Breaches, patches, malware & threat intel • 19 July 2026
▶ Update 7-Zip Now: New Flaw Lets Booby-Trapped Archives Run Code on Your PC
Category: Vulnerabilities & Patches
Summary
A newly patched flaw in 7-Zip, the hugely popular free file-archiving tool, could let attackers run their own code on your computer if you open a malicious archive. Because 7-Zip is bundled into so many workflows and doesn't always update itself automatically, plenty of people are running older, vulnerable versions without realising it. The fix is already available, so the safest move is to grab the latest release directly from the official 7-Zip site rather than waiting. If you regularly handle ZIP, 7z or RAR files from email or downloads, treat this as a priority update.
Why it matters to you
- Opening a single rigged archive could be enough to compromise your PC
- 7-Zip rarely auto-updates, so you likely need to update it by hand
- Download only from the official site to avoid fake "updater" traps
▶ WordPress Site Owners: Patch the "wp2shell" Flaw Before Attacks Ramp Up
Category: Vulnerabilities & Patches
Summary
Security researchers have flagged remote-code-execution flaws in WordPress core dubbed "wp2shell," and working exploit code is now public — which usually means opportunistic attacks pick up fast. Anyone who runs a WordPress site, from small blogs to shops, should update core immediately and confirm the patch actually applied. Public exploits lower the bar dramatically, letting even low-skill attackers hijack unpatched sites to steal data, inject spam or plant malware that then infects visitors. If you use managed hosting, check whether the update was pushed for you; if you self-host, don't delay.
Why it matters to you
- Public exploit code means attacks on unpatched sites are likely imminent
- A hijacked site can quietly infect the customers who trust it
- Confirm the patch applied — don't assume auto-updates handled it
▶ Microsoft Sounds Alarm on ACR Stealer: Password-Grabbing Malware Is Spreading Fast
Category: Malware & Threats
Summary
Microsoft says it's seeing a surge in attacks using ACR Stealer, malware built to quietly harvest saved passwords, browser cookies, crypto wallets and other sensitive data from infected PCs. Info-stealers like this typically spread through cracked software, fake downloads and booby-trapped links, then get sold on to other criminals who use the stolen logins for fraud and account takeovers. The best defence is boring but effective: avoid pirated apps and sketchy downloads, keep your security software on, and turn on multi-factor authentication so a stolen password alone isn't enough.
Why it matters to you
- One infection can hand over every password saved in your browser
- Stolen logins fuel account takeovers and financial fraud
- MFA and avoiding pirated software dramatically cut your risk
▶ Plot Twist: "Prompt Injection" Is Tripping Up AI Hacking Bots
Category: AI Security
Summary
A new report highlights an unexpected wrinkle in AI-powered cyberattacks: the same "prompt injection" tricks that let people manipulate chatbots are also derailing autonomous AI "hacking agents." Because these agents read text as they work, defenders can plant hidden instructions that confuse or redirect them, blunting automated attacks. It's an early sign that as attackers lean on AI to scale up, defenders are finding creative ways to fight back on the same terrain. For everyday users it's a reminder that AI-driven threats are real but not unstoppable — and that this arms race is only getting started.
Why it matters to you
- AI is now used on both sides of hacking, not just by attackers
- Defenders are already finding ways to sabotage automated attacks
- Expect AI security to shape the threats you face in coming years
▶ Your Period-Tracking App Might Be Quietly Sharing Your Most Private Data
Category: Privacy
Summary
A new report warns that many period- and fertility-tracking apps collect far more personal information than users expect — and some share or sell it to third parties. That can include intimate details about your health, cycles and activity, data that's especially sensitive and hard to claw back once it's out. If you use one of these apps, it's worth checking its privacy settings, trimming permissions, and considering privacy-focused or offline alternatives that store data only on your device. At a minimum, read what the app says it does with your information before you keep feeding it more.
Why it matters to you
- Highly sensitive health data may be shared or sold without you realising
- Check permissions and privacy settings before trusting any tracker
- Offline, on-device apps keep intimate data out of company hands
▶ Shark Vacuum Owners: A Flawed Amazon Policy Could Expose Millions of Users' Data
Category: Privacy
Summary
A report claims a flawed Amazon-linked policy tied to Shark's smart vacuums could make it easy to expose the personal data of millions of users. Connected home gadgets often tie into your account, home network and app profile, so a weakness in how that data is handled can leak far more than you'd expect from a "vacuum." If you own a Wi-Fi-connected Shark device, keep the app updated, review what account info and permissions it has, and watch for any official guidance. It's a fresh reminder that every smart appliance is also a data collector.
Why it matters to you
- Smart vacuums hold more personal and account data than people assume
- A single policy flaw can put millions of users at risk at once
- Review app permissions on every connected device you own
▶ New Age-Verification Tech Promises Your Face Never Leaves Your Device
Category: Privacy
Summary
As more sites and apps are pushed to verify users' ages, a new approach aims to do it without shipping your face or ID off to a company's servers — the check happens on your own device, and only a yes/no result is shared. That's a meaningful privacy upgrade over uploading selfies or documents to third parties who could store or leak them. It won't end the debate over age checks, but for everyday users it points to a less invasive path. If you're asked to prove your age online, it's worth knowing on-device options like this exist.
Why it matters to you
- On-device checks avoid uploading your face or ID to strangers
- Only a pass/fail result leaves your phone, not your biometrics
- A more private alternative as age-verification rules spread online
▶ I Cloned My Own Voice in 5 Seconds — Here's Why That Should Worry You
Category: Scams & Awareness
Summary
A writer describes cloning their own voice from just five seconds of audio, no fancy hardware required — and coming away rattled. The same ease that makes voice AI fun also powers "family emergency" scams, where crooks fake a loved one's voice to demand money or information over the phone. The practical takeaway: treat urgent, emotional phone calls with healthy skepticism, especially requests for cash or codes. Agree on a family "safe word," and verify by calling the person back on a number you already know. As cloning gets trivially easy, a familiar voice is no longer proof of who's really calling.
Why it matters to you
- Scammers can now fake a loved one's voice from seconds of audio
- Urgent "it's me, send money" calls deserve extra suspicion
- A family safe word and callback habit beat trusting a voice alone