RoguePlanet Defender Fix, GigaWiper & $1M County Ransom (07/09/2026)

Microsoft finally shipped the fix for RoguePlanet, the Defender privilege-escalation zero-day that sat exposed for a month with working exploit code in the open, so the patch window is a race you are already behind on. The same day brought GigaWiper, a destructive backdoor assembled from three older malware families, and a leaked negotiation showing a US county quietly wired $1 million to its extortionists. The theme today is cheap advantage: attackers reusing old code, old accounts, and your own patch lag.

Top 5 Critical Security Alerts

1. Microsoft Patches RoguePlanet Defender Zero-Day

Microsoft patched RoguePlanet (CVE-2026-50656, CVSS 7.8), a Windows Defender flaw that hands an attacker SYSTEM privileges, nearly a month after the researcher Nightmare-Eclipse published a working proof-of-concept (The Register, The Hacker News). A month of public exploit code aimed at the security tool that is supposed to be watching the box is how a routine foothold becomes full control.

Operator Note: Patch Defender now and assume anything unpatched since June was reachable. Public exploit code means the attack was automated, not hypothetical.

2. GigaWiper Backdoor Bundles Wiping, Fake Ransomware, and Spyware

Microsoft dissected GigaWiper, a destructive backdoor that combines disk-wiping, fake-ransomware, and spyware modules lifted from several older malware families into one platform the operator can pick from (Microsoft, The Hacker News). Reusing proven destructive code keeps the attacker’s cost down and your detection harder, because each borrowed piece already carries its own evasion.

Operator Note: A wiper wearing a ransomware mask turns your “pay and recover” plan into a trap. Back up like recovery is the only option, because against a wiper it is.

3. US County Paid $1 Million Extortion Demand

Leaked negotiation logs show an unnamed US county, possibly in Ohio, paid a $1 million extortion demand, with the full haggling exchange now public (The Register). Thin budgets and thin security staffing make local government a reliable payday, and every disclosed payment prices the next demand for the county down the road.

Operator Note: A leaked ransom transcript is free adversary training. Assume your own incident calls could end up public and decide the messaging before you need it.

4. Dormant GitHub Accounts Used to Map Corporate Orgs

Datadog Security Labs flagged overlapping campaigns using dormant GitHub accounts and automated scraping to enumerate corporate GitHub organizations, repositories, and users through the API (The Hacker News). Old, trusted-looking accounts blend into your contributor graph while the operator maps who works where and which repos hold the secrets, all before a single exploit.

Operator Note: Audit org membership and outside collaborators. A contributor account that has sat idle for two years is reconnaissance waiting to happen.

5. npm 12 Disables Install Scripts by Default

GitHub shipped npm 12 with install scripts disabled by default and granular access tokens deprecated, closing two of the most abused supply-chain paths in the JavaScript ecosystem (The Hacker News). Install-script execution on npm install has been the quiet delivery mechanism behind a long line of wallet stealers and credential grabbers, so this default finally flips the economics against the attacker.

Operator Note: Test your builds against the new default before it breaks a pipeline, and stop depending on postinstall hooks you cannot audit.

Additional Security Alerts

Threat Intelligence

• GodDamn ransomware disables defenses with a kernel driver: the new family loads the PoisonX signed driver to neutralize endpoint security before it encrypts. The Hacker News
• Injective SDK poisoned on npm: attackers compromised the Injective Labs GitHub repo and pushed a malicious npm package that steals crypto wallet keys and seed phrases. BleepingComputer
• Iran broadens its targeting: researchers warn Iranian activity now reaches well beyond critical infrastructure, so any internet-facing vulnerability is in scope. Dark Reading

Security Breaches & Incidents

• OpenMandriva reports attempted sabotage: the Linux project says a contributor tried to sabotage it after an internal dispute. BleepingComputer

Cloud & Network Security

• Talos discloses 18 vulnerabilities: Cisco Talos reported three flaws in WolfSSL, fourteen in GeoVision, and one in VTK-DICOM, all now patched by the vendors. Cisco Talos

Emerging Security Technologies

• AI agents are a new identity class: treating them like service accounts or API tokens leaves a gap most organizations have not closed. Dark Reading
• Microsoft warns of heavier Patch Tuesdays: AI-driven vulnerability discovery will push patch volume up, and Redmond is using that to sell auto-patching. The Register

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.