Cybersecurity Intelligence Report  09 July 2026

CRITICAL SECTION

• [11] CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV (TheHackerNews)  CVE-2026-48282
  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

  The vulnerabilities are listed below –

  CVE-2026-48282 (CVSS score: 10.0) – A path traversal vulnerability in Adobe ColdFusion that could lead to arbitrary code execution in the context of the

• [10] CISA orders feds to prioritize patching Langflow auth bypass flaw (BleepingComputer)
  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) gave federal agencies until Friday to patch an actively exploited vulnerability in the Langflow visual framework for building AI agents. […]

CISA KEV (last 14 days)

No CISA KEV items in the collector output.

RANSOMWARE VICTIMS (today)

qilin: [RANSOMWARE] qilin leaked S.J. Louis

krybit: [RANSOMWARE] krybit leaked xuerong.com, [RANSOMWARE] krybit leaked shelby.com.mx

akira: [RANSOMWARE] akira leaked Wade's Dairy

nightspire: [RANSOMWARE] nightspire leaked PCCC Realty LLC

pear: [RANSOMWARE] pear leaked Tostrud & Temp, S.C.

chaos: [RANSOMWARE] chaos leaked opportune.com, [RANSOMWARE] chaos leaked corepharma.com

spacebears: [RANSOMWARE] spacebears leaked Biessse

NEWS

• [8] Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS (TheHackerNews)
  Ubiquiti has shipped updates to address multiple critical security flaws impacting UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, and UniFi OS that could result in privilege escalation and arbitrary command execution.

  The list of vulnerabilities is as follows –

  CVE-2026-50746 (CVSS score: 10.0) – An improper access control vulnerability in UniFi Connect Application that an attacker

• [6] CISA orders feds to patch max severity ColdFusion flaw by Friday (BleepingComputer)
  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered government agencies to patch an actively exploited maximum-severity flaw in the Adobe ColdFusion commercial web app development platform by Friday. […]
• [6] Accenture Confirms Data Breach After Hacker Claims Source Code Theft (SecurityWeek)
  <p>The professional services giant says it contained the incident, remediated its source, and experienced no operational or service delivery impact.</p>
  <p>The post <a href="https://www.securityweek.com/accenture-confirms-data-breach-after-hacker-claims-source-code-theft/">Accenture Confirms Data Breach After Hacker Claims Source Code Theft</a> appeared first on <a href="https://www.securityweek.com">SecurityWeek</a>.</p>
• [6] Accenture acknowledges security incident following 35GB data theft claim (HelpNetSecurity)
  <p>Accenture appears to have suffered a data breach, the extent of which is currently unknown. On Monday, a threat actor going by the handle &#8220;888&#8221; posted on the cybercrime forum PwnForums, claiming to have breached the technology consulting company and stolen &#8220;just over 35gb of source codes&#8221; in July 2026. They claim to have exfiltrated source code, RSA keys, SSH keys, Azure personal access tokens, Azure Storage access keys, and configuration files, which they are &#8230;
• [6] Felons, Fraudsters Flog Offensive Cybersecurity Startup (KrebsOnSecurity)
  A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software is run by a pair of far-right conspiracy theorists and convicted felons whose most recent ventures included fake intelligence companies and a now-defunct AI-based lobbying platform they operated under assumed names.
• [5] Mount Royal University confirms breach as hackers claim attack (BleepingComputer)
  Mount Royal University in Calgary says hackers stole and then deleted data from its file storage systems after breaching the university's network. […]
• [5] Attackers using Langflow flaw for credential harvesting (CVE-2026-55255) (HelpNetSecurity)
  <p>The US Cybersecurity and Infrastructure Security Agency (CISA) is warning about yet another Langflow vulnerability (CVE-2026-55255) leveraged by attackers in the wild. The flaw was added to the agency&#8217;s Known Exploited Vulnerabilities catalog on Tuesday, July 7, nearly two weeks after the Sysdig Threat Research Team observed it being actively targeted. CVE-2026-55255 exploited Langflow is an open-source visual framework for building AI agents and workflows, widely used by individual dev
• [5] [RANSOMWARE] qilin leaked S.J. Louis (ransomware.live/qilin)
  Victim: S.J. Louis | Group: qilin | Website: www.sjlouis.com | Country: BR | Details: N/A
• [5] [RANSOMWARE] krybit leaked xuerong.com (ransomware.live/krybit)
  Victim: xuerong.com | Group: krybit | Website: xuerong.com | Country: CN | Details: Shanghai Xuerong Biotechnology Co., Ltd. (上海雪榕生物科技股份有限公司), formerly known as Shanghai Gaoron…
• [5] [RANSOMWARE] krybit leaked shelby.com.mx (ransomware.live/krybit)
  Victim: shelby.com.mx | Group: krybit | Website: shelby.com.mx | Country: MX | Details: Shelby Manufacturing de México, S.A. de C.V. is a Mexican maquiladora company specializing in the manufacturing of sewi…
• [5] [RANSOMWARE] akira leaked Wade's Dairy (ransomware.live/akira)
  Victim: Wade's Dairy | Group: akira | Country: GB | Details: A family-owned business for over a century, Wade's Dairy has been a staple in the Connecticut c
  ommunity.

  We will upload corporate data soon. Detailed employee personal information (name, DOB, SSN, DL,
  height, weight, race, sex, eyes and hair color, tattoo information, emails, phones and so on),
  pr

• [5] [RANSOMWARE] nightspire leaked PCCC Realty LLC (ransomware.live/nightspire)
  Victim: PCCC Realty LLC | Group: nightspire | Country: US | Details: Data is not available now.
• [5] [RANSOMWARE] pear leaked Tostrud & Temp, S.C. (ransomware.live/pear)
  Victim: Tostrud & Temp, S.C. | Group: pear | Website: tntcpas.com | Country: US | Details: Full service CPA firm serving La Crosse
• [5] [RANSOMWARE] chaos leaked opportune.com (ransomware.live/chaos)
  Victim: opportune.com | Group: chaos | Website: www.zoominfo.com/c/opportune-llp/147440067 | Country: US | Details: DATA EXPOSURE: Opportune LLP – Full Operational Transparency

  We are officially announcing that our security team has successfully breached the internal network of Opportune LLP. As of this moment, we are in possession of the entire Opportune internal data environment—an massive archive containi…

• [5] [RANSOMWARE] chaos leaked corepharma.com (ransomware.live/chaos)
  Victim: corepharma.com | Group: chaos | Website: www.zoominfo.com/c/corepharma-llc/30217761 | Country: US | Details: DATA EXPOSURE: CorePharma – Full GMP & Regulatory Compromise

  We are officially announcing that our security team has successfully breached the internal network of CorePharma. We are currently in possession of a comprehensive archive of the company’s internal operations, including sensitive regu…

• [5] [RANSOMWARE] spacebears leaked Biessse (ransomware.live/spacebears)
  Victim: Biessse | Group: spacebears | Website: www.biessseworld.com | Country: IT | Details: The BiesSse group, which has been operating on the global market for over 40 years, specializes in the production and conversion of highly performing technical adhesive tapes. The BiesSse Tape production plant covers a surface area of over 11,000 sq.mt. and is equipped with modern and advanced insta

SUMMARY

Total new items: 47

Critical items: 2

Ransomware victims reported today: 9

Top CVEs to patch urgently: CVE-2026-48282, CVE-2026-50746, CVE-2026-55255, CVE-2026-43499

Sources: BleepingComputer, TheHackerNews, SecurityWeek, HelpNetSecurity, KrebsOnSecurity, CISA KEV, ransomware.live