Mozilla’s Urgent Warning: Two Critical Flaws, Public Exploit Code

Mozilla didn’t hedge. The organization pushed out updates for Firefox on Wednesday, addressing two critical vulnerabilities — and it explicitly warned that exploit code for both is already circulating in the wild. That’s not the usual vague advisory language. That’s a “patch now” signal.

The first flaw, tracked as CVE-2026-15718, is an invalid pointer issue in the JavaScript: WebAssembly component. The second, CVE-2026-15719, involves a site isolation bypass in the DOM: Navigation component. Both are rated critical, and both have public exploit code. Mozilla’s advisory notes that it is not aware of active exploitation in the wild yet, but with proof-of-concept code out there, the gap between “public” and “exploited” tends to shrink fast.

Firefox users should update to the latest version immediately. The fix is included in Firefox 138.0.1 and Firefox ESR 128.4.1. If you’re still on an older ESR channel, check Mozilla’s release notes — some extended support branches received backported patches.

Chrome’s Turn: A Heap Overflow in the V8 Engine

Google followed suit with its own critical advisory. The Chrome team patched CVE-2026-15724, a heap overflow vulnerability in the V8 JavaScript engine. Heap overflows in V8 have historically been a favorite target for attackers, often leading to remote code execution. Google’s threat intelligence partners flagged the bug, and the company has already rolled out the fix in Chrome 138.0.7204.110 for Windows and macOS, and 138.0.7204.111 for Linux.

The stable channel update is being staged over the coming days, so if your browser hasn’t auto-updated yet, it will soon. You can also force it: click the three-dot menu, go to Help, then About Google Chrome. That triggers an immediate update check. A quick reboot of the browser after the update is a good habit.

Adobe Acrobat and Reader: Critical Flaws Across the Board

Adobe’s April security bulletin is a hefty one. The company patched multiple critical vulnerabilities in Adobe Acrobat and Reader, affecting both Windows and macOS. The most serious issues could allow an attacker to execute arbitrary code with the privileges of the logged-in user — which is to say, if you open a malicious PDF, your system is at risk.

Among the patched CVEs are CVE-2026-15731 and CVE-2026-15732, both use-after-free vulnerabilities. Adobe also fixed several out-of-bounds write issues, including CVE-2026-15735 and CVE-2026-15736. The updates are available for Acrobat DC (Continuous Track) version 26.001.20210 and Acrobat Reader DC version 26.001.20210. For those on the Classic Track, versions 24.005.20416 and 22.003.23227 include the fixes.

Adobe hasn’t reported any active exploits for these flaws, but given the history of PDF-based attacks, treating this update as urgent is the smart move. The company rates all of these as critical severity.

VMware: ESXi, Workstation, and Fusion Patched for Memory Corruption

VMware closed out the week with its own advisory, addressing a critical vulnerability in its hypervisor products. The flaw, CVE-2026-15740, is a memory corruption issue in the virtual machine display unit (VMU) that could allow a malicious actor with local administrative privileges on a virtual machine to execute code as the host’s kernel. In plain terms: an attacker who compromises a guest VM could potentially break out and take over the entire host server.

Patches are available for VMware ESXi 8.0 (update 3b), ESXi 7.0 (update 3u), Workstation Pro 17.x, and Fusion 13.x. There are no workarounds for this issue, so applying the update is the only mitigation. VMware’s advisory emphasizes that the vulnerability requires local admin access to the VM, which lowers the immediate risk slightly — but in multi-tenant environments or shared infrastructure, that’s cold comfort.

What Should You Do Right Now?

Here’s a practical checklist to get your systems patched:

• Firefox: Update to Firefox 138.0.1 or ESR 128.4.1. Check via the menu → Help → About Firefox.
• Chrome: Ensure you’re on 138.0.7204.110 or later. Restart the browser after updating.
• Acrobat/Reader: Install version 26.001.20210 (Continuous) or the corresponding Classic Track update. Use Help → Check for Updates within the application.
• VMware: Apply the ESXi, Workstation, or Fusion patches listed in VMSA-2026-0012. No workaround exists.

For enterprises, prioritize the VMware ESXi patches first, especially if you run multi-tenant workloads. The guest-to-host breakout potential is the kind of thing that keeps infrastructure teams up at night. Next, push the Firefox and Chrome updates to all endpoints — browser-based attacks are the most common initial access vector in breaches. Adobe Acrobat should follow, particularly for finance, legal, and HR teams that handle PDFs daily.

For more on securing your browsers, check out our guide on hardening browser security settings and best practices for enterprise patch management strategies.

This round of updates is a reminder that the patch cycle never sleeps. Four major vendors, multiple critical flaws, and at least one instance of public exploit code. The window to act is now.

What Is OkoBot and How Does It Work?

OkoBot is a Windows-based malware framework that has been active since April 2025. Its main goal is to trick hardware wallet owners into giving up their recovery seed phrase, which would let attackers drain funds from their crypto wallets.

The malware operates by injecting malicious code into legitimate desktop applications, specifically targeting Ledger and Trezor wallet software. When a user opens their wallet app on an infected PC, OkoBot displays a fake page that looks like the official wallet interface, asking for the seed phrase.

What makes this attack particularly sneaky is that it waits for the right moment. Sometimes it triggers when the user plugs in their hardware wallet. The request appears to come from inside the wallet’s own desktop software, making it very difficult to spot.

How the Seed Phishing Attack Unfolds

Here’s a step-by-step breakdown of how OkoBot executes its seed phrase phishing attack:

• Infection: The malware lands on a Windows PC, often through a malicious download or a compromised website.
• Injection: OkoBot injects its code into the installed Ledger or Trezor desktop application.
• Trigger: The fake page appears either immediately or when the hardware wallet is plugged in.
• Phishing: The user sees a screen asking them to enter their recovery seed phrase, believing it’s a legitimate request from the wallet software.
• Exfiltration: Once the seed phrase is entered, it’s sent to the attackers, who can then access the victim’s funds.

Why This Attack Is So Hard to Detect

The most alarming aspect of OkoBot is that the surrounding application is the real one you installed. The malware doesn’t replace the app or show a separate popup. It works from within the legitimate software, which makes it nearly impossible to distinguish from a genuine request.

This is a significant departure from earlier phishing attempts that used fake websites or standalone malicious apps. OkoBot blends in so well that even experienced users might fall for it.

Protecting Yourself from OkoBot and Similar Threats

Given the sophistication of OkoBot, it’s crucial to adopt a security-first mindset when dealing with hardware wallets. Here are some practical steps to protect yourself:

• Never enter your seed phrase on a computer: Hardware wallets like Ledger and Trezor are designed so that the seed phrase is only entered on the device itself, never on a connected computer. If any software asks for it, that’s a red flag.
• Keep your wallet software updated: Regular updates often include security patches that can block known malware injection techniques.
• Use a dedicated, clean computer: If you’re dealing with significant crypto holdings, consider using a separate machine that’s only used for wallet transactions.
• Verify the source of downloads: Only download wallet software from official websites, and check file hashes if possible.
• Use antivirus and anti-malware tools: Keep your security software up to date and run regular scans.

What to Do If You Suspect an Infection

If you think your PC might be infected with OkoBot, act immediately. Disconnect the machine from the internet, and do not enter your seed phrase anywhere. Use a different, clean device to transfer your funds to a new wallet if you have any doubts.

It’s also wise to report the incident to your wallet provider’s support team. They can offer guidance specific to your situation.

Final Thoughts on OkoBot

OkoBot represents a new level of sophistication in crypto phishing attacks. By targeting the very software users trust, it bypasses many of the security habits people have developed. The best defense is a healthy dose of skepticism and a strict rule: your seed phrase belongs only on your hardware wallet, never on a computer screen.

Stay informed about the latest crypto security threats and always double-check any request for sensitive information, even if it appears to come from a trusted app.

Anubis Group Claims Credit for Fairlife Disruption

The cybercriminal group known as Anubis has publicly claimed responsibility for the ransomware attack that forced Coca-Cola’s dairy subsidiary Fairlife to halt production. On its dark web leak site, the gang says it grabbed a full terabyte of confidential files before locking up the company’s servers.

The claim, posted July 20, gives Coca-Cola a week to pay up. If no ransom arrives, Anubis says the stolen data will be dumped online.

That’s a tight window, and it puts the beverage giant in an uncomfortable spot. Paying could fund more attacks. Refusing could mean sensitive corporate data ends up public.

What We Know About the Attack on Fairlife

Coca-Cola disclosed the incident last week, confirming that production at Fairlife had been suspended while the company assessed the damage. The full scope of the breach is still being determined.

Fairlife is a major player in the U.S. dairy market, known for its high-protein milk products and sports drinks. A prolonged shutdown doesn’t just hurt the bottom line — it can ripple through grocery shelves and supply contracts.

SecurityWeek has reached out to Coca-Cola for additional comment on the Anubis claims, but no further details have been released so far.

Who Is the Anubis Ransomware Group?

Anubis isn’t a household name like LockBit or BlackCat, but it’s been busy. Active since December 2024, the group has already listed roughly 100 victim organizations on its leak site.

The gang operates on the standard double extortion model: encrypt files to disrupt operations, then threaten to leak the stolen data if the victim won’t pay. It’s a tactic that’s become the industry norm because it works.

What sets Anubis apart is a darker feature. The group has a ‘wiper mode’ that can permanently delete files, making recovery impossible even with backups. That’s a threat that goes beyond financial damage — it’s aimed at destroying a company’s data forever.

Why the Wiper Mode Matters

Most ransomware gangs want to get paid and move on. A wiper function signals a group willing to burn everything down if negotiations stall. For incident responders, that changes the calculus entirely. Restoring from backups becomes a race against time, not a routine procedure.

The Growing Threat of Data Leak Extortion

This incident is another reminder that ransomware is rarely just about encryption anymore. The real leverage is the data. Companies like Fairlife now face the possibility that trade secrets, employee records, or financial documents could surface on the dark web.

Recent attacks on Estée Lauder and Clover Health show the pattern: a breach is disclosed, then weeks or months of fallout follow. The Ernst & Young data breach that exposed personal and financial information is a stark example of how far the damage can spread.

For security teams, the lesson is grim but clear. Assume that if attackers get in, they’ll get out with something valuable. Preparation for data theft is no longer optional.

What Happens Next for Coca-Cola and Fairlife?

The clock is ticking. Anubis has set a deadline, and the industry is watching to see how Coca-Cola responds. Will it negotiate, hold the line, or quietly pay?

There’s no easy answer. Law enforcement agencies generally advise against paying ransoms, but for a company facing a production halt and the threat of leaked data, the pressure is immense.

One thing is certain: this won’t be the last time a major brand finds itself in this position. Ransomware groups are getting bolder, and their tools are getting meaner. The Fairlife attack is just the latest example of a threat that keeps evolving.