RF Wave

Hugging Face breached and more - Jul 26, 2026

Hugging Face breached and more - weekly security news and updates roundup for July 19-26, 2026

  • vulnerability
  • data breach
  • Hugging Face
  • Ostium
  • Estee Lauder
  • Stadler Rail
  • Unbound Group
  • Origin Energy
  • Chick-fil-A
  • OnTrac
  • ServiceNow
  • Cursor
  • Codex
  • Gemini
  • SonicWall
  • Palo Alto
  • WordPress Core
  • SharePoint
  • Langflow
  • Adobe
  • Check Point
  • Linux
  • ransomware
  • PTC Windchill
  • FlexPLM

Hugging Face has revealed they were victim of a data breach

The attackers breached its production infrastructure using an autonomous AI agent system, accessing internal datasets and credentials

This Week’s Updates

Breaches

  1. Ostium confirms an attacker stole $23.75 million from its liquidity provider vault after compromising off-chain price-feed infrastructure
  2. Estée Lauder discloses a data breach after hackers exploited an Oracle E-Business Suite flaw used for HR operations
  3. Stadler Rail confirms the Everest ransomware gang breached a supplier-shared data platform and rejected a $12.3 million ransom demand
  4. Upbound Group confirms hackers used data stolen in a breach to create $13 million in fraudulent Acima leases
  5. Origin Energy confirms an unauthorized party accessed and leaked customer data online, exposing sensitive personal information
  6. Chick-fil-A confirms credential stuffing attacks breached more than 13,000 customer accounts
  7. OnTrac notifies customers that hackers breached its corporate network and may have accessed personal details

Vulnerabilities

  1. Attackers are exploiting a critical ServiceNow AI Platform code execution flaw, CVE-2026-6875
  2. Researchers detail sandbox escape flaws in Cursor, Codex, Gemini CLI, and Antigravity, with vendor patches already shipped for Cursor and Codex
  3. SonicWall patches two SMA1000 zero-days, CVE-2026-15409 and CVE-2026-15410, that were exploited for weeks to push custom malware
  4. The Qilin ransomware gang is exploiting a critical, already-patched PAN-OS GlobalProtect authentication bypass flaw, CVE-2026-0257, to breach networks
  5. Hackers are exploiting the critical “wp2shell” WordPress Core flaws, CVE-2026-63030 and CVE-2026-60137, to install webshells
  6. Attackers are exploiting a critical SharePoint RCE flaw, CVE-2026-50522, to steal machine keys and retain access after patching
  7. CISA orders federal agencies to patch an actively exploited critical Langflow RCE flaw, CVE-2026-0770
  8. Adobe patches a Chrome extension flaw, CVE-2026-48294, that let malicious sites read WhatsApp Web chats without authentication
  9. Check Point patches an actively exploited zero-day in its SmartConsole admin panel
  10. A nine-year-old Linux XFS race condition flaw, CVE-2026-64600, lets local attackers gain root privileges
  11. Clop ransomware exploits a critical, already-patched CVE-2026-12569 flaw in PTC Windchill and FlexPLM in a new data theft campaign