Ransomware Dominates, MFA Bypass, and Critical OT Vulnerabilities Highlight Cybersecurity Landscape

This daily summary covers significant cybersecurity developments, with ransomware continuing its reign as a primary threat. A new report indicates identity-based attacks are the root cause for 79% of ransomware incidents, with 97% of victims using compromised credentials having MFA deployed, underscoring the need for phishing-resistant MFA and advanced Identity Threat Detection and Response (ITDR) solutions. Manufacturing remains a top target, with ransomware attacks rising 20% year-over-year in H1 2026, and attacks on large enterprises surging by 74%.

Critical vulnerabilities are also under active exploitation. CISA has added a critical RCE flaw in Oracle E-Business Suite (CVE-2026-46817) to its KEV catalog, mandating federal agencies to patch by July 18, 2026. Additionally, a SharePoint RCE zero-day (CVE-2026-58644) is being exploited in the wild, with CISA urging all organizations to update systems. A new 'LegacyHive' Windows zero-day LPE exploit has been published online, allowing local privilege escalation.

High-profile incidents include a ransomware attack on Coca-Cola's Fairlife subsidiary, halting U.S. milk production, and a cyberattack on Japan's Nichirei Corporation, disrupting the food supply chain and impacting KFC Japan. Data from a contractor of India's largest nuclear plant was leaked by a ransomware group. Government agencies were hit by ransomware daily in H1 2026, with a 13% increase from the previous period.

New security tools are emerging to address evolving threats, including solutions for deepfake detection, risky OAuth management, and securing AI agents. Finally, a chain of three zero-day vulnerabilities in Siemens ROX II OT switches allows for full root access, posing a significant risk to critical infrastructure operations. Siemens has released firmware updates to address these issues.