Morning Review in IT Security — July 11, 2026

The cybersecurity landscape continues to face mounting pressures from multiple vectors as July unfolds. Today's briefing covers critical vulnerabilities spanning bootloader firmware, cryptocurrency supply chains, containerized services, and active exploitation campaigns, alongside significant law enforcement actions against ransomware operators and ongoing investigations into major telecommunications breaches.

New U-Boot Flaws Could Enable Stealthy Firmware Attacks

Six vulnerabilities have been discovered in U-Boot, the widely deployed open-source bootloader used across embedded devices and IoT systems. These flaws create a pathway for attackers to execute malicious code during the device boot process, potentially establishing persistent firmware-level compromises that circumvent standard security protections. The ability to inject code at this pre-operating system stage represents a particularly dangerous attack vector, as such compromises can survive operating system reinstallation and traditional remediation efforts.

Source: New U-Boot flaws could enable stealthy firmware attacks

Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages

Threat actors have successfully compromised the GitHub repository for Injective Labs SDK, a critical component in the cryptocurrency ecosystem. The attackers leveraged this access to publish a malicious package version (@injectivelabs/sdk-ts@1.20.21) to the npm registry, embedding wallet-key-stealing functionality disguised as telemetry code. This supply chain attack specifically targeted the exfiltration of private keys and mnemonic seed phrases from cryptocurrency wallets, representing a sophisticated effort to compromise users at the dependency level.

Source: Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages

Hackers Exploit Critical Auth Bypass in Gitea Docker Image

Active exploitation is underway against a critical authentication bypass vulnerability in the official Docker image for Gitea, a self-hosted Git service platform. The flaw enables attackers to impersonate any user on affected instances, including administrative accounts, creating immediate risk for organizations relying on Gitea for version control and repository management. CVE-2026-20896 represents a zero-day level threat due to its severity and the widespread deployment of Gitea in enterprise environments.

Source: Hackers exploit critical auth bypass in Gitea Docker image

Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws

Security researchers have documented a complete attack chain leveraging three patched vulnerabilities in OpenClaw, a personal artificial intelligence assistant. The exploitation sequence originates from WhatsApp interactions and escalates through credential theft and privilege escalation to achieve arbitrary code execution on the host system. One of the identified flaws carries a CVSS score of 8.8, underscoring the severity of these weaknesses in AI-powered applications.

Source: Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws

Armenian National Pleads Guilty to Ryuk Ransomware Attacks

Karen Vardanyan, an Armenian national, has entered a guilty plea for his involvement in Ryuk ransomware attacks that targeted multiple U.S. organizations. Vardanyan faces up to 15 years in federal prison and has agreed to pay nearly $1.2 million in restitution to victims. This prosecution represents continued law enforcement progress in dismantling ransomware operations that have caused substantial damage to American critical infrastructure and businesses.

Source: Armenian national pleads guilty to Ryuk ransomware attacks

Police Suspects Dutch Hackers Were Involved in Odido Breach

The Dutch National Police have announced strong indications that Dutch-based hackers participated in a February breach of Odido, a major Dutch telecommunications provider. The investigation suggests involvement by threat actors with domestic connections, adding a domestic dimension to what was initially characterized as a standard data breach. The incident exposed personal information affecting millions of Odido customers.

Source: Police suspects Dutch hackers were involved in Odido breach

URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat

Progress Software has issued an urgent directive instructing ShareFile customers to immediately shut down Windows servers running their Storage Zone Controllers in response to a credible external security threat. The company has temporarily disabled access to affected accounts as a precautionary measure while coordinating with internal and external security teams. This incident response action indicates an active and serious threat to the ShareFile infrastructure, potentially related to CVE-2023-24489.

Source: URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat

Money Launderer Accused of Stealing Seized Crypto While in Prison

A Bulgarian national has been charged with stealing $290,000 in government-seized cryptocurrency while serving a 121-month prison sentence for money laundering connected to American fraud victims. The incident exposes significant vulnerabilities in cryptocurrency custody and asset management protocols within law enforcement and correctional systems, raising questions about internal controls and oversight of digital asset storage.

Source: Money launderer accused of stealing seized crypto while in prison

Today's threat landscape reflects the convergence of supply chain vulnerabilities, active zero-day exploitation, and persistent criminal activity across ransomware and cryptocurrency theft domains. Organizations should prioritize patching critical bootloader and containerization flaws while maintaining heightened vigilance around open-source dependencies and cloud infrastructure configurations.