Major Threats & Vulnerabilities
Record Patch Releases and Actively Exploited Zero-Days
Microsoft’s July 2026 Patch Tuesday addressed a record 570 vulnerabilities, including three zero-days and two under active exploitation. Of these, 59 were rated critical, many enabling remote code execution. Organizations are urged to prioritize patching actively exploited vulnerabilities, apply compensating controls, and validate patch deployment across all systems.
Critical Enterprise and Infrastructure Flaws
SAP patched 16 vulnerabilities, including three critical ones affecting NetWeaver, Commerce Cloud, and AppRouter. These flaws could lead to memory corruption or HTTP request smuggling. While no exploitation has been reported, enterprises should apply updates immediately and review access controls.
RabbitMQ administrators were warned of two vulnerabilities that could allow unauthenticated attackers to gain administrative control or expose tenant metadata. Patching, rotating OAuth secrets, and restricting management interfaces via VPN or Zero Trust controls are strongly recommended.
SonicWall released emergency hotfixes for SMA1000 vulnerabilities (CVE-2026-15409, CVE-2026-15410) under active attack. CISA added both to its Known Exploited Vulnerabilities catalog. Affected organizations should re-image systems, rotate credentials, and reset TOTP tokens if compromise is suspected.
Django’s GeoDjango component was found vulnerable to SQL injection through raster field lookups, with active exploitation confirmed. Immediate patching is essential to prevent data exposure or manipulation.
Browser and Mobile Threats
Google Chrome 150 introduced a new Android back button and patched 27 security vulnerabilities, including two critical ones. Security teams should ensure timely browser updates and monitor managed Android devices for anomalies.
RedHook malware is targeting Android users in Vietnam and Indonesia by abusing Accessibility permissions to gain remote control. Users should avoid sideloading apps and review permission settings regularly.
Supply Chain and Open Source Risks
Ghost GitHub accounts were discovered mapping corporate repositories and developers to facilitate source code theft. Attackers leveraged stolen tokens and GitHub APIs in coordinated campaigns that remain active.
Fake GitHub repositories mimicking legitimate software were used to distribute infostealer malware capturing credentials and crypto wallets. Security teams should enforce repository allowlists and use EDR/XDR tools to detect malicious downloads.
The WP-SHELLSTORM campaign targeting outdated WordPress and Joomla sites was exposed after an OPSEC mistake revealed internal tools. Over 1.4 million sites were affected. Admins should patch CMS platforms and remove unused plugins to reduce exposure.
Emerging Platform Threats
Progress Software issued an urgent advisory for ShareFile Storage Zone Controller servers, urging customers to take systems offline due to a credible security threat. Organizations should preserve forensic evidence and monitor for credential abuse before restoring operations.
Aging embedded devices continue to pose security risks as outdated firmware and third-party components remain unpatched. Experts recommend adopting a lifecycle approach to OT and IoT device management, especially in critical infrastructure environments.
Industry News
Cyberattacks and Data Breaches
Mount Royal University confirmed a ransomware attack that resulted in data theft and deletion. The CMD Organization claimed responsibility, highlighting the ongoing vulnerability of educational institutions to targeted ransomware campaigns.
Lidl reported a data breach through a third-party IT provider affecting customers in Germany, Belgium, and the Netherlands. While payment data was not exposed, personal information could be leveraged for phishing or identity fraud.
Japan’s largest taxi operator, Nihon Kotsu, suffered a cyberattack that disrupted dispatch and booking systems nationwide. The incident underscores the operational risks of digital transformation in transportation.
Law Enforcement and Policy Developments
Spanish police dismantled a €140 million cyber fraud and money-laundering network tied to investment scams. The operation, supported by Europol and Interpol, froze €3 million for victim restitution.
The U.S. Treasury sanctioned a VPN provider and malware cryptor developer for supporting ransomware operations. The move followed Operation Saffron, which dismantled related infrastructure across 27 countries.
CMMC assessments were temporarily paused due to a shortage of assessors, but compliance with DFARS and NIST SP 800-171 remains mandatory. Defense contractors should use this time to strengthen cybersecurity governance, including oversight of AI-driven systems handling controlled information.
Corporate and Technology Updates
SpaceX and Starlink X accounts were hijacked to promote a fake cryptocurrency scam, generating over $125,000 before takedown. The incident highlights the need for stronger social media account protections.
Telstra experienced a 12-hour outage caused by a software defect, disrupting critical services across Australia. Although not a cyberattack, the event prompted a government review of telecom resilience and continuity planning.
New York courts announced a ban on camera-equipped smart glasses, including Meta Ray-Bans, to prevent unauthorized recordings. The policy underscores the growing need for clear organizational rules around wearable devices.
Anthropic revealed that attackers used its Claude Code AI to automate cyber campaigns, exposing governance gaps in AI oversight. Experts urge enterprises to treat AI agents as privileged identities requiring strict monitoring and access control.
Cybercrime markets have surged following the shutdown of the $12 billion Tudou Guarantee marketplace, with new platforms like Tiancheng and Timi continuing to facilitate phishing and money laundering operations.
Security Tips & Best Practices
Are You Phishing Ready?
- Verify unexpected requests through secondary channels before sharing sensitive data.
- Use phishing-resistant MFA, least privilege, and Zero Trust verification for users and devices.
- Test incident response plans and use phishing simulation tools to improve readiness.
Can You Trust Your AI Agents?
- Treat AI agents as managed identities with strong authentication and least-privilege access.
- Maintain an inventory of AI agents, review permissions, and assign clear oversight ownership.
- Continuously monitor AI agent activity and test response procedures for revoking credentials.
How Confident Are You in Your Cyber Resilience?
- Protect critical assets by segmenting high-value systems and maintaining offline immutable backups.
- Continuously monitor for threats and validate incident response through tabletop exercises.
- Regularly test recovery processes to align with business continuity goals.
Wearable Tech Security
- Keep wearable firmware updated and use phishing-resistant MFA for connected accounts.
- Remove old or unused devices from accounts and review app permissions regularly.
- Disable unnecessary connectivity features and avoid bringing wearables into restricted environments.
Is Your SDLC Secure Enough?
- Integrate security into development with secure coding practices and secrets management.
- Automate vulnerability detection with SAST, DAST, and SCA tools across the CI/CD pipeline.
- Sign and verify software artifacts to ensure code integrity before deployment.
Tools & Resources
Simplify compliance — get ready-to-use security policies to help protect your business without the cost or complexity of an enterprise, all for under $100.
Organizations can leverage the latest updates from Microsoft, SAP, and Google Chrome to strengthen their patch management programs. Additionally, the AI software supply chain guidance and AI governance frameworks provide valuable resources for securing emerging technologies.
If you want to see more from our Newsletter Archive please click here.