Morning Review in IT Security — July 22, 2026

The cybersecurity landscape continues to face significant threats as attackers actively exploit critical vulnerabilities across major platforms. Today's briefing highlights urgent concerns spanning remote code execution flaws, privilege escalation weaknesses, and ransomware campaigns targeting network infrastructure.

Critical SharePoint RCE Flaw Exploited to Steal Machine Keys

Hackers are actively exploiting the critical CVE-2026-50522 vulnerability in Microsoft SharePoint to steal machine keys and maintain persistent access even after affected servers are patched. This represents a particularly dangerous threat vector because attackers who successfully extract machine keys can preserve their foothold regardless of remediation efforts. The vulnerability allows for remote code execution, which attackers are leveraging to compromise sensitive systems and establish long-term presence within affected environments. Source: Critical SharePoint RCE flaw exploited to steal machine keys

CVE-2026-8933: Local Privilege Escalation in Set-Capabilities snap-confine

The Qualys Threat Research Unit has identified a local privilege escalation vulnerability in snap-confine designated as CVE-2026-8933. This flaw allows unprivileged local users to gain full root access on default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The vulnerability stems from a security hardening change that inadvertently introduced a race condition during sandbox operations, creating a pathway for attackers to escalate their privileges to administrator level. Organizations running affected Ubuntu versions should prioritize patching to mitigate this risk. Source: CVE-2026-8933: Local Privilege Escalation in Set-Capabilities snap-confine

Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access

Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability to deploy Qilin ransomware, also known as Agenda, on victim environments. Arctic Wolf Labs investigated multiple intrusions in June 2026 that began with exploitation of CVE-2026-0257, an authentication bypass flaw with a CVSS score of 7.8 affecting the portal and gateway components. This vulnerability served as the initial entry point for attackers to establish footholds before deploying ransomware payloads across victim networks. Organizations with unpatched PAN-OS systems remain at significant risk of similar attacks. Source: Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access

Closing the Identity Gaps in Critical Infrastructure Security

Critical infrastructure attacks frequently begin with stolen credentials, compromised devices, or abuse of trusted accounts, highlighting the importance of comprehensive identity security measures. Specops Software emphasizes that Zero Trust principles must verify both user identities and device trust before granting access to critical systems, rather than relying solely on traditional perimeter-based security models. Organizations protecting critical infrastructure should implement robust identity verification and device posture checks to prevent unauthorized access regardless of credential compromise. Source: Closing the Identity Gaps in Critical Infrastructure Security

Security teams should prioritize patching the identified vulnerabilities, particularly CVE-2026-50522 and CVE-2026-0257, while implementing Zero Trust identity frameworks to defend against the evolving threat landscape targeting both enterprise and infrastructure environments.