Summary5 min read

Cybersecurity Headlines – July 20, 2026

Host: Steve Prentiss, CISO Series
Episode Focus: Fairlife Dairy Cyberattack, ACR Stealer Surge, Abbott Labs Incidents, and Other Major Security Stories

Episode Overview

This episode delivers a concise roundup of the day’s most notable cybersecurity events, ranging from impactful data breaches at major corporations to critical vulnerabilities exploited in the wild. Hosted by Steve Prentiss, the episode emphasizes recent attacks impacting the food, healthcare, and finance sectors, malware trends, and evolving technical vulnerabilities affecting global enterprises.

Key Discussion Points & Insights

1. Fairlife Dairy Suffers Cyberattack

[00:06–00:41]

Incident Details: Fairlife, a Coca Cola subsidiary, suffered a significant cyberattack forcing it to temporarily halt production in the US.
Scope: The incident’s full extent is still unclear.
Safety and Impact: Coke assures that product quality and safety were not compromised; Canadian operations remain unaffected.
Unanswered Questions: No mention yet of ransomware involvement or a breach, and the responsible group remains unidentified.

“The full scope of the incident isn't yet known... No mention of a ransomware group or any information about a breach has yet been made.”
(Steve Prentiss, 00:29–00:41)

2. Microsoft Warns of ACR Stealer Surge

[00:50–01:17]

Threat Overview: ACR Stealer malware, believed to be a rebranding of Amatera Stealer, is targeting browser-stored credentials and sensitive documents.
Attack Chains: Two intrusion vectors:
- Running malicious DLLs via remote WebDAV shares.
- Exploiting Microsoft HTML Application Host.
Social Engineering: Attackers employ click-fix social engineering techniques to lure users.

“The observed surge in attacks... to steal browser stored passwords, authentication tokens, and sensitive documents from its enterprise customers...”
(Steve Prentiss, 00:50–00:57)

3. Abbott Labs Under Extortion Pressure

[01:31–02:07]

Incidents: Two separate breaches are under investigation:
- Unauthorized access to legacy systems in its cancer diagnostics business.
- Claims of a breach in the Lab Central portal with possible data theft.
Threat Actor: Shiny Hunters extortion group reportedly demands compliance by July 21st.

“The Shiny Hunters extortion gang has already added Abbott to its data leak site and it has set a deadline of July 21st.”
(News Reporter, 01:36–02:07)

4. Ernst & Young Support System Breach

[02:07–02:57]

Nature of Breach: Compromise of a third-party support ticket system used by IT staff led to the download of sensitive customer documents, including tax filings.
Timeline: Unauthorized access occurred between March 28 and April 12; detected April 23.
Impact: The company won’t disclose number of affected customers or locations; no group has claimed responsibility.

“Support tickets submitted through the platform may have included documents containing client tax information.”
(News Reporter, 02:11–02:23)

5. 40Sandbox Critical Flaws Under Attack

[03:43–04:25]

Vulnerabilities: Two OS command injection bugs (CVSS 9.1) affecting 40Sandbox cloud and PaaS products.
Exploit Nature: Permit unauthenticated remote code execution via specially crafted HTTP requests.
Status: Both added to CISA’s KEV catalog, signaling active exploitation in the wild.

“They are OS command injection flaws that allow unauthenticated attackers to execute arbitrary commands via specially crafted HTTP requests requiring neither valid credentials nor user interaction.”
(News Reporter, 03:55–04:13)

6. WP2Shell – New WordPress Core Zero Day

[04:30–05:22]

Bug Details: Allows unauthenticated code execution even on unmodified WordPress installs (no plugins needed).
Affected Versions: 6.9 and 7.0 until the emergency update (6/7.0.2) last Friday enabled forced auto-updates.
Attack Surface: Exploitable by any anonymous user.

“A bare install with zero plugins is exploitable... It has no preconditions and can be exploited by an anonymous user.”
(News Reporter, 04:35–05:04)

7. SharePoint RCE Zero-Day Added to KEV Catalog

[05:27–06:13]

Vulnerability: Critical remote code execution hole (CVSS 9.8) stemming from deserialization of untrusted data.
Impact: Remotely exploitable, no significant prior knowledge required, highly repeatable.
Response: Federal agencies given a strict patch deadline.

“Microsoft noted that the vulnerability is remotely exploitable over the Internet and that an attacker does not require significant prior knowledge of the system.”
(News Reporter, 05:35–05:53)

8. AI Spam Filters Evaded by Classic Text Salting

[06:17–07:39]

Techniques: Attackers bypass advanced AI spam detection using old methods:
- Random innocuous words (“text salting”)
- CSS cropping (hiding text from humans)
- Zero font techniques (visible to scanners, not readers)
Defense: Barracuda urges a multi-layered approach, including sender reputation and in-depth HTML analysis.

“Attackers are using a long established technique known as text salting to enable phishing emails and spam to elude new AI powered spam filters.”
(News Reporter, 06:23–06:34)

Notable Quotes & Memorable Moments

“The full scope of the incident isn’t yet known... No mention of a ransomware group or any information about a breach has yet been made.”
— Steve Prentiss, [00:29–00:41]
“The Shiny Hunters extortion gang has already added Abbott to its data leak site and it has set a deadline of July 21st.”
— News Reporter, [01:36–02:07]
“Support tickets submitted... may have included documents containing client tax information.”
— News Reporter, [02:11–02:23]
“They are OS command injection flaws that allow unauthenticated attackers to execute arbitrary commands via specially crafted HTTP requests requiring neither valid credentials nor user interaction.”
— News Reporter, [03:55–04:13]
“Attackers are using a long established technique known as text salting to enable phishing emails and spam to elude new AI powered spam filters.”
— News Reporter, [06:23–06:34]

Timestamps for Major Segments

Fairlife Dairy Cyberattack: [00:06–00:41]
ACR Stealer/Amatera Malware Surge: [00:50–01:17]
Abbott Labs Extortion & Breaches: [01:31–02:07]
Ernst & Young Data Breach: [02:07–02:57]
40Sandbox Active Exploit: [03:43–04:25]
WP2Shell WordPress Zero Day: [04:30–05:22]
SharePoint RCE Zero Day: [05:27–06:13]
AI Spam Filter Evasion: [06:17–07:39]

Episode Tone

As a rapid-fire headline briefing, the tone stays factual, succinct, and focused on actionable intelligence for security professionals. The delivery underscores urgency and the need for ongoing vigilance against emerging threats.

For more in-depth coverage, visit CISOseries.com.

Loading summary

Transcript35 lines

[00:00]
Host
From the CISO series, it's Cybersecurity Headlines
[00:07]
Steve Prentiss
these are the cybersecurity headlines for Monday, July 20, 2026. I'm Steve Prentiss. Dairy company Fairlife suffers cyberattack the company, a subsidiary of Coca Cola, has been
[00:24]
News Reporter
forced to temporarily halt production in the
[00:26]
Steve Prentiss
US the intrusion occurred on Thursday and
[00:29]
News Reporter
the full scope of the incident isn't yet known. Coca Cola emphasized that product quality and safety had not been impacted and Fairlife's
[00:38]
Steve Prentiss
operations in Canada have not been affected.
[00:41]
News Reporter
No mention of a ransomware group or any information about a breach has yet been made. Microsoft warns of surge in ACR Stealer
[00:51]
Steve Prentiss
attacks on Customers the observed surge in attacks using the ACR Stealer malware to
[00:57]
News Reporter
steal browser stored passwords, authentication tokens and sensitive documents from its enterprise customers appears to be yet another incident of click fix social engineering. ACR Stealer is a malware is a
[01:09]
Steve Prentiss
service operation believed to be a rebranding
[01:12]
News Reporter
of the Amatera Stealer malware. This current alert highlights two different intrusion chains, one that executes a command to run a malicious DLL from a remote webdav share and another that exploits Microsoft HTML application host Abbott Labs investigates two
[01:32]
Steve Prentiss
cyber incidents amidst extortion claims the pharmaceuticals
[01:36]
News Reporter
giant is looking into two separate incidents, one after confirming unauthorized access to internal legacy Exact Sciences systems in its cancer diagnostics business, end quote. The other a separate claim that attackers breached its lab central portal and stole company data. The Shiny Hunters extortion gang has already added Abbott to its data leak site and it has set a deadline of July 21st. Ernst and Young discloses data breach after
[02:08]
Steve Prentiss
support system Intrusion the auditing and professional
[02:12]
News Reporter
services provider is notifying customers of a data breach caused by the compromise of a third party support ticket system used by its IT personnel. The company says support tickets submitted through the platform may have included documents containing client tax information. This announcement refers to anomalous activity detected on ITS networks on April 23. Investigations show that an unauthorized third party accessed the platform between March 28 and April 12 and downloaded multiple documents, which included personal and financial data used to prepare tax filings. The company has not shared the number of customers affected or the countries impacted. No ransomware or extortion groups have yet
[02:58]
Steve Prentiss
taken responsibility for the attack.
[03:03]
News Reporter
Huge thanks to our sponsor, Quiller AI. AI agents don't ask permission, they act, moving data, triggering workflows, changing systems. Quiller AI is the permission layer they never had. Its decision engine evaluates the content, context and intent of every action before it completes alerts. Tell you later. Quiller AI decides now visit quillerai that is q u I l r AI
[03:38]
Steve Prentiss
stay safe quiller it
[03:43]
News Reporter
40 sandbox floors
[03:45]
Steve Prentiss
now under active attack following up on
[03:48]
News Reporter
a story we covered in June, a pair of critical fortisandbox bugs are now
[03:53]
Steve Prentiss
confirmed as being actively exploited.
[03:56]
News Reporter
Both of these bugs carry CVSS scores of 9.1 and affect 40 sandbox, 40 sandbox cloud and 40 sandbox platform as a service. They are OS command injection flaws that allow unauthenticated attackers to execute arbitrary commands via specially crafted HTTP requests requiring neither valid credentials nor user interaction. The fact that CISA has now added both bugs to its Kev catalog means that the agency has evidence that the
[04:26]
Steve Prentiss
vulnerabilities are being actively exploited.
[04:30]
News Reporter
New WP2 shell WordPress core flaw lets unauthenticated attackers run code According to researchers at Asset Note, the Attack Surface management arm of Searchlight Cyber, an anonymous HTTP request can run code on a WordPress site. The bug is in core, so a bare install with zero plugins is exploitable. It has no preconditions and can be exploited by an Anonymous user named wp2shell that is wp the number 2 and then shell it is actually two bugs, each with CVE numbers. Every WordPress site based on versions 6.9 and 7.0 was a target up until last Friday, at which point WordPress shipped 6 and 7.0.2 and enabled what it
[05:22]
Steve Prentiss
calls forced updates through its Auto update system.
[05:28]
News Reporter
CISA adds SharePoint RCE Zero Day to
[05:31]
Steve Prentiss
kev catalog this newly patched security flaw
[05:35]
News Reporter
impacts Microsoft's SharePoint server. It has a score of 9.8 and is described as a critical deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute arbitrary code, end quote. Microsoft noted that the vulnerability is remotely exploitable over the Internet and that an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component. The flaw was entered into the Kev catalog last Thursday, and federal agencies had until yesterday Sunday to update their instances
[06:13]
Steve Prentiss
to the latest supported versions.
[06:17]
News Reporter
AI spam filters are getting fooled by
[06:20]
Steve Prentiss
old fashioned text salting According to the
[06:24]
News Reporter
cybersecurity firm Barracuda, attackers are using a long established technique known as text salting to enable phishing, emails and spam to elude new AI powered spam filters. The technique involves adding random, harmless seeming words into the body of the message to fool an AI email scanning system into thinking the message is benign, something most human readers would latch onto. Techniques also used include CSS cropping, which sets the visible window small enough that a human won't see the hidden filler text as well as zero font techniques to make these misleading words visible to the scanning software, but not to a human reader. To counter this, Barracuda recommends a layered approach to email security. Rather than relying solely on keyword detection, this includes checking sender reputation authentication results, embedded URLs, HTML rendering techniques, and differences between user visible and hidden content. If you have some thoughts on the news from today, or about this show in general, please be sure to reach out to us@feedbackisoseries.com we would love to hear from you.
[07:39]
Steve Prentiss
Steve I'm Steve Prentiss, reporting for the CISO series.
[07:46]
Host
Cybersecurity headlines are available every weekday. Head to CISoseries.com for the full stories behind the headlines.