[{"data":1,"prerenderedAt":213},["ShallowReactive",2],{"publication:en:D202607":3},{"meta":4,"copy":18,"relatedArticles":168,"terms":205,"term":206,"resourceParent":207,"glossaryParent":210},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":16,"preparedOn":17},"D202607","\u002Fblog\u002Fvulnerability-digest-2026-07","article","Website vulnerability digest for July 2026","Cybersecurity digest for July 2026","July 2026: vulnerabilities, breaches and cyber incidents","July 2026 security digest: software vulnerabilities, incidents involving Coca-Cola \u002F fairlife and Origin Energy, sources and practical checks for businesses.",[13,14,15],"\u002Fblog","\u002Fblog\u002Fvulnerability-digest-2026-06","\u002Fblog\u002Fvulnerability-digest-2026-08","2026-08-03","2026-11-06",{"intro":19,"sections":20,"checklistTitle":126,"checklist":127,"faq":130,"sources":140,"links":150,"cta":163},"July's review covers a WordPress REST-route chain, NGINX map expressions and a Node.js HTTP\u002F2 memory-safety issue. WordPress branch applicability differs, and the Node.js release was postponed before shipping on 29 July. Keep version evidence and the actual deployment time together. The issue also covers incidents involving Coca-Cola \u002F fairlife and Origin Energy, with the reported impact and checks relevant to a business using similar services.",[21,45,60,69,81,100,112,121],{"title":22,"paragraphs":23,"table":26},"Selected events and fix thresholds",[24,25],"This retrospective covers 2026-07-01 to 2026-07-31. Sources were checked on 6 November 2026. The table lists historical fix thresholds in the corresponding branches. Before deploying, choose a currently supported release or a distributor package with the relevant backport; an old fix threshold is not a recommendation to install an obsolete branch.","For the selected items, this review confirms the disclosure or security release and its stated conditions. Active exploitation and historical CISA KEV or EPSS status are not asserted here. Missing exploitation evidence remains unknown.",{"caption":27,"headers":28,"rows":32},"Selected disclosures and security releases for July 2026",[29,30,31],"Event date","Product and advisory","Fix thresholds by branch",[33,37,41],[34,35,36],"2026-07-17","WordPress | CVE-2026-63030","7.0.2 \u002F 6.9.5",[38,39,40],"2026-07-15","NGINX | CVE-2026-42533","1.31.3 \u002F 1.30.4",[42,43,44],"2026-07-29","Node.js | CVE-2026-56848","22.23.2 \u002F 24.18.1 \u002F 26.5.1",{"title":46,"paragraphs":47,"sources":50},"WordPress: REST batch routes and SQL injection (CVE-2026-63030)",[48,49],"REST API batch-route confusion can combine with a separate SQL-injection weakness and lead to code execution. The route-confusion case affects the 6.9 and 7.0 branches before the listed fixes. The July core release addresses both issues; other branches have different applicability.","Confirm the installed core branch and security backport with the maintainer. Check REST integrations, editorial access and shop workflows after the update.",[51,54,57],{"label":52,"url":53},"wordpress 7 0 2 release","https:\u002F\u002Fwordpress.org\u002Fnews\u002F2026\u002F07\u002Fwordpress-7-0-2-release\u002F",{"label":55,"url":56},"CVE-2026-63030 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-63030",{"label":58,"url":59},"WordPress advisory GHSA-ff9f-jf42-662q","https:\u002F\u002Fgithub.com\u002FWordPress\u002Fwordpress-develop\u002Fsecurity\u002Fadvisories\u002FGHSA-ff9f-jf42-662q",{"title":61,"paragraphs":62,"sources":65},"NGINX: map expressions with regex captures (CVE-2026-42533)",[63,64],"Certain map directives with regular expressions and capture-variable evaluation can overflow a heap buffer. A worker can crash; code execution requires additional ASLR-related conditions. The July notice lists a specific configuration dependency rather than every use of map.","Have the host review map expressions and the installed OSS or Plus package. Test redirects, routing and cache decisions that depend on those variables after deploying the fix.",[66],{"label":67,"url":68},"CVE-2026-42533 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-42533",{"title":70,"paragraphs":71,"sources":74},"Node.js: re-entrant HTTP\u002F2 processing (CVE-2026-56848)",[72,73],"Re-entrant HTTP\u002F2 send processing can use freed heap memory in affected Node.js 22, 24 and 26 branches. The security releases became available on 29 July after postponements. Use the actual release date when checking a deployment record, rather than an earlier planned date.","Update the runtime inside deployed images and running processes. Exercise controlled HTTP\u002F2 application traffic and confirm worker stability after restart.",[75,78],{"label":76,"url":77},"july 2026 security releases","https:\u002F\u002Fnodejs.org\u002Fen\u002Fblog\u002Fvulnerability\u002Fjuly-2026-security-releases",{"label":79,"url":80},"CVE-2026-56848 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-56848",{"title":82,"paragraphs":83,"table":85},"Breaches and cyber incidents reported this month",[84],"These cases were publicly reported during July 2026. Discovery dates are stated separately where known. The summaries retain the limits of the cited notices: an outage alone does not establish data theft, and exposed records are not automatically a count of people.",{"caption":86,"headers":87,"rows":91},"Incident notices: July 2026",[88,89,90],"Organization","Public notice","Incident",[92,96],[93,94,95],"Coca-Cola \u002F fairlife","2026-07-16","Ransomware and disruption",[97,98,99],"Origin Energy","2026-07-23","Information exposure",{"title":101,"paragraphs":102,"sources":105},"fairlife: ransomware stopped production (2026-07-16)",[103,104],"Coca-Cola's 2026-07-16 announcement linked a temporary suspension of fairlife's US production to ransomware affecting production-related systems. On July 27 it reported most production restored and confirmed that some data had been taken. Those statements did not establish a customer-password breach.","Test continuity beyond the public website: order intake, warehouse access and production interfaces may share dependencies. Include controlled restart checks and reconciliation of work performed during the outage in the recovery plan.",[106,109],{"label":107,"url":108},"The Coca-Cola Company \u002F Business Wire: incident notice","https:\u002F\u002Fwww.nasdaq.com\u002Fpress-release\u002Fcoca-cola-company-announces-technology-disruption-involving-fairlife-operations-2026",{"label":110,"url":111},"fairlife \u002F The Coca-Cola Company: incident notice","https:\u002F\u002Ffairlife.com\u002Fnews\u002Fsignificant-progress-in-restoring-fairlife-operations\u002F",{"title":113,"paragraphs":114,"sources":117},"Origin Energy: personal data and partial payment identifiers (2026-07-23)",[115,116],"On 2026-07-23, Origin confirmed unauthorized access and disclosure of some customer data. Listed categories included contact and account details and partial card or bank-account digits. The company stated those incomplete payment identifiers could not be used to make purchases or access accounts.","Review which customer fields remain in support and analytics systems. Record whether an exposed payment field is a complete credential or a partial identifier, and tailor customer advice to the actual data involved.",[118],{"label":119,"url":120},"Origin Energy: incident notice","https:\u002F\u002Fwww.originenergy.com.au\u002Fupdate-july-2026\u002F",{"title":122,"paragraphs":123},"Coverage and editorial record",[124,125],"This is a selected review for business websites and hosting, not a complete monthly vulnerability inventory. Each section links to its evidence. Public disclosure or a security release determines the coverage month; a private report date, CVE reservation year or later record edit does not determine that month.","The first edition was prepared on 6 November 2026. Current advisories may contain later corrections, so this article does not claim to reproduce their exact month-end state. No corrections are recorded for this edition. A substantive change will receive a dated note and updated article metadata.","Checks to assign to the maintainer",[49,64,73,128,129],"Record the installed package or image, the applicable condition and the person responsible for the change.","Agree backup, restart and rollback steps, then check enquiries, login and affected integrations using controlled data.",[131,134,137],{"question":132,"answer":133},"Should we install the old version listed in the table?","The numbers identify the historical fix in each branch. Select a release that is supported at deployment time, or a distributor package whose security notice confirms the backport. Record the actual installed revision.",{"question":135,"answer":136},"Does an update prove that a site was never compromised?","An update closes the affected software path. If logs, accounts or files show suspicious changes, investigate that evidence separately and verify recovery. A successful update alone does not resolve an incident.",{"question":138,"answer":139},"Why can the date of an attack differ from the digest month?","This section groups public notices by the month in which they were issued. The text states an earlier discovery date when the source provides one. A later investigation or a newly released old database is not silently presented as a new attack.",[141,142,143,144,145,146,147,148,149],{"label":52,"url":53},{"label":55,"url":56},{"label":58,"url":59},{"label":67,"url":68},{"label":76,"url":77},{"label":79,"url":80},{"label":107,"url":108},{"label":110,"url":111},{"label":119,"url":120},[151,153,155,158,161],{"path":14,"label":152},"Previous issue: June 2026",{"path":15,"label":154},"Next issue: August 2026",{"path":156,"label":157},"\u002Fblog\u002Fvulnerability-prioritization","How to prioritize vulnerabilities",{"path":159,"label":160},"\u002Fservices\u002Fsecurity-audit","Plan a website security review",{"path":13,"label":162},"All articles",{"title":164,"description":165,"button":166,"type":167},"Check which updates apply to your website","Send the website URL and the hosting or application details you know. We will agree applicability, the maintenance scope and checks after the change.","Discuss the update scope","check",[169,181,190,198],{"id":170,"path":14,"title":171,"description":172,"category":173,"artwork":174,"order":175,"publishedOn":176,"period":177,"related":178},"D202606","Cybersecurity digest for June 2026","June 2026 security digest: software vulnerabilities, incidents involving Novo Nordisk and LastPass \u002F Klue, sources and practical checks for businesses.","digest","vulnerability-digest",5,"2026-07-03","2026-06",[179,6,156,180],"\u002Fblog\u002Fvulnerability-digest-2026-05","\u002Fblog\u002Fwhy-website-updates-matter",{"id":182,"path":15,"title":183,"description":184,"category":173,"artwork":174,"order":185,"publishedOn":186,"period":187,"related":188},"D202608","Cybersecurity digest for August 2026","August 2026 security digest: software vulnerabilities, incidents involving Chubu Electric Power and SickKids, sources and practical checks for businesses.",3,"2026-09-03","2026-08",[6,189,156,180],"\u002Fblog\u002Fvulnerability-digest-2026-09",{"id":191,"path":156,"title":192,"description":193,"category":194,"artwork":195,"order":196,"publishedOn":197},"P083","Vulnerability prioritization for small business: decide what to fix first","Prioritize vulnerabilities by applicability, exposure, exploitation evidence, business impact and repair. Record an owner, decision and acceptance check.","operations","security",82,"2026-10-22",{"id":199,"path":180,"title":200,"description":201,"category":202,"artwork":202,"order":203,"publishedOn":204},"updates","How to Update WordPress Safely","To update WordPress safely, check theme, plugin and PHP compatibility, back up files and the database, and prepare a recovery procedure before changing versions. After the update, test login, forms and checkout. Pause when a critical dependency is incompatible or recovery has not been prepared.","websites",107,"2026-04-21",[],null,{"path":208,"label":209},"\u002Fresources","Website security resources and templates",{"path":211,"label":212},"\u002Fglossary","Cybersecurity glossary for small businesses",1794138524253]