Week of July 13, 2026: Russian router warnings, SonicWall and ShareFile zero-days

Security leaders tracked a wave of Russian state-sponsored targeting advisories, new EU and UK sanctions against Russian cyber operators, and actively exploited zero-days in SonicWall SMA appliances and Progress ShareFile across July 13-19, 2026. River Financial Corporation disclosed additional securities litigation tied to a network intrusion, Lidl confirmed a vendor breach exposing customer data across three countries, and CISA expanded its Known Exploited Vulnerabilities catalog with entries including a Microsoft SharePoint flaw.

River Financial faces more litigation over network intrusion

River Financial Corporation, parent of River Bank & Trust, filed a Form 8-K/A reporting additional securities litigation connected to a previously disclosed network intrusion. A third class action was filed against the company on July 10, 2026, and a fourth followed on July 16, 2026, with plaintiffs disputing whether attackers accessed customers' personally identifiable information. As of the July 17, 2026 filing, River stated it had not yet determined the full nature, scope, or financial materiality of the incident, and said it would amend the report once that assessment was complete. (SEC EDGAR)

Lidl notifies customers after IT provider breach

German discount retailer Lidl told customers in Germany, Belgium, and the Netherlands that attackers who breached one of its IT service providers gained brief access to a separately stored file and stole some of the customer data it contained, while the online shop system itself remained unaffected. Exposed data included names, phone numbers, email addresses, dates of birth, customer numbers, and salutations, with passwords, billing and delivery addresses, and payment details also possibly compromised. Lidl said customer accounts were not affected and notified the relevant data protection authority. (Help Net Security)

EU and UK sanction Russian cyber operators

The EU and UK jointly imposed sanctions on Russian individuals and entities accused of coordinating a cyber ecosystem targeting Europe, with the UK sanctioning 24 individuals and entities and the EU restricting nine individuals and four entities. The measures tied the 16th Centre of Russia's Federal Security Service to campaigns against government networks and critical infrastructure, including a December 29, 2025 data-wiping attack on Polish wind and solar farms, a combined heat and power plant, and a manufacturing company. The UK also sanctioned individuals linked to Lumma Stealer, which the National Crime Agency tied to at least 2,100 UK victims over six months. (Help Net Security)

CISA, NSA, FBI warn of Russian targeting of networking devices

CISA joined NSA, FBI, the Department of Defense Cyber Crime Center, and international partners in releasing a joint advisory on Russian government-sponsored activity targeting vulnerable networking devices across critical infrastructure sectors, including communications, defense industrial base, energy, financial services, government services, and healthcare. The advisory attributed the activity to FSB Center 16 and described actors exploiting poorly configured routers and select CVEs to exfiltrate configuration data. Authoring agencies urged network defenders to restrict management interface access, strengthen authentication and encryption, secure internet-facing systems, and monitor for suspicious activity. (CISA)

SonicWall patches SMA 1000 zero-days under active attack

SonicWall patched two actively exploited vulnerabilities, CVE-2026-15409 and CVE-2026-15410, affecting its SMA 1000 Series secure remote access appliances after confirming attacks chaining a server-side request forgery flaw with a code injection flaw to achieve remote code execution. The company issued firmware hotfixes ahead of public disclosure and urged customers to check for indicators of compromise, re-image or re-deploy affected appliances, reset passwords, and rotate TOTP tokens if compromise was found. CISA added both flaws to its Known Exploited Vulnerabilities catalog and directed federal civilian agencies to remediate by July 17, 2026. (Help Net Security)

Progress disables ShareFile accounts over security threat

Progress Software disabled customer access to ShareFile accounts using on-premises Storage Zone Controllers after identifying a credible external security threat, emailing customers on July 10, 2026 to manually shut down affected servers. An update on July 14, 2026 confirmed a high-severity path traversal vulnerability in ShareFile Storage Zones Controller versions 5.x and 6.x, with patched versions 5.12.5 and 6.0.2 released. Progress said it had no indication of unauthorized access to ShareFile accounts or data and began restoring access while asking customers to keep Storage Zone Controllers disabled. (Help Net Security)

CISA adds SharePoint and FortiSandbox flaws to KEV catalog

CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on July 16, 2026: CVE-2026-25089 and CVE-2026-39808, both OS command injection flaws in Fortinet FortiSandbox, and CVE-2026-58644, a deserialization of untrusted data vulnerability in Microsoft SharePoint. The agency reiterated that Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of KEV-listed vulnerabilities on internet-exposed assets and check for prior compromise before patching, while encouraging all organizations to adopt the same risk-based approach to vulnerability management. (CISA)