Afternoon Review in IT Security — July 19, 2026

The security landscape continues to shift as organizations face mounting pressure from sophisticated attackers exploiting both known vulnerabilities and supply chain weaknesses. Today's briefing covers critical incidents at a major healthcare diagnostics provider, emerging threats in open-source ecosystems, and dangerous zero-day exploitation campaigns targeting enterprise infrastructure.

Abbott Laboratories Probes Two Cyber Incidents Amid Extortion Claims

Abbott Laboratories is actively investigating two separate cybersecurity incidents that have exposed significant vulnerabilities within the organization. The company has confirmed unauthorized access to internal legacy Exact Sciences systems within its Cancer Diagnostics business unit, while simultaneously investigating a separate breach claim involving its LabCentral portal where attackers allegedly stole company data. The incidents have surfaced amid extortion claims, suggesting threat actors may be leveraging stolen information for financial gain. A Microsoft Entra SSO compromise has been identified as a contributing factor to the unauthorized access. Source: Abbott Laboratories probes two cyber incidents amid extortion claims

OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests

A critical denial-of-service vulnerability in OpenSSL, dubbed HollowByte, has emerged as a significant threat to unpatched servers worldwide. The flaw allows attackers to allocate up to 131 KB of server memory using only eleven bytes in a malformed TLS request, effectively freezing system resources on affected systems. On glibc systems tested by Okta's Red Team, the allocated memory persists until the process is restarted, creating opportunities for sustained denial-of-service attacks. Notably, OpenSSL shipped the fix in June without issuing a CVE, security advisory, or changelog entry to alert administrators to the vulnerability. The vulnerability is associated with CVE-2025-66199 and CVE-2026-34183. Source: OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests

Inc Ransomware Exploits SonicWall SMA Zero-Days

A new ransomware variant designated Inc has begun actively exploiting two zero-day vulnerabilities in SonicWall's Secure Mobile Access (SMA) appliances. When chained together, these two vulnerabilities grant threat actors root-level capabilities on affected mobile access devices, providing complete system compromise. This exploitation chain represents a significant risk to organizations relying on SonicWall infrastructure for remote access and mobile security. Source: Inc Ransomware Exploits SonicWall SMA Zero-Days

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have identified a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem in a sophisticated software supply chain attack. The campaign, codenamed ViteVenom by Checkmarx, represents an expansion of the ChainVeil malware operation, which employs an unprecedented four-tier blockchain-based command-and-control infrastructure spanning multiple blockchain networks. The malicious packages deliver a remote access trojan (RAT) to developers who unknowingly incorporate them into their projects, establishing persistent backdoor access. This attack demonstrates the evolving sophistication of supply chain threats leveraging decentralized infrastructure to evade detection. Source: Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Organizations should prioritize patching OpenSSL systems, reviewing access logs for Abbott-like breach indicators, securing SonicWall appliances against known zero-day chains, and implementing dependency scanning in development pipelines to detect malicious npm packages before deployment.