Microsoft shipped an out-of-band update to the Microsoft Malware Protection Engine on July 8, raising the version to 1.1.26060.3008 and closing CVE-2026-50656. The vulnerability, publicly known as RoguePlanet, was disclosed by the researcher going by Nightmare Eclipse on June 16 alongside a working proof-of-concept exploit. The flaw exploits a race condition and an improper link resolution before file access in the Microsoft Defender Malware Protection Engine, allowing any low-privileged local user to spawn a command shell with SYSTEM-level privileges on fully patched Windows 10 and Windows 11 machines. The proof of concept works regardless of whether Defender's real-time protection is enabled or disabled, making it viable even on machines where security teams attempted to detect or block it by toggling the agent.

Nightmare Eclipse noted that small changes to the proof of concept could bypass signature-based mitigations that vendors attempted to build, and stated that the only effective defensive action was to wait for the patch. Microsoft did not acknowledge Nightmare Eclipse as the discoverer in its advisory, continuing a public dispute over the company's vulnerability disclosure process and bug bounty program that has driven the researcher to release eight zero-days since March 2026. Three earlier Nightmare Eclipse flaws, including BlueHammer, RedSun, and UnDefend, were exploited in the wild before patches shipped. Microsoft has not confirmed exploitation of RoguePlanet specifically, though the 23-day window with public exploit code is among the longest unpatched zero-day windows this researcher's disclosures have produced.

Nebula Security's VEGA team disclosed GhostLock on July 7, 2026, a use-after-free vulnerability in the Linux kernel's real-time mutex (rtmutex) code that has shipped in every mainstream Linux distribution since kernel 2.6.39 in May 2011. The bug lives in the remove_waiter() function in the futex priority inheritance code. The function assumes the thread cleaning up a lock is the same thread that was waiting on it. The Requeue-PI feature added years later broke that assumption without updating the cleanup logic, leaving a dangling pointer to freed stack memory that an attacker can reclaim and use to hijack kernel control flow. The exploit is 97 percent reliable, takes approximately five seconds, requires no special permissions, no capabilities, and no user namespaces, and also escapes Docker, Podman, LXC, and Kubernetes container isolation. Google awarded Nebula $92,337 through the kernelCTF program.

GhostLock is one half of a chain Nebula calls IonStack. The first half is CVE-2026-10702, a flaw in Firefox's IonMonkey JIT compiler patched in Firefox 151.0.3 on June 2. Chained together, IonStack eliminates the local-foothold requirement: a single tap on a malicious link in Firefox on Android was sufficient to reach full device root in Nebula's demonstration. Nebula has published working exploit code. Distribution patches are in progress but uneven. Ubuntu has patched some releases and cloud kernels, with 24.04, 22.04, and 20.04 LTS still listed as vulnerable or in progress as of early July. Check your distribution's advisory and confirm the fixed package version rather than assuming the update is waiting.

The AI Now Institute published Friendly Fire on July 8, a proof-of-concept demonstrating that autonomous AI coding agents tasked with scanning open-source repositories for security vulnerabilities can be manipulated into executing the malicious code they identify rather than reporting it. The attack embeds natural-language instructions inside malicious code comments or README content that instruct the agent to run specific commands as part of its analysis workflow. Against Claude Code and OpenAI Codex in autonomous modes that allow self-approval of tool calls, the agents ran the embedded commands and confirmed execution. AI Now describes the root vulnerability as a trust boundary failure: agents that are authorized to read code and run analysis tools treat attacker-controlled content as equivalent to user instructions.

Separately, Wiz Research published GhostApproval on July 8, documenting a symlink-based attack against six popular AI coding assistants that allows a malicious repository to take control of a developer's machine. A booby-trapped repository includes a symlink pointing outside the project directory. When an AI agent follows the symlink while auditing or processing the repository, it executes code outside the sandboxed project context, reaching the developer's file system and environment variables. Wiz confirmed the attack works against six tools in their testing. Both Friendly Fire and GhostApproval target developers in the specific workflow mode, autonomous or semi-autonomous code review, where AI agents provide the most productivity value and receive the most trust.