Threat Brief — 2026-07-20 — Core platforms under active fire

Executive summary: Three high-impact vulnerabilities in widely deployed platforms demand immediate attention: a critical ServiceNow RCE is now exploited in the wild, a WordPress core SQL injection threatens millions of default-configured sites, and an OpenSSL DoS flaw allegedly concealed by maintainers can crash servers with 11 bytes. Elsewhere, extortion actors forced Coca-Cola to halt all US Fairlife dairy production, and Romania's national cadastre agency went down to a cyberattack that froze mortgage processing nationwide. Operators should prioritise patching or mitigating ServiceNow and WordPress immediately.

Top items

• ServiceNow CVE-2026-6875 — critical RCE now exploited in the wild. Active exploitation confirmed by threat-intel firm Defused. The vulnerability resides in the ServiceNow AI Platform and enables unauthenticated code execution. Any organisation running a vulnerable ServiceNow instance should treat this as an emergency. — bleepingcomputer

• WordPress core SQL injection via batch REST requests. A flaw in WordPress's bundled REST API batch-request handling can be turned into a SQL injection that yields full server control — even on default installations. Given WordPress's enormous deployment base, this is a mass-exploitation candidate. Distinct from the wp2shell RCE reported 2026-07-18. — securitylab-ru

• OpenSSL "HollowByte" — 11-byte unauthenticated DoS. A resource-exhaustion vulnerability in OpenSSL allows a remote, unauthenticated attacker to crash a server with as little as 11 bytes. Maintainers reportedly attempted to downplay the issue. Any service terminating TLS with a vulnerable OpenSSL build is affected. — securitylab-ru

• Coca-Cola halts all US Fairlife dairy production after extortion attack. Attackers gained access to part of the Fairlife infrastructure, forcing a complete production stoppage across US facilities. Demonstrates extortion actors' willingness to hit OT-adjacent manufacturing environments. — xakep

• Romania national cadastre cyberattack freezes mortgages nationwide. The National Agency of Cadastre and Land Publicity confirmed a cyberattack after days of outages, reportedly crippling mortgage and property transactions across the entire country. Highlights fragility of centralised government property systems. — securitylab-ru

• Microsoft WSUS suffering large-scale sync failure — Windows servers stuck without updates. Microsoft acknowledged the outage; synchronisation takes hours and some systems lose connectivity entirely due to overloaded metadata. At a time when critical patches are dropping, this creates a dangerous patching gap for WSUS-dependent estates. — securitylab-ru

• Ostium DEX drained of $18M via infrastructure manipulation. An attacker exploited the decentralised exchange's own infrastructure to drain liquidity — a novel scheme described as "looking into the future." Reinforces that DeFi protocol composability remains a prime attack surface. — securitylab-ru

• Large batch of Linux kernel CVEs published via MSRC. Microsoft published details for roughly 20 kernel vulnerabilities spanning ksmbd (CVE-2026-53390 OOB read, CVE-2026-53383 session validation), AppArmor (CVE-2026-63827 UAF, CVE-2026-63828 TCP fast-open mediation), f2fs, gfs2, exfat, 9p, virtiofs, TIPC, and NFSD. Several are use-after-free or out-of-bounds-read issues in filesystem and network subsystems. Enterprises running Linux on Azure or maintaining their own kernels should prioritise ksmbd and AppArmor fixes. — MSRC

• rust-openssl CVE-2026-45784 — out-of-bounds write in AES-KW-PAD cipher operations. CipherCtxRef::cipher_update_inplace can write out of bounds when handling AES-KW-PAD ciphers. Rust projects depending on the openssl crate for key-wrapping functionality should audit usage. — MSRC

Themes

• Attacking the foundation layer: ServiceNow, WordPress core, and OpenSSL are ubiquitous platform dependencies. When these go critical-and-exploited, the blast radius spans virtually every industry. Patch lead times for lower-tier dependents will be long.
• Extortion moves upstream into production: Coca-Cola's Fairlife shutdown shows extortion actors are increasingly willing (or able) to halt physical manufacturing, not just encrypt data.
• Government single-points-of-failure exposed: Romania's nationwide mortgage freeze illustrates how centralised property-registration systems can become national-scale single points of failure.