Major Incidents or Breaches

  • SonicWall confirmed active exploitation of two zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) in SMA 1000 series appliances, enabling remote code execution and administrative command execution. Patches have been released and users are urged to update immediately [3][15][41].
  • Progress Software attributed the emergency shutdown of ShareFile Storage Zone Controllers to a high-severity zero-day vulnerability and issued security updates to address the flaw [21].
  • Nearly 300 fake GitHub repositories have been published by threat actors impersonating legitimate software projects to distribute infostealer malware [17].
  • The Spanish Police dismantled a cybercrime and money-laundering organisation responsible for €140 million in investment fraud and BEC attacks, arresting four individuals [16].
  • xAI’s Grok Build CLI was found to be uploading entire Git repositories, including full commit histories, to a Google Cloud Storage bucket operated by xAI, rather than just necessary files [13].
  • LastPass and Bitwarden users are being targeted by a phishing campaign using fake security alerts to direct them to fraudulent sites [22].
  • The D1R cybercrime group claimed to have stolen data from Synopsys and Bosch, threatening to leak it unless a ransom is paid. Synopsys reports no evidence of breach [43].

Newly Discovered Vulnerabilities

  • Microsoft released a record-breaking Patch Tuesday update, addressing 622 vulnerabilities (including 570 in Windows), with at least two zero-days under active exploitation affecting Active Directory and SharePoint Server, and a publicly disclosed BitLocker bug. Over 60 flaws were rated critical [4][18][19][30][36][39][42].
  • SAP patched multiple critical vulnerabilities in NetWeaver Application Server ABAP (CVSS 9.9), Commerce Cloud, and AppRouter that could allow attackers to access, modify data, cause system unavailability, and desynchronise requests and responses [5][26][47].
  • Researchers disclosed two access control flaws in RabbitMQ that could allow attackers to leak OAuth client secrets and expose enterprise queue metadata [8].
  • Eleven old Microsoft-signed Linux UEFI shims have been discovered that can be abused to bypass Secure Boot on most modern systems [9].
  • A critical vulnerability remains unpatched in the Claude for Chrome extension, allowing rogue browser extensions to trigger access to Gmail, Google Docs, and Calendar data via Claude tasks [6][46].
  • Adobe patched critical ColdFusion vulnerabilities that could allow remote code execution or privilege escalation [44].
  • VMware patched seven severe vulnerabilities in its Avi Load Balancer, including authentication bypass, remote code execution, privilege escalation, and directory traversal [45].
  • Critical vulnerabilities were patched in Chrome 150 and Firefox 152. Public exploit code exists for Firefox flaws, but no in-the-wild exploitation has been observed [40].
  • Researchers found a vulnerability in the Cursor IDE that allows automatic execution of malicious code from poisoned repositories [35].
  • Automated Frequency Coordination systems for 6 GHz Wi-Fi were found to trust client-side data by default, enabling location spoofing and potential disruption of critical systems [31].

Notable Threat Actor Activity

  • At least two threat actors are using OAuth client ID spoofing to validate stolen Microsoft Entra credentials in cloud campaigns, evading detection [12].
  • LabubaRAT, a previously undocumented Rust-based remote access trojan, is masquerading as NVIDIA software to gain persistence and control over Windows hosts [7].
  • Multiple state-sponsored Russian APTs are targeting critical infrastructure routers, exploiting poorly secured devices across sector networks [48].
  • A threat actor is distributing infostealer malware via hundreds of fake GitHub repositories impersonating legitimate projects [17].
  • The D1R group claimed responsibility for alleged attacks on Synopsys and Bosch, demanding ransom for stolen data [43].
  • A trusted ransomware negotiator was discovered to have secretly assisted the BlackCat ransomware gang in extorting victims, constituting an insider threat [51].

Trends, Tools, or Tactics of Interest

  • The ClickFix social engineering technique has emerged as the leading malware delivery method, involving user interaction to copy and execute malicious commands. The ecosystem is now available for rent at scale, can evade AV and EDR, and relies on YARA analysis for detection [1][34].
  • AI tools are being leveraged by scammers to geolocate individuals based on social media photos, enabling more targeted social engineering attacks [2].
  • Two new phishing kits, Jalisco and OmegaLord, are targeting Microsoft 365 accounts and using techniques to bypass multi-factor authentication [25].
  • New phishing campaigns are targeting LastPass and Bitwarden users with fake security alerts to lure victims to malicious sites [22].
  • Crypto wallet browser extensions were found to leak address and tracking information, enabling linkage and tracking of users [10].
  • AI-driven security agents are increasingly influencing security operations by summarising findings and prioritising remediation, but most tools remain fragmented [11].
  • Picus described the use of TTP chaining for vulnerability validation without running live exploits, supporting safer risk assessment [23].
  • Cybercriminals are combining FaceTime social engineering with unpatched devices to steal credentials and drain bank accounts [50].

Regulatory or Policy Developments Affecting the Security Industry

  • The US Treasury Department’s OFAC sanctioned two individuals and one entity for enabling ransomware attacks against US organisations, targeting VPN and malware providers [28].
  • US federal prosecutors unsealed charges against three Russian nationals accused of providing bulletproof hosting services to ransomware gangs responsible for over $62 million in damages [14].
  • Nigeria advanced rules mandating the disclosure of cyberattacks by organisations, aligning with a global trend towards required transparency [29].
  • Microsoft announced that passkeys will become the default authentication method for Entra ID enterprise identity service starting September 2026 [24].
  • Several US state governments are moving to legislate transparency in the deployment of frontier AI models, responding to increased independence and reduced human oversight in AI systems [33].

Sources#

  1. Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands - thehackernews.com
  2. SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now - bleepingcomputer.com
  3. SonicWall Issues Urgent SMA Patch Warning for Two Zero-Day Exploits - securityweek.com
  4. Progress confirms ShareFile zero-day flaw behind Storage Zone shutdown - bleepingcomputer.com
  5. Nearly 300 GitHub repos pose as legit software to push malware - bleepingcomputer.com
  6. Spanish Police take down €140 million cyber fraud ring, arrest four - bleepingcomputer.com
  7. Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read - thehackernews.com
  8. LastPass, Bitwarden users targeted with fake security alerts - bleepingcomputer.com
  9. Synopsys Finds No Evidence of Data Breach Amid Bosch Hack Claims - securityweek.com
  10. Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack - thehackernews.com
  11. Microsoft releases Windows 10 KB5099539 extended security update - bleepingcomputer.com
  12. Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days - bleepingcomputer.com
  13. Records Are Made to Be Broken: Patch Tuesday Raises Triage Stakes - darkreading.com
  14. Microsoft Patches a Record 570 Security Flaws - krebsonsecurity.com
  15. Microsoft Patch Tuesday July 2026 - The AI Acopolypse is Here , (Tue, Jul 14th) - isc.sans.edu
  16. Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days - securityweek.com
  17. SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data - thehackernews.com
  18. SAP warns of critical flaws in NetWeaver and Commerce Cloud - bleepingcomputer.com
  19. SAP Patches Critical Vulnerabilities in NetWeaver, Approuter, Commerce Cloud - securityweek.com
  20. RabbitMQ Flaws Could Leak OAuth Secrets and Expose Cross-Tenant Queue Metadata - thehackernews.com
  21. 11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot - thehackernews.com
  22. Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads - thehackernews.com
  23. Unpatched Claude for Chrome Flaw Lets Extensions Read Gmail, Calendar - securityweek.com
  24. Adobe Patches Critical ColdFusion Vulnerabilities - securityweek.com
  25. 7 Severe Vulnerabilities Patched in VMware Avi Load Balancer - securityweek.com
  26. Critical Vulnerabilities Patched With Fresh Chrome 150, Firefox 152 Updates - securityweek.com
  27. Cursor IDE Auto-Executes Malicious Code in Poisoned Repos - darkreading.com
  28. 6 GHz Wi-Fi Flaws Could Disrupt Critical Systems - darkreading.com
  29. OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials - thehackernews.com
  30. LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts - thehackernews.com
  31. US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers - securityweek.com
  32. The inside job that cost ransomware victims millions - malwarebytes.com
  33. ClickFix Social Engineering is Now the Leading Malware Delivery Method - blog.knowbe4.com
  34. ClickFix's Mushrooming Ecosystem Demands New Defense Tactics - darkreading.com
  35. Scammers Can Use AI Tools to Pinpoint Your Location Based on a Photo - blog.knowbe4.com
  36. New phishing kits target Microsoft 365 accounts, evade MFA - bleepingcomputer.com
  37. Study of 85 Crypto Wallet Extensions Finds Address Leaks and Cross-Site Tracking Risks - thehackernews.com
  38. How Pentera Turns AI Security Workflows into Validation Engines - thehackernews.com
  39. You Don't Have to Run an Exploit to Know If You're Vulnerable - bleepingcomputer.com
  40. Warning: Scammers are using FaceTime to empty bank accounts - malwarebytes.com
  41. US sanctions VPN, malware providers for enabling ransomware attacks - bleepingcomputer.com
  42. US charges alleged operators of Russian bulletproof hosting service - bleepingcomputer.com
  43. Nigeria Deepens Cybersecurity Efforts as Cybercriminals See More Profits - darkreading.com
  44. Microsoft Entra ID gets passkeys default authentication starting September - bleepingcomputer.com
  45. Frontier AI: The Genie's Out of the Bottle, but Where's the Rulebook? - darkreading.com