Cybersecurity Updates July 25, 2026: Fastjson Exploits, Cl0p Attacks, and Android NFC Surge

A security vulnerability in the Vatican’s 'Click to Pray' app has been leaking user data for over six months, affecting more than 700,000 users worldwide. The flaw remains unpatched, exposing sensitive information globally as of July 2026.

Threat actors are actively exploiting a critical remote code execution (RCE) vulnerability (CVE-2026-16723) in Fastjson 1.x, Alibaba’s Java JSON library, impacting Spring Boot applications worldwide. No patch is currently available to mitigate this exploit as of late July 2026.

AI tools like ChatGPT and Claude are increasingly used by cybercriminals, even those without cybersecurity experience, to exploit vulnerabilities and gain unauthorized access to systems. This trend has significantly expanded the cyber threat landscape over the past two years.

The Chrome extension 'Planet Search', with 2 million installs, has been discovered routing all user queries through the nextgeeker[.]com hijacker network secretly. This malicious behavior compromises user privacy and security despite the extension's minimal permissions.

Cl0p ransomware affiliates are exploiting unauthenticated remote code execution vulnerabilities in internet-exposed PTC Windchill and FlexPLM systems to conduct data extortion attacks. These campaigns signify ongoing targeted assaults on enterprise software platforms as of July 2026.

Cyber attackers are targeting the unpatched Fastjson 1.x remote code execution vulnerability, raising significant concern over potential widespread exploits. The lack of remedial measures exacerbates the risk for systems using this library.

Research by CTM360 reveals that phishing attacks targeting insurance companies have evolved into real-time account hijacking, representing a more aggressive and immediate form of cybercrime. This development marks a shift in tactics beyond stealing credentials to direct control over victims’ accounts.

Operators of the DevMan ransomware-as-a-service (RaaS) platform have launched a centralized web portal that enables affiliates to easily build ransomware payloads, manage their victims, and oversee affiliate payouts. This level of infrastructure sophistication indicates the increasing commercialization of ransomware operations.

Cobalt has introduced an autonomous pentesting tool designed to provide continuous offensive security testing in modern development environments. This innovation aims to improve ongoing vulnerability detection and mitigation practices starting July 2026.

Android NFC cyberattacks surged by 188%, exposing serious security vulnerabilities in contactless technologies and payment systems. This sharp increase underscores escalating threats against NFC-enabled devices as of mid-2026.