Blahalla

Microsoft Patch Tuesday July 2026 – Record 570 Vulnerabilities Patched

gbhackers.com · 6 days ago

Microsoft released a record 570 patches in July 2026, addressing three zero-days, two of which attackers exploited in the wild. Organizations must prioritize fixing critical issues like CVE-2026-56155 (AD FS) and CVE-2026-56164 (SharePoint Server). The update also includes patches for CVE-2026-55040, a SharePoint flaw, and the publicly disclosed BitLocker bypass, CVE-2026-50661.

SonicWall Issues Urgent SMA Patch Warning for Two Zero-Day Exploits

www.securityweek.com · 6 days ago

SonicWall urges updates for SMA1000 appliances against CVE-2026-15409 (SSRF via Workplace) and CVE-2026-15410 (arbitrary OS commands). CISA added both to KEV, advising swift patching.

Microsoft is forcing an enterprise transition to passkeys

www.csoonline.com · 6 days ago

Passkeys have been around for some time, but enterprise-wide adoption to this point has been slow for a number of reasons. But soon, many Microsoft customers won’t have a choice. Starting September 1, Microsoft will roll out passkeys as the default authentication method in its cloud-based identity and access management (IAM) service Entra ID.

Patch Tuesday roundup: Microsoft fixes a monthly record 569 holes; SAP patches a critical memory corruption bug

www.csoonline.com · 6 days ago

Earlier this month Microsoft warned that, because the latest AI models can now help discover vulnerabilities, CSOs will see a higher volume of security updates every month. It wasn’t kidding. Today the company issued a record number of patches, with 59 rated as critical. And Microsoft is now recommending that customers accelerate their patching schedules to more quickly deal with critical flaws.

Data Centers to Add Billions in Power Costs in 13 States

www.nytimes.com · 7 days ago

A grid operator conducted an auction that expects to add $6.3 billion in charges to consumers and businesses due to data center electricity needs. This figure underscores the massive energy demands powering large-scale data centers, significantly impacting infrastructure costs.

Cribl Adds Agentic Detection Engineering & Boosts SecOps With CardinalOps Deal

www.darkreading.com · 7 days ago

Cribl acquired CardinalOps, integrating AI-based detection engineering into its product suite. This integration allows customers to map security controls and detection rules directly to the MITRE ATT&CK framework. SecOps teams can identify coverage gaps and operationalize threat intelligence, positioning Cribl as a robust alternative to legacy SIEM solutions.

SVD-2026-0702: SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise

advisory.splunk.com · 7 days ago

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.

SVD-2026-0703: Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise

advisory.splunk.com · 7 days ago

Splunk has a high-severity Path Traversal vulnerability (CVE-2026-20297) in its App Install REST Endpoint affecting Enterprise and Cloud Platform. Exploitation via editlocalapps/installapps allows writing files outside app dirs, potentially to $SPLUNKHOME/etc/. Users must upgrade immediately for resolution.

SVD-2026-0704: Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk Enterprise

advisory.splunk.com · 7 days ago

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.

SVD-2026-0705: Third-Party Package Updates in Splunk Enterprise - July 2026

advisory.splunk.com · 7 days ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions 10.4.1, 10.2.5, 10.0.8, 9.4.13, and higher.

SVD-2026-0706: Third-Party Package Updates in Splunk Universal Forwarder - July 2026

advisory.splunk.com · 7 days ago

Splunk issued an advisory detailing remediation for critical vulnerabilities in the Universal Forwarder's third-party packages. Users must upgrade to recommended versions like 10.4.1, 10.2.5, 10.0.8, or 9.4.13. These updates patch OpenSSL and resolve CVE-2026-28388, CVE-2026-28389, and CVE-2026-28390.

Records Are Made to Be Broken: Patch Tuesday Raises Triage Stakes

www.darkreading.com · 7 days ago

Microsoft patched 622 CVEs, including zero-days. Flaws like CVE-2026-56155 and CVE-2026-56164 risk EoP. Updates cover critical issues from CVE-2026-48561 to CVE-2026-57092. Experts see a shift to continuous, high-stakes patching.

Lidl Data Breach Exposes Customer Details in Germany, Belgium, and the Netherlands

www.techrepublic.com · 7 days ago

Lidl's German, Belgian, and Dutch online shops saw identity data theft from a third-party provider. Stolen records include names, phone numbers, emails, DOBs, and customer IDs, increasing phishing/fraud risk. Payment details were safe.

SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now

www.bleepingcomputer.com · 7 days ago

SonicWall warns that malicious groups actively exploit two zero-day vulnerabilities in SMA1000 appliances. These flaws, CVE-2026-15409 an unauthenticated SSRF and CVE-2026-15410 a code injection flaw demand immediate attention. Customers must upgrade to the new hotfix releases and follow IOC guidance to secure their devices.

Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack

thehackernews.com · 7 days ago

Microsoft shipped its largest Patch Tuesday to date, releasing updates that address 622 distinct CVEs. Crucially, this update fixes two vulnerabilities actively being exploited by attackers in the wild. Microsoft credited incident responders for identifying these critical security flaws.

Spanish Police take down €140 million cyber fraud ring, arrest four

www.bleepingcomputer.com · 7 days ago

Spanish Police dismantled a cybercrime ring that generated €140M via investment fraud and BEC. Four suspects were arrested across Spain, Portugal, and Panama following tracing through 800+ accounts. They seized electronics and froze €3M.

6 GHz Wi-Fi Flaws Could Disrupt Critical Systems

www.darkreading.com · 7 days ago

Penn State/INL warn 6 GHz Wi-Fi AFC servers trust client data (GPS, GNSS, etc.). Input manipulation can spoof location/time, risking wrong freq assignment and DoS to critical infra. Vulnerabilities are present in AFC systems.

Microsoft Patches a Record 570 Security Flaws

krebsonsecurity.com · 7 days ago

MS patched 570+ flaws, fixing zero-days: CVE-2026-56155 (ADFS), CVE-2026-56164 (Sharepoint), CVE-2026-50661 (BitLocker bypass), and CVE-2026-48561 (Copilot RCE). AI aided this large update release.

Nearly 300 GitHub repos pose as legit software to push malware

www.bleepingcomputer.com · 7 days ago

ArcticWolf uncovered a group deployed nearly 300 fake GitHub repositories impersonating legitimate software to distribute infostealer malware. This BoryptGrab variant steals credentials from 19 web browsers, 32 crypto wallets, and messaging services like Discord. Researchers noted the malware bypasses Chrome’s App-Bound Encryption using direct code injection into the browser process.

Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days

www.securityweek.com · 7 days ago

Microsoft issued patches addressing 622 vulnerabilities, including two zero-days in Active Directory and SharePoint Server. The updates fixed the BitLocker bug, VMSwitch flaws, and critical defects like CVE-2026-55008 and RCE in protocols. Microsoft also addressed numerous additional security weaknesses, including the DHCP Server vulnerability and flaws affecting various applications.

Microsoft releases Windows 10 KB5099539 extended security update

www.bleepingcomputer.com · 7 days ago

MS released W10 KB5099539, fixing 570 vulns, including two zero-days from July 2026 Patch Tuesday. Free support is extended to Oct 12, 2027.

Australian Enterprises At Risk as Anthropic Finds Hackers In Claude Code

www.techrepublic.com · 7 days ago

A Chinese state-linked group executed a cyberattack using Anthropic's Claude Code tool against approximately 30 global organizations. The attack was highly automated, requiring minimal human intervention to fire off rapid API requests. This vulnerability highlights major AI governance gaps in Australia; Deloitte reports only 22% of businesses possess mature models despite high agent adoption.

Australian Enterprises At Risk as Anthropic Finds Hackers In Claude Code

www.techrepublic.com · 7 days ago

Chinese state-linked group attacked with Claude Code via automated API calls. Attackers ran 80-90% autonomously, exploiting AI agent gaps. Australian businesses face risks without strong AI governance.

Synopsys Finds No Evidence of Data Breach Amid Bosch Hack Claims

www.securityweek.com · 7 days ago

D1R claimed IP theft from Synopsys and Bosch, demanding ransom. Synopsys found no evidence of unauthorized access or breaches. Experts question D1R's claims due to using public material.

SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data

thehackernews.com · 7 days ago

SAP released July 2026 security updates that address multiple vulnerabilities in its software stack. The patch includes fixes for CVE-2026-44747, a critical out-of-bounds write flaw affecting SAP NetWeaver Application Server ABAP (CVSS score: 9.9). This vulnerability allows authenticated attackers to cause memory corruption by leveraging logical errors in the server’s memory management.

Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days

www.bleepingcomputer.com · 7 days ago

Microsoft released security updates for 570 flaws during the July 2026 Patch Tuesday. The update fixes three zero-day vulnerabilities, including CVE-2026-56155 in Active Directory Federation Services and another active exploit affecting SharePoint Server (CVE-2026-56164). Microsoft also patched elevated privilege weaknesses related to the listed flaws, including CVE-2026-50661.

Manage Vendor Risk in a Few Practical Steps

www.darkreading.com · 7 days ago

Third-party failures disrupt operations and cause losses. Governance requires measuring residual exposure via inherent risk, controls, and vendor assurance. Businesses must validate review depth, check tolerances, and document policy deviations.

Windows 11 KB5101650 & KB5099414 cumulative updates released

www.bleepingcomputer.com · 7 days ago

Microsoft released cumulative updates KB5101650 and KB5099414 for Windows 11 versions 25H2/24H2 and 23H2. These mandatory July 2026 patches address 571 vulnerabilities and fix numerous bugs. The update also introduces new features, such as full-screen color tint accessibility options and quick actions displayed when hovering over files in File Explorer.

Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads

thehackernews.com · 7 days ago

Other browser extensions running scripts on claude.ai can trigger "Claude for Chrome" tasks that potentially access user data across Gmail, Google Docs comments, and Calendar. These extensions require a rogue script to run on claude.ai itself. Anthropic had previously restricted the arbitrary-prompt path in May following earlier vulnerabilities.

Adobe Patches Critical ColdFusion Vulnerabilities

www.securityweek.com · 7 days ago

Adobe patched 12 products for 88 vulns, incl. ColdFusion flaws (CVE-2026-48318 to CVE-2026-48327), Commerce issues (CVE-2026-48356, CVE-2026-48358), and Experience Manager bugs (CVE-2026-48259, CVE-2026-48359). Users must apply patches for dozens of flaws, like CVE-2026-48334.

LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts

thehackernews.com · 7 days ago

Cybersecurity researchers flagged LabubaRAT, an undocumented Rust-based remote access trojan (RAT). The malware masquerades as NVIDIA software to infiltrate target environments unnoticed. Blackpoint Cyber researchers Sam Decker and Nevan Beal determined the RAT establishes a reusable foothold for activity and profiles host systems.

Progress confirms ShareFile zero-day flaw behind Storage Zone shutdown

www.bleepingcomputer.com · 7 days ago

Progress Software confirmed a high-severity path traversal zero-day vulnerability in ShareFile Storage Zone Controllers, affecting versions 5.x and 6.x. The flaw allowed an authenticated administrative user to read arbitrary files or write content anywhere on the system. Progress released patches (including 5.12.5 and 6.0.2) and urges customers to install them immediately to resolve the threat.

Frontier AI: The Genie's Out of the Bottle, But Where's the Rulebook?

www.darkreading.com · 7 days ago

States rapidly regulating powerful AI models through new disclosure laws. Illinois enacted SB315, requiring large developers to update comprehensive AI frameworks and submit transparency reports. New York's RAISE Act and California's TFAIA similarly establish oversight offices and critical guardrails for frontier AI development.

ClickFix's Mushrooming Ecosystem Demands New Defense Tactics

www.darkreading.com · 7 days ago

Cybercriminals use industrialized ClickFix social engineering attacks via pop-ups, tricking users into running malicious code using legitimate tools like PowerShell, bypassing AV/EDR. Reversing Labs recommends YARA structural analysis to target its HTML delivery method.

LastPass, Bitwarden users targeted with fake security alerts

www.bleepingcomputer.com · 7 days ago

Phishing attacks target LastPass/Bitwarden users via emails mimicking policy changes. Fake DocuSign sites prompt credential theft/downloads. Report suspicion and change master passwords on a trusted device.

Source-reviewing 200+ self-hosted multi-tenant AI/SaaS apps for tenant isolation: 78 leaked across tenants (the "un-retrofitted read sibling")

sectum.ai · 7 days ago

Researcher found cross-tenant data exposure in 78 multi-tenant SaaS AI tools due to lack of auth on read endpoints. One tenant can access another's private data across over 200 self-hosted AI tools. Developers must fix these isolation failures for LLM apps.

7 Severe Vulnerabilities Patched in VMware Avi Load Balancer

www.securityweek.com · 7 days ago

Broadcom patched 7 VMware Avi flaws: CVE-2026-47865 (auth bypass), CVE-2026-47871 (dir traversal), and others involving RCE, CVE-2026-47869. Researchers Waeytens & Duy reported fixes for these critical issues.

RabbitMQ Flaws Could Leak OAuth Secrets and Expose Cross-Tenant Queue Metadata

thehackernews.com · 7 days ago

Two access control vulnerabilities affect the RabbitMQ message broker service. Researchers from Miggo disclosed these flaws, which could allow attackers to leak OAuth client secrets and bypass tenant boundaries. The findings expose enterprise messaging infrastructure to severe takeover risks.

Miasma Worm Returns as RAT-First npm Attack With Automatic Propagation Disabled

gbhackers.com · 7 days ago

Compromised versions of four AsyncAPI packages deliver a RAT-focused build of the Miasma worm. Attackers bypassed previous defenses by inserting obfuscated launchers into legitimate JavaScript source files, evading npm v12 protections. Researchers analyzed the payload, which establishes encrypted command-and-control communications and enables persistence via an IPFS gateway.

Unpatched Claude for Chrome Flaw Lets Extensions Read Gmail, Calendar

www.securityweek.com · 7 days ago

AI security firm Manifold warned that vulnerabilities linked to ClaudeBleed persist in the latest Claude for Chrome version. Attackers can trigger extensions to act without explicit user clicks or approvals, potentially reading sensitive data like Gmail and Google Docs. These critical flaws remain unpatched across multiple versions released by Anthropic.

Cursor IDE Auto-Executes Malicious Code in Poisoned Repos

www.darkreading.com · 7 days ago

Offensive security firm Mindgard detailed a vulnerability allowing malicious code execution within the popular Cursor IDE. This flaw permits attackers to implant fake executables, such as git.exe, at a repository root, which Cursor automatically runs during project loading. Despite reporting the issue in December, Mindgard noted that Cursor has provided no visible remediation for affected users.

xAI Grok CLI Exposed Developer Code Through Automatic Whole-Repository Uploads

gbhackers.com · 7 days ago

Grok Build CLI v0.2.93 transmits full Git repos, unread files, and commit history by default to xAI infra. It sends raw content, exposing simulated creds from test.env.

Microsoft Entra ID gets passkeys default authentication starting September

www.bleepingcomputer.com · 7 days ago

Microsoft will make passkeys the default authentication method for Entra ID starting September 2026. Microsoft plans to retire SMS and voice authentication by February 2027, requiring organizations to adopt phishing-resistant methods. Teams must transition users now to prevent sign-in disruptions and strengthen protection against AI-enabled credential theft campaigns.

New phishing kits target Microsoft 365 accounts, evade MFA

www.bleepingcomputer.com · 7 days ago

Jalisco and OmegaLord phishing kits target Microsoft 365 MFA bypass. Jalisco exploits OAuth 2.0 Device Authorization Grant with real-time device codes. OmegaLord uses fake PDF readers to steal credentials/phone numbers, enabling SharePoint data theft. These methods affect multiple accounts.

11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot

thehackernews.com · 7 days ago

Cybersecurity researchers discovered 11 old, Microsoft-signed Unified Extensible Firmware Interface (UEFI) applications that risk bypassing Secure Boot on modern systems. An attacker exploiting one of these vulnerable apps executes untrusted code during system boot. This capability enables attackers to deploy malicious UEFI bootkits and other forms of malware.

Attackers Distribute Password Attacks Across Fictional OAuth Apps to Evade SOC Alerts

gbhackers.com · 7 days ago

Attackers used spoofed OAuth app IDs to enumerate over 1M Microsoft Entra ID accounts and test credentials. This method evades detection using fake client IDs. Proofpoint documented this campaign.

Cybercriminals Target Turkish Banks With 8,400 Phishing Domains and 6,600 Scam Ads

gbhackers.com · 7 days ago

Group-IB found an industrial fraud ecosystem targeting Turkish banks with 8,400+ phishing domains and 6,600+ scam ads on Meta. Attackers use a sold phishing kit to impersonate banks/govt services across platforms. Detection requires tracking shared artifacts.

Study of 85 Crypto Wallet Extensions Finds Address Leaks and Cross-Site Tracking Risks

thehackernews.com · 7 days ago

Researchers at KU Leuven tested 85 popular crypto wallet browser extensions and discovered they leak critical information. These wallets communicate with websites and blockchain servers in a way that ties together a person's separate digital addresses. This leakage enables outsiders to follow and track users across different sites.

SAP warns of critical flaws in NetWeaver and Commerce Cloud

www.bleepingcomputer.com · 7 days ago

SAP released July 2026 updates for 16 vulns. Critical fixes include NetWeaver memory corruption (CVE-2026-44747), Approuter HTTP Request Smuggling (CVE-2026-27690), and Commerce Cloud default credentials (CVE-2026-44761). Six other high-severity issues were also addressed.

How Pentera Turns AI Security Workflows into Validation Engines

thehackernews.com · 7 days ago

AI security agents influence real decisions by summarizing findings and prioritizing remediation steps for faster team action. However, these tools currently rely on fragmented risk signals, including scanner output, severity scores, configuration findings, and threat intelligence. Attackers exploit this fragmentation because they navigate environments non-linearly.