17,000 attacker actions from a single AI agent. 7 KEV entries in one week. 3-day federal patch deadlines. A CVSS 9.5 exploit hitting the wild before the advisory. That was the week of July 13-19.
If last week had a theme, it is this: the gap between vulnerability disclosure and active exploitation has collapsed to near zero, and AI agents are doing the exploiting. Three separate stories this week prove that autonomous attackers are not theoretical anymore. They are live, they are fast, and they are targeting the same tools and platforms your business depends on.
Let me walk you through the stories that matter most, what they mean for SMBs, and what you should actually do about them.
ServiceNow CVE-2026-6875: The patch that arrived just in time or maybe not
On July 13, ServiceNow released fixes for a critical pre-authentication sandbox escape in their AI Platform (CVE-2026-6875, CVSS 9.5). By July 17, attackers were already exploiting it. Defused researchers observed hits against the same /assessment_thanks.do endpoint using a different sandbox-escape gadget than the published PoC. No credentials required. No user interaction needed. Just an internet-facing ServiceNow instance and you are in play.
Who should care: If you run a self-hosted ServiceNow instance, especially in IT service management, apply the July 13 patch immediately. Enable the new Guarded Script feature. And do not assume that because you are a small shop with a single instance, you are too small to target. Attackers scanning for this will not filter by company size.
CISA dropped 7 KEVs and gave some of them a 3-day deadline
CISA had a busy week. Two separate KEV updates totaling 7 actively exploited vulnerabilities, including a CVSS 10.0 SonicWall SMA1000 SSRF flaw. The July 14 batch included SonicWall SMA1000, Microsoft AD FS elevation of privilege, and Microsoft SharePoint authentication bypass. The July 16 batch added two Fortinet FortiSandbox OS command injection flaws and a second SharePoint RCE (CVE-2026-58644).
The deadlines tell the real story. Federal agencies got 3 days for some of these, not the standard 21-day window. That is how fast attackers are moving.
Three days is the new normal. If your patch cycle is measured in months, you are already behind.
Who should care: SonicWall SMA appliances (popular for remote access), any self-hosted SharePoint, FortiSandbox deployments, and Microsoft AD FS. Check your versions. If you are using any of these, this week's priority list just wrote itself.
libssh2 RCE (CVE-2026-55200): The one you will not see coming
This one is insidious. A critical out-of-bounds write in the libssh2 library (versions through 1.11.1, CVSS 9.2) lets a malicious SSH server corrupt heap memory on any connecting client. Public PoC exploit is already out. And this is not just a curl or Git problem. libssh2 lives in PHP, backup agents, deployment scripts, CI runners, CRM integrations. A compromised dependency or a man-in-the-middle attack on an SSH connection can turn any of these into a beachhead.
Who should care: Everyone. Seriously. If you have ever written a script that connects over SSH, or deployed software that does, libssh2 is probably in the stack somewhere. Update to 1.12.0 and scan your environment for anything linking libssh2. The list will surprise you.
Hugging Face: An AI agent did all of this in one weekend
Hugging Face disclosed a breach that reads like a cybersecurity fiction script. An autonomous AI agent infiltrated their production infrastructure over a single weekend. It entered through a malicious dataset exploiting two code-execution paths, escalated privileges, harvested cloud and cluster credentials, and moved laterally across internal clusters. Hugging Face's forensic team reconstructed more than 17,000 individual attacker actions. The agent used short-lived sandboxes with self-migrating C2 on public services. No human was at the keyboard.
Here is a detail I find wild: commercial AI models refused to help with forensic analysis because their safety filters flagged the real attack payloads as harmful content. The team had to switch to open-weight models to analyze what happened.
Who should care: This is the second major "AI ran the whole attack" incident this month. We saw the same pattern last month with a botnet compromise in six minutes. These agents operate at machine speed, adapt in real time, and do not make human errors. For SMBs, the defense is still the fundamentals: strong authentication, least privilege, network segmentation, and monitoring for anomalous action volume. You do not need AI to defend against AI yet, but you do need the basics locked down tight.
23andMe pays $18M: Credential stuffing is still the cheapest attack
A coalition of 42 state attorneys general secured an $18 million settlement from 23andMe over the 2023 breach that exposed genetic data of 6.9 million customers. The investigation found the company had no password blocklisting, no mandatory MFA, no rate limiting, and no intrusion detection. The breach went undetected for 5 months. Courts also approved a separate $46.75 million class-action settlement.
The most telling detail? 23andMe initially tried to blame customers for password reuse. The regulators were not buying it.
Who should care: Any business with customer-facing or employee-facing authentication. The three controls the investigation specifically called out (MFA enforcement, breached-password blocklisting, rate limiting) are the same gaps found in almost every credential-stuffing postmortem. If you are missing any of these, this settlement is a data point for prioritizing the fix.
Quick hits: Abbott, ClickLock, and everything else
A few more stories worth your attention:
Abbott Laboratories is investigating two separate cyber incidents simultaneously, including a breach of legacy Exact Sciences systems from a prior acquisition and a separate LabCentral portal compromise. The lesson: every acquisition inherits someone else's security debt.
ClickLock Stealer targets macOS users by killing apps every 210ms until the victim types their password. Combined with the broader DriveSurge operation that compromised thousands of legitimate websites using ClickFix lures, this is a reminder that your employees are the front line. If a website tells you to copy-paste a command into a terminal, stop and call IT.
Oracle EBS (CVE-2026-46817) received an unusually compressed 3-day CISA remediation deadline, reflecting active exploitation. If you run Oracle EBS in your mid-market environment, patch it this week.
CISA's own GitHub leak exposed AWS GovCloud keys in a public repo for six months before KrebsOnSecurity found them. The most secure agency in the US government made the same mistake your team could make tomorrow. Enable secret scanning, use pre-commit hooks, and rotate keys on a schedule.
The bottom line
If there is one sentence to take away from this week, it is this: attackers are faster than they have ever been, and they are getting faster. The Hugging Face breach showed an AI agent completing an entire attack chain in days. CISA is compressing patch deadlines to three days. The gap between disclosure and exploitation is shrinking to zero.
The good news? The defenses that stop these attacks are not exotic. They are the same fundamentals we have been talking about for years: patch quickly, authenticate strongly, monitor your environment, and train your people. The difference is that now, you need to do them faster and more consistently than ever before.
Not sure your defenses are keeping pace? Let us take a quick look.
Book a 15-minute security check
No pitch, no obligation. Just a straight answer about where you stand.