Active Exploits & Emerging Threats – July 7, 2026

Active Exploits & Emerging Threats – July 7, 2026

This post is about things that are happening right now — not theoretical vulnerabilities, not research demos, not hypothetical attack chains. Active exploitation confirmed. PoC code in the wild. A persistent threat actor on a breach spree. If your security team has a triage queue, everything in this post belongs at the top of it.

The Threat Board

CVE-2026-48282 — Adobe ColdFusion (CVSS: 10.0) — ACTIVELY EXPLOITED

Adobe ColdFusion is being hit right now. CVE-2026-48282 carries a maximum severity CVSS score, and vulnerability intelligence firm KEVIntel has confirmed active in-the-wild exploitation. ColdFusion is a perennially under-patched web application platform with outsized deployment in legacy enterprise environments — financial services, healthcare, and government agencies. When a 10.0 lands on ColdFusion, attackers know exactly what they have: a fast path to full server compromise with a wide target pool.

Let me be direct: if ColdFusion is running anywhere in your environment — internet-facing, internal, dev, staging — you need to know about this in the next thirty minutes. Patch or take offline. There is no middle ground here. Check your WAF logs for anomalous ColdFusion request patterns dating back at least a week. If you've been hit, the window for early containment is closing.

Source: BleepingComputer — https://www.bleepingcomputer.com/news/security/max-severity-adobe-coldfusion-flaw-now-exploited-in-attacks/

CVE-2026-46242 — Linux Bad Epoll (PoC Released) — Local Root on Linux & Android

The Bad Epoll vulnerability in the Linux kernel — CVE-2026-46242 — now has public proof-of-concept exploit code. The flaw grants local attackers root access on Linux and Android systems. Organizations running Linux-based infrastructure, particularly where untrusted users or processes have local execution (shared hosting, developer workstations, containerized environments with breakout risk), need to treat this as urgent.

The PoC release is the inflection point. Before PoC, this was a patching priority. After PoC, it's a race. Automated exploitation frameworks typically incorporate publicly available PoC within 24-72 hours. Every unpatched Linux host running a vulnerable kernel version is now a potential privilege escalation target. There's an additional dimension worth noting: this flaw was missed by AI-assisted code review tools. That's a calibration point for teams that rely on AI tooling as part of their secure development lifecycle — we'll cover that more in this week's AI post.

Source: Security Affairs — https://securityaffairs.com/194795/hacking/bad-epoll-flaw-gives-attackers-root-access-on-linux-and-android.html | SecurityWeek — https://www.securityweek.com/proof-of-concept-exploit-released-for-linux-bad-epoll-root-access-vulnerability/

CVE-2026-20896 — Gitea Docker (Critical) — Active Probing 13 Days Post-Disclosure

Threat actors are actively scanning and probing Gitea Docker deployments for CVE-2026-20896 — a critical-severity flaw — just thirteen days after it was publicly disclosed. This pattern is now standard operating procedure for well-resourced threat actors: monitor vulnerability disclosures, spin up scanning infrastructure, and start hitting unpatched targets before defenders can catch up.

From where I sit advising enterprise security teams: the thirteen-day window isn't a surprise — it's a data point confirming that your patch SLAs need to be measured in days, not weeks. Gitea is widely used in DevOps environments as a self-hosted Git service. Compromise of a Gitea instance gives attackers access to source code repositories, CI/CD pipeline configurations, secrets potentially stored in repos, and a trusted internal network position. If you have Gitea Docker running, verify patch status immediately and review access logs for scanning activity.

Source: The Hacker News — https://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html

ShinyHunters: Medtronic (3.8M) + Moody Bible Institute (2.3M) — Ongoing Campaign

ShinyHunters, one of the most prolific data extortion threat actors of the past several years, has had a busy week. The group is responsible for the breach of Medtronic — exposing personal and medical data of 3.8 million patients — and the breach of Moody Bible Institute, affecting 2.3 million accounts. Two large-scale breaches in rapid succession from the same threat actor is not coincidence — it's a campaign tempo.

ShinyHunters has demonstrated a consistent pattern: they identify organizations with externally exposed or poorly secured data storage (cloud buckets, exposed APIs, credential stuffing of SaaS platforms), exfiltrate at scale, and monetize through extortion and dark web sales. The Medtronic breach is particularly serious given that it includes medical data, which carries both HIPAA regulatory exposure and life-safety implications in certain attack scenarios. Healthcare organizations should be running a ShinyHunters-specific threat hunt right now: look for anomalous data access patterns in your cloud storage, review third-party data processor access logs, and verify your data classification and DLP controls are functioning.

Sources: Security Affairs — https://securityaffairs.com/194788/cyber-crime/medtronic-notifies-3-8-million-after-shinyhunters-data-breach.html | The Register — https://www.theregister.com/security/2026/07/06/moody-bible-institute-breach-leaves-23m-accounts-needing-salvation-says-cyber-expert/

What Enterprise Teams Should Do Right Now

• PATCH IMMEDIATELY: Adobe ColdFusion CVE-2026-48282 — this is actively exploited, CVSS 10.0. No excuses, no delay.

• PATCH THIS WEEK: Linux kernel Bad Epoll CVE-2026-46242 — PoC is public. Every unpatched Linux host is now an easier target.

• AUDIT & PATCH: Gitea Docker CVE-2026-20896 — active scanning is happening now. Verify patch status across your DevOps tooling.

• THREAT HUNT: Search your environment for ShinyHunters TTPs — anomalous cloud storage access, bulk data exports, unusual API key usage.

• REVIEW ColdFusion WAF rules and check web logs for exploitation attempts dating back at least 2 weeks.

• VERIFY your SBOM and dependency scanning for PolinRider/DPRK supply chain IOCs in open source packages.

• ENABLE kernel live-patching (kpatch, livepatch) if you cannot do full kernel maintenance windows quickly — it buys time.

• NOTIFY incident response teams of current threat tempo — escalation criteria should reflect that exploitation windows are now measured in days.

• REVIEW third-party data processor agreements and access logs given ShinyHunters' ongoing campaign targeting organizations that store large datasets.

Threat Actor Profile: ShinyHunters

Worth a dedicated note this week: ShinyHunters has been operating for years, but their current tempo suggests either organizational growth, new tooling, or a deliberate acceleration of operations. They have historically targeted cloud storage misconfigurations, credential theft, and exploitation of third-party SaaS platforms with access to large datasets. Two major breaches in a single week affecting healthcare and education sectors is a pattern worth escalating to your board-level risk reporting. If your organization stores significant volumes of personal, medical, or financial data, ShinyHunters should be on your current threat actor watchlist with active monitoring.