Afternoon Review in IT Security — July 21, 2026

The cybersecurity landscape continues to evolve with critical vulnerabilities emerging across enterprise infrastructure, automotive systems, content management platforms, and artificial intelligence environments. Today's threat intelligence reveals active exploitation campaigns targeting both established and emerging attack surfaces, underscoring the persistent urgency of patch management and vulnerability remediation across all technology sectors.

Critical Palo Alto VPN Bug Now Exploited by Qilin Ransomware Gang

The Qilin ransomware gang has begun actively exploiting a critical authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect VPN. According to cybersecurity researchers at Arctic Wolf, this vulnerability is being weaponized as a primary vector for network intrusion and lateral movement during ransomware campaigns. The flaw, tracked as CVE-2026-0257, allows attackers to bypass authentication mechanisms and gain unauthorized access to protected networks without requiring valid credentials.

This exploitation represents a significant escalation in threat activity, as the vulnerability provides attackers with direct access to enterprise perimeter defenses. Organizations running affected PAN-OS instances should prioritize immediate patching and implement enhanced monitoring for suspicious VPN access patterns. Source: Critical Palo Alto VPN bug now exploited by Qilin ransomware gang

A Device Hidden in Cars Across the US Leaves Them Vulnerable to Hacking and Paralysis

Researchers have identified a critical vulnerability affecting millions of vehicles across the United States through automotive alarm systems installed by dealerships. These security devices, often installed without customer knowledge or consent, can be remotely compromised to unlock vehicles, enable real-time tracking, and disable critical vehicle systems. The KARR Security System, present in approximately two million vehicles, contains exploitable flaws that could allow attackers to assume complete control over affected automobiles.

The vulnerability stems from inadequate security controls in the alarm system's design and deployment, compounded by the fact that many vehicle owners are unaware the devices are even installed in their vehicles. Researchers strongly recommend that affected vehicle owners contact their dealerships for immediate patching and removal of the vulnerable systems. Source: A Device Hidden in Cars Across the US Leaves Them Vulnerable to Hacking and Paralysis. Patch It Now

WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

Two critical vulnerabilities in WordPress, designated CVE-2026-63030 and CVE-2026-60137, have been combined into a weaponized attack framework known as wp2shell that enables unauthenticated remote code execution. The public release of exploitation code has triggered widespread mass scanning and active compromise attempts against vulnerable WordPress installations. By early Saturday morning UTC, successful exploitation campaigns were already documented across multiple targets.

The wp2shell vulnerability chain allows attackers to completely compromise affected WordPress websites without requiring authentication credentials. The availability of public exploit code has dramatically accelerated the attack timeline, with threat actors deploying automated scanning and exploitation infrastructure at scale. Website administrators should immediately update WordPress and all affected plugins to patched versions and implement web application firewalls to detect exploitation attempts. Source: WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack

Security researchers at Sysdig have identified a new ransomware variant called ENCFORGE, deployed by the JADEPUFFER threat actor group during attacks against Langflow servers. This ransomware represents a novel targeting approach, specifically designed to encrypt artificial intelligence infrastructure assets including model weights, vector indexes, training datasets, and other machine learning files. The attacks exploit CVE-2025-3248, a remote code execution vulnerability in Langflow that allows unauthenticated command execution.

JADEPUFFER's deployment of ENCFORGE demonstrates an emerging threat trend targeting the AI and machine learning sector, where attackers recognize the high value of trained models and training data. The ransomware has been observed using the email address e78393397@proton.me for ransom communications. Organizations operating Langflow instances should immediately apply security patches for CVE-2025-3248 and implement network segmentation to isolate AI infrastructure from internet-facing systems. Source: New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack

Today's threat intelligence demonstrates that attackers continue to exploit vulnerabilities across the full spectrum of technology infrastructure, from enterprise network perimeters to consumer automotive systems, web platforms, and emerging artificial intelligence environments. Rapid patching, vulnerability scanning, and threat monitoring remain essential defensive practices in the current threat landscape.