Abbott and EY Breaches, OpenSSL HollowByte, Windows LegacyHive, and IBM Langflow RCEs Lead July 18 Threat Digest

Top Stories

Abbott probes two cyber incidents amid extortion claims

Abbott Laboratories is investigating two separate cyber incidents, including unauthorized access involving legacy Exact Sciences systems in its Cancer Diagnostics business and a separate claim that attackers accessed the LabCentral portal and stole company data, according to BleepingComputer (source).

So what?
Healthcare and diagnostics environments remain high-impact targets because they combine regulated data, lab operations, and distributed vendor ecosystems. Even if the incidents are still under investigation, defenders in similar sectors should assume that legacy business-unit systems and customer-facing portals are both attractive entry points.

What to do next - Review authentication and admin activity on externally accessible lab, diagnostics, and partner portals. - Pull access logs for legacy acquisitions or inherited platforms that may not follow current IAM standards. - Hunt for abnormal data export patterns, especially ZIP, CSV, and PDF bulk downloads. - Validate whether any SSO integrations, API keys, or service accounts tied to acquired business units remain active.

Technical Notes

Example log review approach for suspicious portal access in common reverse proxy or web server logs:

grep -E "POST /login|/api/|/export|/download" /var/log/nginx/access.log \
  | awk '{print $1, $4, $7, $9, $10, $12}' \
  | sort | uniq -c | sort -nr | head -50

Quick indicators to review: - Successful logins from new geographies - Repeated MFA failures followed by success - Large response sizes on export endpoints - Access to dormant admin pages or support workflows

---

HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload

BleepingComputer reported a denial-of-service issue dubbed HollowByte that can cause OpenSSL server memory growth using a payload as small as 11 bytes (source).

So what?
A low-bandwidth memory exhaustion condition is operationally dangerous. It lowers attacker cost and increases the chance that internet-facing TLS services can be destabilized without high traffic volumes. This matters most for load balancers, reverse proxies, APIs, and edge services that rely on affected OpenSSL-backed implementations.

What to do next - Identify all internet-exposed systems using vulnerable OpenSSL builds or products linked to the issue. - Rate limit new TLS connections at the edge where possible. - Monitor resident memory growth on front-end services. - Stage patching and failover validation before pushing changes to high-availability clusters.

Technical Notes

Find OpenSSL versions on Linux hosts:

openssl version -a

Check package inventory on Debian/Ubuntu:

dpkg -l | grep -i openssl

Check package inventory on RHEL-compatible systems:

rpm -qa | grep -i openssl

Monitor memory growth for a suspected service:

watch -n 2 'ps -o pid,ppid,%mem,%cpu,rss,vsz,cmd -C nginx -C apache2 -C haproxy'

If you terminate TLS at NGINX or HAProxy, review connection surge protections, for example:

limit_conn_zone $binary_remote_addr zone=perip:10m;
limit_conn perip 20;
client_header_timeout 10s;
client_body_timeout 10s;
keepalive_timeout 15s;

---

Ernst & Young discloses data breach after support system hack

Ernst & Young disclosed a customer data breach tied to the compromise of a third-party support ticket system used by IT personnel, according to BleepingComputer (source).

So what?
Third-party support tooling remains a recurring weak point because it often stores screenshots, diagnostics, email threads, and customer identifiers. Compromise of support platforms can turn a single vendor-side foothold into multi-client exposure.

What to do next - Review all outsourced support and ticketing providers for data minimization and retention settings. - Rotate credentials or tokens that may have appeared in attachments or ticket comments. - Search helpdesk exports for secrets, hostnames, architecture diagrams, and user data. - Require separate admin accounts and MFA for support staff accessing enterprise environments.

Technical Notes

A quick search pattern for secrets in exported ticket data:

grep -RniE "(password|apikey|api_key|secret|token|bearer|private key|BEGIN RSA|BEGIN OPENSSH)" ./ticket-export/

Questions to ask vendors today: - Was data at rest encrypted? - Were attachments included in the compromise scope? - Were OAuth tokens or session cookies stored in tickets? - What log retention is available for investigator review?

---

New Windows LegacyHive zero-day gives hackers admin privileges

BleepingComputer reported on a Windows privilege escalation zero-day called LegacyHive, with a researcher claiming it can grant admin access on fully updated Windows systems (source).

So what?
Privilege escalation flaws matter because they turn phishing, malware, or low-privilege access into full host compromise. Even without broad exploitation confirmation, defenders should treat publicly discussed Windows local privilege escalation claims as post-compromise force multipliers.

What to do next - Tighten endpoint detection around token manipulation, service creation, scheduled tasks, and registry hive access. - Restrict local admin sprawl and validate LAPS or equivalent controls are working. - Review recent detections where malware was blocked but initial execution succeeded. - Prioritize credential guard, attack surface reduction rules, and application control on high-value endpoints.

Technical Notes

Useful Windows triage commands:

whoami /priv
Get-LocalGroupMember -Group "Administrators"
schtasks /query /fo LIST /v
wevtutil qe Security /q:"*[System[(EventID=4672 or EventID=4688)]]" /f:text /c:50

Behavior to monitor: - New processes spawned by low-privilege users that quickly open service control manager handles - Unexpected writes to sensitive registry hives - Short-lived scheduled tasks - Parent-child chains such as Office -> script host -> LOLBin -> system utility

---

New wp2shell WordPress Core flaw lets unauthenticated attackers run code

Google News surfaced reporting from The Hacker News about a wp2shell WordPress Core issue that allegedly enables unauthenticated code execution (source).

So what?
An unauthenticated WordPress core-level code execution claim is severe because of WordPress internet exposure across SMB, agency, publishing, and ecommerce environments. However, defenders should confirm vendor guidance and patch availability before making broad-impact changes.

What to do next - Inventory internet-facing WordPress sites, including shadow IT microsites and marketing properties. - Temporarily reduce attack surface: disable unnecessary plugins, limit XML-RPC if not needed, and enforce WAF coverage. - Watch for new admin users, modified theme files, unexpected PHP under uploads, and cron abuse. - Validate backups and restoration procedures before emergency patching.

Technical Notes

Find suspicious PHP files in uploads directories:

find /var/www -type f -path "*/uploads/*" -name "*.php" -ls

Review recently changed WordPress files:

find /var/www/html -type f -mtime -2 | sort

Search for newly created admin accounts in WordPress database:

SELECT u.ID, u.user_login, u.user_email, um.meta_value
FROM wp_users u
JOIN wp_usermeta um ON u.ID = um.user_id
WHERE um.meta_key = 'wp_capabilities';

---

iPhone hacking firm sues ex-worker over alleged theft of secrets

Bloomberg reported that an iPhone hacking firm sued a former employee over alleged theft of trade secrets, surfaced via Google News (source).

So what?
This is less of an immediate patching story and more of a reminder that insider risk and developer offboarding remain critical for firms handling offensive security research, exploit development, mobile telemetry, or sensitive customer tooling.

What to do next - Audit source code repository access and dormant SSH keys. - Ensure offboarding includes device collection, token revocation, and cloud access review. - Monitor for unusual cloning of high-sensitivity repositories or late-stage bulk downloads. - Reassess NDAs, contractor access, and secrets management around research environments.

---

CrowdStrike acquires XM Cyber’s technology five years after its $700 million sale

Calcalist Tech reported that CrowdStrike acquired XM Cyber’s technology, as surfaced via Google News (source).

So what?
This is a market signal rather than a directly exploitable event. Exposure management, attack path analysis, and adversary-informed prioritization remain strategic buying themes. Security leaders should expect more platform consolidation around identity, cloud posture, and lateral movement mapping.

What to do next - Review whether your current stack already covers attack path visibility before adding overlapping tools. - Use this news as leverage to revisit exposure prioritization workflows, not just tooling budgets. - Ensure asset inventory, identity graphing, and privilege mapping feed into remediation decisions.

---

Windows Server 2022 reaches end of mainstream support in 90 days

Microsoft announced that Windows Server 2022 will hit the end of mainstream support in October 2026, while extended support and security updates will continue for five more years, per BleepingComputer (source).

So what?
This is not an immediate security update cutoff, but it is an operational planning milestone. Mainstream support ending often affects feature velocity, support assumptions, and upgrade planning for dependent applications.

What to do next - Confirm lifecycle status in your CMDB and infrastructure roadmap. - Identify workloads that cannot tolerate in-place changes and require parallel migration. - Validate vendor support matrices for apps running on Server 2022. - Separate lifecycle planning from urgent patching so the support milestone does not get ignored.

Technical Notes

PowerShell checks for OS version and install data:

Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
  Select-Object ProductName, DisplayVersion, CurrentBuild

---

Critical Vulnerabilities

IBM Langflow OSS vulnerabilities demand immediate review

IBM published multiple critical advisories affecting Langflow OSS versions 1.0.0 through 1.10.0, each with CVSS 9.9 severity. References are available directly from IBM support pages:

• CVE-2026-9135: Code injection in Policies component ToolGuard integration that can bypass allow_custom_components=false, leading to server-side Python execution by authenticated users with flow creation privileges (IBM advisory).
• CVE-2026-8476: Remote code execution through unsafe pickle.loads() deserialization in disk-based caching (IBM advisory).
• CVE-2026-8481: Remote code execution via the /api/v1/validate/code endpoint using Python exec() on user-supplied code (IBM advisory).
• CVE-2026-8635: Privilege escalation to superuser through direct database manipulation, with potential command execution and full compromise (IBM advisory).
• CVE-2026-8859: Path traversal in the APIRequest component’s “Save to File” handling, allowing arbitrary file writes (IBM advisory).

So what?
This cluster is especially important because Langflow is used in AI workflow and agentic app environments where users often grant broad network access, connect internal APIs, and store secrets. Even where exploitation requires authentication or special workflow permissions, the blast radius can be high.

What to do next - Determine whether Langflow OSS is deployed anywhere in production, labs, or developer platforms. - Restrict external access immediately if instances are internet exposed. - Rotate secrets stored in flows, connectors, or environment variables if compromise is suspected. - Review whether custom components, code validation features, or file-save workflows are enabled. - Patch or follow IBM remediation guidance as soon as change control permits.

Technical Notes

Quick discovery examples:

docker ps --format '{{.Names}} {{.Image}}' | grep -i langflow
kubectl get pods -A | grep -i langflow

Look for suspicious endpoint access in application or reverse proxy logs:

grep -RniE "/api/v1/validate/code|update_flow_component_field|Save to File|ToolGuard" /var/log/

If you need to identify internet exposure from a host:

ss -lntp | grep -E ":7860|:80|:443"

High-risk patterns to review: - Requests to /api/v1/validate/code - Unexpected writes under temp directories or app data paths - New or modified flows created by low-trust users - Outbound network calls from the Langflow service to unapproved hosts

A simple reverse proxy restriction pattern for internal-only access:

location / {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://langflow_backend;
}

---

What Defenders Should Do Today

1. Triage internet-facing exposure first

Focus on services with direct external reach: - OpenSSL-backed TLS endpoints potentially affected by HollowByte - WordPress sites, especially unmanaged or agency-run properties - Langflow OSS instances exposed to the internet - Customer or partner portals similar to those implicated in the Abbott and EY stories

2. Hunt for signs of credential misuse and data staging

Prioritize: - Admin logins from rare geographies - Large downloads from support, diagnostics, or portal platforms - Webshell-like PHP artifacts in WordPress - Short-lived privilege escalation artifacts on Windows endpoints

3. Patch, isolate, or restrict before full root-cause certainty

For high-risk assets, reducing exposure is often the right first move: - Put vulnerable apps behind VPN or SSO - Disable risky features not required for operations - Tighten WAF and rate-limiting controls - Segment AI workflow tools from production secrets and east-west access

4. Recheck third-party support and inherited systems

Both breach stories reinforce a familiar lesson: - Third-party support systems can become a client data exposure channel - Acquired or legacy business platforms can lag in IAM, logging, and hardening

5. Validate recovery paths

Before emergency changes: - Confirm backups are current and restorable - Snapshot critical VMs or containers where appropriate - Preserve logs before rotation - Capture volatile evidence from suspected compromised hosts

Technical Notes

Quick Linux triage bundle:

date
hostname
who
last -a | head
ss -pant
ps auxwf --sort=-%mem | head -40
df -h
journalctl -p err -n 100

Quick Windows triage bundle:

Get-Date
hostname
quser
Get-Process | Sort-Object WS -Descending | Select-Object -First 25
Get-NetTCPConnection | Sort-Object State,LocalPort
Get-WinEvent -LogName Security -MaxEvents 100 | Format-List

---

Bottom Line

Today’s cybersecurity threats picture is a mix of confirmed breach fallout, potentially disruptive service-level weakness, and critical application-layer risk in AI tooling. The most practical priorities for July 18 are to review exposed OpenSSL services, verify WordPress and Windows hardening, and urgently assess whether IBM Langflow OSS exists anywhere in your environment.

For many teams, the fastest risk reduction today is not a perfect investigation. It is cutting unnecessary exposure, tightening access, and verifying that logs, backups, and response workflows are ready before the next alert arrives.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.