Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

A critical zero-day vulnerability (CVE-2026-50656/“RoguePlanet”) in Microsoft Defender’s Malware Protection Engine (mpengine.dll) enables local users, including standard, low-privilege accounts, to escalate privileges to NT AUTHORITY\SYSTEM using a race condition and improper link resolution. Microsoft initially issued a patch (Engine v1.1.26060.3008) in July 2026.

Black Hat 2026 came just weeks after the Five Eyes cybersecurity agencies — CISA, the UK’s NCSC, Australia’s ACSC, Canada’s CCCS, and New Zealand’s NCSC-NZ — issued a joint statement to boards and executives with the blunt message that AI is rewriting the rules of cyber risk, the window between vulnerability and exploitation is shrinking, and organizations have a matter of months to adapt.

Arctic Wolf is tracking an ongoing Microsoft 365 phishing campaign affecting healthcare, education, manufacturing, government, professional services, and other sectors across the United States, Canada, and Europe. In July 2026, we observed hundreds of organizations being targeted by email, with successful intrusions identified across a broad range of environments.

On July 30th, 2026, SolarWinds released fixes for a critical Authentication-Bypass vulnerability in Web Help Desk (WHD) tracked as CVE-2026-28323, and a related high-severity Denial-of-Service vulnerability, tracked as CVE-2026-28299. Although no active exploitation has been observed yet, WHD is commonly internet-facing and the authentication bypass requires no credentials, making it a likely target once exploit code becomes available.

A sophisticated supply chain attack has actively compromised multiple npm packages, including keyv, cacheable, cacheable-request, flat-cache, file-entry-cache, and possible related adapters. Attackers took control of a popular maintainer’s npm account on or before August 4, 2026, and began publishing trojanized package versions containing a preinstall hook (setup.mjs) as a loader.

Avni Wala, Principal Developer – Arctic Wolf Laura Ellis, SVP Artificial Intelligence – Arctic Wolf Merin Eralil, Security Partner Solutions Architect – AWS Tim Sitze, Solutions Architect – AWS AI didn’t just make defenders faster. It made attackers faster too. The moment both sides got access to the same speed, speed stopped being the advantage. With speed no longer separating attackers from defenders, the deciding factor moved somewhere else.

AI has overwhelmingly changed how organizations build and grow. It’s also changed how attackers find and exploit exposures and weaknesses. The window between “exposure exists” and “exposure is exploited” is shrinking, and most security teams already feel it.

AI didn’t just make defenders faster. It made attackers faster too. The moment both sides got access to the same speed, speed stopped being the advantage. With speed no longer separating attackers from defenders, the deciding factor moved somewhere else. Ask a CISO what’s actually kept agentic security out of reach, and it comes down to this: they can’t afford to build it, and even if they could, they’d struggle to trust it. Neither half of that problem outweighs the other.

A ransomware note doesn’t take down a business. The weeks of downtime after it does. That’s the distinction I hear missed most in boardroom conversations about cyber risk. Leaders ask what it costs to stop an attack. The harder question, and the one that actually decides whether a business comes out the other side, is what it takes to keep operating while you recover from one.

Threat actors are actively exploiting two high-severity authentication bypass vulnerabilities, CVE-2026-18556 and CVE-2026-18577, in N-able N-Central, a widely deployed remote monitoring and management (RMM) platform used by MSPs and enterprise IT teams. N-able began investigating anomalous activity on July 31 and released an emergency hotfix (2026.3.1.7) on August 2, 2026, to remediate both vulnerabilities.