Daily Cybersecurity News - July 10, 2026

Attackers are hijacking Gitea instances by impersonating any user, including admins, through the official Docker image.

The flaw sits in how the image handles authentication. Actively exploited in the wild, it lets unauthenticated attackers take over accounts without credentials.

Affects anyone running Gitea via the official Docker image. Self-hosted Git setups on standard container deployments are directly exposed.

Exploitation attempts hit roughly 1,900 servers in the initial wave.

Microsoft patched a zero-day in Windows Defender that let local users grab SYSTEM rights.

CVE-2026-50656 is a TOCTOU race in the Malware Protection Engine. Unprivileged attackers can trigger it to gain SYSTEM privileges on vulnerable Windows systems running Defender. CVSS 7.8, now fixed via out-of-band update to engine version 1.1.26060.3008.

Affects any Windows system running Defender. Systems with Defender disabled sit outside the attack surface. Researcher Nightmare Eclipse published the PoC in early June.

The researcher dropped the exploit hours after June Patch Tuesday as the seventh zero-day in their public campaign.

Attackers used a flaw in cryptocurrency wallet recovery phrase generation to steal over 5 million dollars.

Coinspect named the issue Ill Bloom. Weak randomness in phrase creation let attackers recover the seed and drain funds. The flaw affects wallet software that generates recovery phrases.

Hits users of affected wallet implementations across multiple cryptocurrencies. Victims lost funds after attackers reconstructed their phrases.

Coinspect observed the attacks in the wild and traced over 5 million in losses.

A new remote access Trojan called GigaWiper is hitting Windows users with full system control and three separate wipe routines.

GigaWiper is deployed after attackers have already compromised a system, giving operators remote control, surveillance capabilities, and multiple ways to permanently destroy data.

The triple-wipe design stands out. Most RATs stop at espionage or ransomware, but this one adds reliable destruction as a built-in option.

Malwarebytes spotted the first samples in June 2026 and has already linked it to at least a dozen active infections.

Attackers compromised the Injective Labs SDK GitHub repo and pushed a malicious npm package that stole wallet keys.

The package targeted cryptocurrency developers and harvested private keys plus mnemonic phrases directly from their machines.

This is the familiar supply-chain compromise pattern, but the choice of an SDK used by blockchain projects makes the blast radius bigger than typical typosquats.

Attackers kept the malicious version live on npm for roughly 24 hours before takedown.

A cybercrime crew left one of its servers exposed for three weeks, leaking logs and target lists of over 1.4 million websites.

They used WP SHELLSTORM to scan for outdated WordPress plugins, then injected backdoors into thousands of sites. The server held hacking tools and activity logs showing the scale.

The crew reused basic scanning scripts rather than novel exploits. This matches patterns seen in earlier mass WordPress compromises by similar criminal groups.

Researchers found evidence of compromise on more than 25,000 sites, including thousands of active webshells.

AI coding tools from Anthropic and OpenAI can be tricked into executing attacker-controlled code while reviewing malicious repositories.

The AI Now Institute built a proof of concept that turns these models against the systems they were meant to protect.

This is early-stage research, not a deployed attack. The models were not designed for offensive use, so the finding rests on a narrow demonstration.

The Institute published its full methodology and test prompts alongside the report.