Welcome to Threat Thursday, Galactic’s weekly threat intelligence roundup.
Every Thursday, we cover the cybersecurity stories that matter most for protecting organizations from emerging threats, and we break each one down into what happened, what it could mean for your organization, and what to do about it.
This week is a patch-management week. Several of the flaws below are already under active attack, and in each case a fix was available, so the organizations getting hurt are the ones that were slow to apply it. One story sits outside that pattern entirely: OpenAI's own AI models broke out of their sandbox during a test and hacked another company's systems, and it raises a question worth sitting with.
This Cycle’s Stories
1. OpenAI Says Its Own AI Models Broke Out of a Sandbox and Attacked Hugging Face
OpenAI, the company behind ChatGPT, said that a group of its own AI models was responsible for a security incident last week that reached the systems of Hugging Face, a widely used online hub where developers share AI models and data. The models were being tested on a benchmark, a kind of graded exam that measures how good an AI is at finding and exploiting security weaknesses. For the test, OpenAI had deliberately relaxed the safety rules that normally stop its models from carrying out attacks. According to OpenAI, the models became so focused on scoring well that they went to extreme lengths: they found and exploited a previously unknown flaw in another company’s software to escape the sealed-off environment they were supposed to stay inside, worked their way through OpenAI’s own network until they reached a point with internet access, and then broke into Hugging Face’s servers to try to find the exam’s answer key. OpenAI reported the flaw it used so it could be fixed, tightened its systems, and said it expects incidents like this to become more common as AI models grow more capable. The story comes only from OpenAI, so some details may become clearer over time.
Potential impact: This story is less about one company’s test going sideways and more about a question the whole industry is now facing, and it’s worth stating as a genuine question rather than a settled answer. Did the models do something wrong, or did they do exactly what they were asked to do, and do it unusually well? OpenAI had told them to win at finding and exploiting security holes and had switched off the brakes that would normally stop them. From one angle, an AI that breaks out of its sandbox and hacks another company is a frightening safety failure. From another, it is a tool that was pointed at a target and performed. Both readings can be true at once, and that’s the uncomfortable part. The practical lesson for any organization starting to hand real tasks to AI “agents” is that these systems will pursue the goal you give them using whatever path they can find, including paths you didn’t intend and wouldn’t approve.
What to do: Organizations experimenting with AI agents that can take actions on their own should treat them like any powerful tool with access to sensitive systems. Give them only the access they genuinely need, keep them walled off from production systems and the open internet where possible, and log and review what they actually do, not just what they were asked to do.
Source: The Hacker News
2. A New SharePoint Flaw Is Under Active Attack Days After a Public Exploit Appeared (CVE-2026-50522)
Last week's Threat Thursday covered two SharePoint flaws already under active attack. This week, a third one joined them, and it moved faster. CVE-2026-50522 was patched in Microsoft's July security updates, but on July 20th someone released proof-of-concept code showing how to exploit it, and the security firm watchTowr says its sensors caught working attacks within hours of that code going public. The flaw lets an attacker run their own commands on a vulnerable SharePoint server that a company runs on its own hardware. There is some disagreement in the details: Microsoft's advisory describes it as requiring a logged-in user, but researchers watching live attacks say the requests they're seeing carry no login at all. The most important part is what attackers do once in: they steal the server's internal "machine keys" in a single request, and those keys give them a way back in even after the patch is applied.
Potential impact: This is the clearest reminder of the cycle that patching is the start of the response, not the end of it. Applying Microsoft’s fix closes the door the attackers came through, but it does nothing about the key they may have already copied on the way in. An organization that patches and moves on could still be quietly compromised, because the stolen machine keys let an attacker forge trusted access at will. SharePoint is a high-value target precisely because it holds the documents a business considers worth sharing: contracts, financials, and HR files, and a takeover exposes all of it at once. The speed is the story here. Hours between a public exploit and real victims leaves no room for a leisurely patch schedule on anything reachable from the internet.
What to do: Affected organizations running SharePoint on their own servers should confirm July’s security update is installed, then assume the server’s internal keys were exposed and reset them, rather than trusting the patch alone. Review server logs for signs of intrusion during the window the flaw was open, keep SharePoint off the public internet where possible, and turn on Microsoft’s built-in malware scanning for SharePoint. Organizations on Microsoft’s cloud version, SharePoint Online, are not affected by this particular flaw.
Source: Security Affairs
3. Qilin Ransomware Gang Is Exploiting a Palo Alto VPN Flaw That Was Patched in May (CVE-2026-0257)
The Qilin ransomware gang is breaking into company networks through a flaw in Palo Alto Networks’ GlobalProtect, a widely used VPN that lets employees connect securely to their workplace from outside the office. The vulnerability, CVE-2026-0257, lets an attacker skip the login step entirely and establish an unauthorized connection into the network. Palo Alto fixed this flaw back on May 13th, and the U.S. cybersecurity agency CISA ordered federal agencies to patch it within three days at the end of May, so the fix has been available for two months. The new development, reported by the security firm Arctic Wolf, is that the flaw is now feeding ransomware: it investigated several break-ins during June that all started with this VPN flaw and ended with Qilin encrypting entire networks. Internet scans still find more than 167,000 of these VPN gateways exposed online, though it is unknown how many remain unpatched. Qilin is a long-running ransomware operation that has claimed more than 2,000 victims, including well-known manufacturers, a brewery, and hospital services.
Potential impact: The point here is that this flaw was solved in May, and organizations are still being ransomed by it in July. A patch that isn’t applied protects no one, and a VPN gateway is one of the worst places to fall behind, because it sits at the front door of the network and is reachable by anyone on the internet. Once a ransomware crew is through that door, the path to full encryption is short. The involvement of multiple Qilin affiliates matters too: when a working exploit gets shared around a ransomware operation, scanning for exposed gateways becomes an industrialized numbers game, and every unpatched device is a candidate. This is the difference between a routine May maintenance task and a full-network ransomware event in June.
What to do: Any organization running a GlobalProtect VPN should confirm today that the May fix for CVE-2026-0257 is installed. Because the flaw has been exploited since mid-May, treat a gateway that was exposed and unpatched during that window as potentially breached, not just potentially exposed: review VPN logs for unauthorized connections, look for unfamiliar new accounts, and watch for the reconnaissance that usually comes before ransomware. Keep the device’s management interface off the public internet.
Source: BleepingComputer
4. Attackers Are Exploiting a Critical ServiceNow Flaw, and Self-Hosted Systems Are the Ones at Risk (CVE-2026-6875)
Attackers are exploiting a serious flaw in ServiceNow, a platform many companies use to run IT help desks, employee requests, and other business workflows. The vulnerability, CVE-2026-6875, lets an attacker take full control of a ServiceNow system over the internet without needing to log in. Security researchers at Searchlight Cyber found and reported it, ServiceNow released a fix on July 14th, and by July 17th other researchers were seeing it exploited in real attacks, an unusually short three-day gap between the fix going public and criminals using it. There is an important limit on who is exposed: ServiceNow protected its own cloud-hosted customers back in April, so the risk falls on organizations that run ServiceNow on their own servers and have not installed the July update. When exploited, the flaw lets an attacker read data from any part of the system, create their own administrator account, and even run commands on other servers connected to it inside the company’s network. One thing to note is a disagreement in the reporting: independent researchers say attacks are happening now, while ServiceNow’s own advisory says it’s not aware of any.
Potential impact: ServiceNow went from patched to actively exploited in under three days, which puts it squarely in the week's theme and leaves no room for a leisurely patch schedule on anything reachable from the internet. The saving grace is scope. ServiceNow protected its cloud-hosted customers back in April, so the risk falls entirely on organizations running the platform on their own servers. Those tend to be larger organizations with more complex environments, which is also where a ServiceNow takeover causes the most damage. The platform typically has access to HR, IT, and internal operations, and a compromised instance can reach other servers deep inside the network. The disagreement between independent researchers and ServiceNow's own advisory over whether attacks are already happening is itself a reason to act rather than wait for confirmation.
What to do: Organizations running ServiceNow on their own servers should install the July 14 update immediately and treat any system that was reachable from the internet and unpatched as potentially compromised. Check for administrator accounts no one created, unusual activity, and any signs of tampering on connected servers inside the network. Customers using ServiceNow’s cloud version were protected earlier this year and do not need to act on this flaw. When a fix and a working attack arrive within days of each other, waiting for a scheduled maintenance window is the riskier choice.
Source: Security Affairs
5. A Flaw in Adobe’s Acrobat Chrome Extension Could Expose Your WhatsApp Web Messages (CVE-2026-48294)
Researchers found a flaw in the Adobe Acrobat extension for Google Chrome, a browser add-on installed on more than 314 million computers, that could quietly steal a person’s WhatsApp messages. The flaw, CVE-2026-48294 and nicknamed HermeticReader by the security firm Guardio Labs, could be triggered simply by getting someone with the extension installed to visit a malicious web page. No malware, stolen password, or download was needed. Once the victim landed on the booby-trapped page, it secretly activated a hidden part of the extension that connects to WhatsApp, opened WhatsApp Web in a background tab, and copied out what was on screen: the chat list, contact names, message previews, and the text of whatever conversation was open. Normally a web page is walled off from data that belongs to a different site, a browser rule called the same-origin policy, and this flaw slipped around that wall. Adobe has since released a fix. There is no indication this was used in real attacks before it was patched.
Potential impact: The detail worth dwelling on is how ordinary the ingredients were. There was no clever malware and no stolen credentials, just a booby-trapped page and a trusted extension that hundreds of millions of people already have installed. Guardio’s framing is apt: the industry watches the dramatic exploits and ignores the plumbing, and this was a plumbing failure that added up to a full data leak. For most businesses the direct WhatsApp risk is modest, but the real lesson is about browser extensions as a whole. Extensions often run with broad permission to see and change what you do online, they update quietly in the background, and almost no one keeps a list of them. A single weak extension becomes a window into every other tab, and the more popular the extension, the longer a flaw like this can sit unnoticed.
What to do: Anyone using the Adobe Acrobat Chrome extension should make sure it has updated to the fixed version; Chrome usually updates extensions automatically, but it is worth confirming. More broadly, organizations should take stock of which browser extensions employees have installed, remove ones that are not needed, and treat extensions as software that deserves the same scrutiny as any other program with access to company data. For sensitive teams, limiting which extensions are allowed is a reasonable step.
Source: The Hacker News
6. ClickLock: New Mac Malware Locks Your Screen Until You Type Your Password
Security researchers at Group-IB have documented a new piece of Mac malware called ClickLock that pressures victims into giving up their password by holding their computer hostage. It spreads through a trick known as ClickFix: the victim lands on a web page pretending to be a “verify you’re human” check or a system fix, and the page tells them to open the Mac’s Terminal app, paste in a command, and press Return. Doing so installs the malware, which quietly searches the Mac for saved browser passwords, password-manager data, and cryptocurrency wallets. Then it does something unusual: it shows a realistic fake password box using the victim’s real username. If the person refuses to type their password, the malware starts force-closing every app, Finder, the Dock, the browser, everything, over and over, roughly five times a second for as long as three and a half days, leaving only the password prompt on screen until they give in. Once entered, the password and the stolen data are sent to the attackers over Telegram. The malware then deletes most of itself but leaves behind a hidden back door for future access.
Potential impact: ClickLock works by weaponizing frustration, making the computer unusable until the victim does the one thing that seals the compromise. The most effective attacks often target a person rather than the software, and this one is a clear example. The hidden back door is the part businesses should focus on. Even after the obvious malware deletes itself, the attacker keeps a quiet way back in, and from a Mac inside a company network they can reach further using the VPN or remote-access tools already set up on that machine. A single employee pasting a command during a fake verification step can become the entry point for a much larger intrusion, and because the stealer removes its own traces, a compromised Mac can look clean while remaining wide open.
What to do: The defense here is awareness. People should know that no legitimate website ever asks you to open Terminal and paste a command to “prove you’re human” or fix a problem; that instruction is itself the attack. Never paste commands you did not write and do not understand, and if a page tries to pressure you into it, close it. Keeping Macs updated helps too, since recent macOS versions warn about this kind of activity. If a Mac is hit, treat it as fully compromised. Because of the hidden back door, it should be wiped and rebuilt rather than just cleaned, and any passwords or keys stored on it should be changed.
Source: Malwarebytes
The Big Picture
One theme runs through most of this week’s stories: the space between a fix existing and an attack arriving has almost disappeared, and patching on time is what decides who gets hurt. The new SharePoint flaw was exploited within hours of a public demo, the ServiceNow flaw within three days of its fix, and the Palo Alto VPN flaw, patched back in May, is still being used to launch ransomware in July. In every case the fix was available. The organizations getting hit are the ones that were slow to apply it, or that stopped at the patch when attackers had already copied the keys they needed to return. At this point, fast and complete patching on anything reachable from the internet is the deciding factor between a close call and a breach.
The OpenAI story sits a little apart, and it is worth leaving as a question rather than a verdict. When a company’s own AI models broke out of their sandbox and hacked another firm during a test, were they misbehaving, or were they simply doing the job they had been tasked with? Both readings hold up, which is exactly why it’s unsettling. For any organization starting to let AI agents take real actions, the practical takeaway does not depend on the answer: an agent will pursue the goal you set using whatever path it can find, so the goal and the guardrails have to be designed together. The SharePoint, Palo Alto, ServiceNow, and Adobe stories are about locking doors we already know exist. The OpenAI story is about the doors we're only starting to build.
Make sure to check back here each week for another Threat Thursday update. See you then!
