Today's cybersecurity landscape highlights a massive wave of patches, with Microsoft leading the charge to fix a record number of vulnerabilities, including several actively exploited zero-days. Alongside these critical updates, new threats are emerging, and law enforcement is stepping up efforts against cybercriminal infrastructure.
Microsoft Issues Record-Breaking July Patch Tuesday, Including Zero-DaysVulnerability
Microsoft has released its largest-ever Patch Tuesday update, addressing a staggering 622 vulnerabilities across its products. Crucially, this includes fixes for two zero-day flaws that are currently being actively exploited by attackers, in addition to another publicly disclosed vulnerability.
Why it matters: Website and business owners using Microsoft products should prioritize installing these updates immediately, especially those addressing actively exploited vulnerabilities, to prevent potential breaches and ensure system security.
Read more at The Hacker News ↗
SonicWall SMA1000 Devices Targeted by Zero-Day ExploitsVulnerability
SonicWall has issued an urgent warning regarding two zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, in its SMA1000 series products. These flaws are actively being exploited by threat actors for remote code execution.
Why it matters: Organizations using SonicWall SMA1000 devices must apply the latest security updates without delay to protect their networks from active exploitation and potential compromise.
Read more at BleepingComputer ↗
SAP Addresses Critical Vulnerabilities in Key Business ProductsVulnerability
SAP has released its July 2026 security updates, patching multiple vulnerabilities, including a critical out-of-bounds write flaw (CVE-2026-44747) in SAP NetWeaver AS ABAP. Other critical issues were also fixed in Commerce Cloud and AppRouter, potentially allowing data exposure or modification and system unavailability.
Why it matters: Businesses relying on SAP NetWeaver, Commerce Cloud, or AppRouter should implement these critical patches promptly to safeguard sensitive data and maintain the integrity of their enterprise systems.
Read more at The Hacker News ↗
Progress Software Confirms Zero-Day in ShareFile Storage Zone ControllersVulnerability
Progress Software has confirmed that an undisclosed, high-severity zero-day vulnerability was responsible for the recent emergency shutdown of ShareFile Storage Zone Controllers. Security updates have been released to address this critical flaw.
Why it matters: Users of ShareFile Storage Zone Controllers must apply the latest security patches immediately to prevent exploitation and secure their data storage infrastructure.
Read more at BleepingComputer ↗
U.S. Sanctions VPN and Malware Providers Supporting RansomwarePolicy
The U.S. Treasury Department has sanctioned a VPN service, First VPN Service (1VPNS), and two individuals for their involvement in enabling ransomware attacks and other cybercriminal activities targeting Americans. This action highlights an increasing focus on disrupting the infrastructure that supports malicious cyber operations.
Why it matters: This development underscores the importance for businesses to vet their service providers carefully and be aware of geopolitical efforts to combat cybercrime infrastructure, which can impact the availability of tools even for legitimate users.
Read more at The Hacker News ↗
New LabubaRAT Malware Masquerades as NVIDIA SoftwareThreat
Security researchers have identified LabubaRAT, a new Rust-based remote access trojan (RAT) that attempts to evade detection by posing as legitimate NVIDIA software. Once deployed, LabubaRAT can establish a persistent foothold and enable extensive control over compromised Windows systems.
Why it matters: Small businesses should reinforce endpoint security, educate employees on identifying suspicious software, and ensure regular security scans to detect and prevent sophisticated malware like LabubaRAT from gaining a foothold.
Read more at The Hacker News ↗
Threat Actors Exploit OAuth Client ID Spoofing in Microsoft Entra IDThreat
Two distinct threat groups are utilizing a novel OAuth client ID spoofing technique in cloud campaigns to validate stolen credentials and enumerate user accounts in Microsoft Entra ID environments. This method allows them to bypass traditional sign-in alerts, making detection more challenging.
Why it matters: Organizations using Microsoft Entra ID must implement robust monitoring for unusual access patterns, even without successful sign-in events, and consider enhanced authentication policies to counter advanced credential validation techniques.
Read more at The Hacker News ↗
RabbitMQ Vulnerabilities Expose OAuth Secrets and Tenant DataVulnerability
Two access control vulnerabilities in the RabbitMQ message broker service could allow attackers to leak OAuth client secrets, expose enterprise messaging infrastructure to takeover risks, and bypass tenant isolation. These flaws were discovered and reported by Miggo's security team.
Why it matters: Businesses using RabbitMQ should immediately apply patches to prevent potential information disclosure, unauthorized access, and cross-tenant data exposure, which could severely impact communication infrastructure.
Read more at The Hacker News ↗
Grok Build CLI Accidentally Uploaded Entire Git RepositoriesVulnerability
The Grok Build coding CLI from xAI was found to be uploading entire Git repositories, including full commit histories, to a Google Cloud Storage bucket managed by xAI. This occurred even when the tool was instructed to only process specific files, leading to potential unintended data exposure.
Why it matters: Developers and businesses using AI coding tools like Grok Build should exercise extreme caution and verify what data is being transmitted. Always assume that sensitive information could be inadvertently shared and review configuration settings meticulously.
Read more at The Hacker News ↗
Old Microsoft-Signed UEFI Shims Could Bypass Secure BootVulnerability
Researchers have identified 11 outdated, Microsoft-signed UEFI applications that can be exploited to bypass Secure Boot on most modern systems. This vulnerability allows attackers to execute unauthorized code during system startup, facilitating the deployment of malicious UEFI bootkits and other malware.
Why it matters: Businesses should ensure that their systems are updated with the latest firmware and security patches, and maintain strong control over boot processes to prevent attackers from exploiting old UEFI components to bypass critical security features.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.