on self-managed GitLab instances [1]. The vulnerability affects GitLab 18.11.3 and earlier versions; a patch has been available since June 10 [1]. Any user with project push access can exploit this to escalate privileges within the Git repository environment [1].
Sources:[1] The Hacker News
Recommended Action
- Verify all self-managed GitLab instances are updated to 18.11.3 or later immediately.
- Review git repository access logs for suspicious command execution or privilege escalation activity post-patch.
- Restrict Git SSH and HTTP access to trusted networks if not already implemented.
- Monitor for unauthorized commits or repository metadata changes on affected instances.
3. Cl0p Affiliates Exploiting PTC Manufacturing Flaws for Data Extortion
Severity: HIGH Affected: manufacturing
Threat actors linked to the Cl0p ransomware campaign (also known as Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) are actively exploiting pre-authentication information disclosure flaws in internet-exposed PTC Windchill and FlexPLM product lifecycle management systems [1]. Attackers chain these flaws to achieve unauthenticated remote code execution as part of a new data extortion campaign [1]. The attacks target organizations that have exposed these systems directly to the internet without network segmentation or authentication controls [1].
Sources:[1] The Hacker News
Recommended Action
- Immediately audit network exposure of PTC Windchill and FlexPLM systems; any internet-facing instances should be moved behind firewalls or VPN access controls.
- Apply PTC security updates for pre-authentication information disclosure flaws in these products.
- Enable authentication and access controls on all PTC product deployments; disable unauthenticated API endpoints.
- Monitor for unauthorized data access, extraction, or exfiltration from these systems; review logs for pre-authentication reconnaissance activity.
- Engage incident response and threat intelligence teams to assess whether your organization appears in Cl0p extortion demands.
4. Vatican Prayer App Leaks 700K+ User PII via Unprotected API
Severity: HIGH Affected: technology
The Vatican's official prayer application exposed personal information for numerous+ users through a porous API endpoint ⚠[1]. The unprotected endpoint exposed names, email addresses, country, and account status information, which could be easily accessed by anyone with a browser [1].
Sources:[1] Dark Reading
Recommended Action
- If you or your organization uses this application, change your password and monitor your email and contact information for phishing or social engineering attempts.
- Organizations with similar mobile or web APIs should audit endpoint authentication and implement proper access controls.
- Use API rate limiting, authentication tokens, and principle-of-least-privilege data exposure to protect user PII.
5. Microsoft Azure Automation Default Configuration Enables Cross-Tenant Identity Takeover
Severity: HIGH Affected: technology
Microsoft identified a chain of code flaws in Azure Automation that, combined with a public-by-default configuration setting, could allow attackers to seize another tenant's identity and gain unauthorized access to credentials, data, and cloud workloads [1]. Microsoft has issued a patch addressing the configuration and underlying code vulnerabilities [1].
Sources:[1] Dark Reading
Recommended Action
- Review Azure Automation account settings for any public-by-default configurations and change to private or restricted access.
- Apply Microsoft's latest Azure Automation security patches immediately.
- Audit Azure Automation runbook permissions and identity delegation policies to ensure least-privilege access.
- Enable multi-factor authentication and Conditional Access policies for Azure Automation accounts.
Ongoing Coverage
- Fastjson RCE (CVE-2026-16723): BleepingComputer reports attackers are exploiting a critical unauthenticated remote code execution flaw in Alibaba's Fastjson JSON library for Java. ThreatBook and Imperva have confirmed active attacks. No patched version is available [2]. See earlier coverage.
- GitHub / Supply-Chain Defenses: GitHub and PyPI have added time-based mechanisms in the Dependabot dependency management tool to reduce the window of exposure to supply-chain attacks [6].
- ClickFix on Steam: BleepingComputer reports malicious posts on Steam forums using ClickFix social engineering attacks to distribute XMRig cryptominers to gamers [7].
- ShinyHunters Data Leaks Fueling Sextortion: Threat actors are leveraging email addresses from ShinyHunters data breaches to send sextortion emails demanding $2,000 in Bitcoin [9].
Today’s Action Checklist
- ☐ URGENT: Audit PTC Windchill and FlexPLM systems for internet exposure; move to restricted access or behind firewalls.
- ☐ URGENT: Verify all self-managed GitLab instances are patched to version 18.11.3 or later; review git command execution logs.
- ☐ Patch Microsoft Azure Automation and review default public-access configuration; audit cross-tenant identity delegation policies.
- ☐ Deploy endpoint detection for in-memory malware assembly and Bun runtime abuse; review browser traffic logs for SourTrade IoCs.
- ☐ Audit internal APIs and web services for unprotected or public-by-default endpoints exposing PII; implement authentication and rate limiting.