Top Cybersecurity Developments: GoldenEyeDog Breach, SharePoint Zero-Day, and GOLD EAGLE Initiative | July 17 2026

Cybersecurity researchers have linked the April 2026 DigiCert breach to the GoldenEyeDog subgroup (also called CylindricalCanine), responsible for stealing code-signing certificates. This incident highlights ongoing threats to digital certificate security and the risks posed by sophisticated hacker groups.

A critical vulnerability named wp2shell was discovered in WordPress core that allows unauthenticated attackers to execute arbitrary code. This flaw affects millions of WordPress sites worldwide and enables attackers to compromise site security without needing login credentials.

The OpenSSL HollowByte vulnerability enables attackers to send specifically crafted 11-byte TLS requests that can freeze server memory, threatening server stability and security. The flaw, reported in July 2026, could disrupt critical services reliant on OpenSSL before it was patched.

Ernst & Young (EY), a major professional services firm, suffered a cybersecurity breach affecting its operations. The incident emphasizes the growing vulnerabilities and risks faced by large institutions in the current cyber threat landscape.

Coca-Cola halted production of its U.S. Fairlife milk brand following a cyberattack that disrupted its operational systems. The attack impacted supply chain activities, underscoring the operational risks posed by cyber intrusions on major consumer goods companies.

The Cybersecurity and Infrastructure Security Agency (CISA) issued an alert about actively exploited vulnerabilities in SharePoint software. These weaknesses are being leveraged by hackers, prompting urgent calls to patch systems to prevent potential data breaches.

The White House launched the GOLD EAGLE AI cybersecurity clearinghouse initiative designed to protect financial institutions from emerging and sophisticated cyber threats. Introduced in July 2026, this effort aims to centralize AI-driven threat intelligence and improve sector-wide resilience.

Researchers identified seven malicious npm packages targeting the Vite ecosystem that use blockchain-based command and control servers to deliver remote access trojans (RATs). This attack vector illustrates novel supply chain threats leveraging decentralized blockchain technologies.

The NadMesh botnet has been discovered actively hunting exposed AI services, cloud keys, and Kubernetes tokens, with claims of accessing 3,811 AWS keys. It uses tools like Shodan to scan platforms such as ComfyUI and Gradio, posing a significant threat to cloud infrastructure security.

CISA has added the recently exploited SharePoint remote code execution zero-day vulnerability CVE-2026-58644 to its Known Exploited Vulnerabilities catalog, requiring U.S. federal agencies to patch systems by July 19, 2026, amid ongoing active exploitation.