Category: Cyber Security News

Microsoft released a record-breaking Patch Tuesday with 622 CVEs, including two actively exploited zero-days: CVE-2026-56164 in SharePoint Server and CVE-2026-56155 in Active Directory Federation Services. The update also includes a SharePoint authentication bypass, BitLocker fixes, and major Kerberos RC4 hardening that could break legacy logins if environments are not audited first….

Microsoft released patches for 622 vulnerabilities, including zero-days in Active Directory Federation Services and SharePoint Server that were already being exploited in the wild. The update also addressed high-severity issues across Windows, Office, BitLocker, Exchange Server, RDP, and other products, while Adobe fixed 88 additional flaws. #CVE-2026-56155 #CVE-2026-56164 #CVE-2026-50661 #SharePointServer #ActiveDirectoryFederationServices…

SonicWall warns that attackers are actively exploiting CVE-2026-15409 and CVE-2026-15410 in zero-day attacks against SMA1000 appliances, and urges customers to install the latest hotfixes immediately. CISA has added both flaws to its KEV catalog, while affected administrators are advised to check for the listed indicators of compromise and re-image or redeploy compromised devices if needed. #SonicWall #CVE-2026-15409 #CVE-2026-15410 #SMA1000 #CISA #KEV

Microsoft’s latest Patch Tuesday set a record by addressing 622 vulnerabilities across Windows, Office, Edge, and other business products, including two actively exploited zero-days in Active Directory Federation Services and SharePoint Server. SAP also issued fixes for critical flaws in NetWeaver Application Server and Approuter as Microsoft’s vulnerability totals continue rising sharply. #Microsoft #ActiveDirectoryFederationServices #SharePointServer #SAPNetWeaver #SAPApprouter

LastPass is warning users about a phishing campaign that uses fake security notices and a counterfeit DocuSign page to lure victims to malicious sites. The company says its systems were not compromised, and it advises users to report suspicious emails and change their master password if they entered credentials. #LastPass #DocuSign #Bitwarden #lastpasscompliance #bitwardencompliance

Progress Software confirmed that a high-severity zero-day path traversal vulnerability forced the emergency shutdown of ShareFile Storage Zone Controllers and has now released patches. The company says there is no indication of customer account compromise or active threat, and urges users to install the updates immediately. #ProgressSoftware #ShareFile #StorageZoneController

Microsoft has released Windows 11 cumulative updates KB5101650 and KB5099414 for 25H2/24H2 and 23H2, delivering July 2026 Patch Tuesday fixes for 571 vulnerabilities along with bug fixes and new features. The updates improve Bluetooth pairing, Widgets, File Explorer, accessibility, networking, printing, WSL, and more, while also introducing Point-in-Time restore and several reliability enhancements. #Microsoft #Windows11 #KB5101650 #KB5099414 #PatchTuesday

Microsoft’s July 2026 Patch Tuesday delivers security updates for a record 570 flaws, including three zero-days, two of which were actively exploited in attacks. The fixes span major products such as Active Directory Federation Services, SharePoint Server, BitLocker, Exchange Server, Office, Windows, and Microsoft Defender, with broad coverage across elevation of privilege, remote code execution, information disclosure, and other bug classes. #CVE-2026-56155 #CVE-2026-56164 #CVE-2026-50661 #ActiveDirectoryFederationServices #SharePointServer #BitLocker #MicrosoftDefender

Broadcom has released VMware Avi Load Balancer updates to fix seven serious vulnerabilities, including a critical authentication bypass that could let an attacker breach the Avi control plane. The flaws were reported by Filip Waeytens of NATO’s technology and cyber hub and Lang Khuong Duy of Viettel IDC, and Broadcom says…

Adobe issued security updates for 12 products to fix 88 vulnerabilities, including critical flaws in ColdFusion, Commerce, Experience Manager, and Illustrator. The company says none of the issues are known to be exploited in the wild, but it urges customers to patch immediately. #Adobe #ColdFusion #Commerce #ExperienceManager #Illustrator…

Synopsys says it found no evidence of unauthorized access after the D1R ransomware group claimed to have stolen customer data and Bosch intellectual property through its systems. The hackers’ alleged proof appears weak, and the company says the claims of access to customer confidential data are unfounded. #Synopsys #Bosch #D1R…

The U.S. Treasury Department sanctioned First VPN Services (1VPNS), its alleged administrator Dmytro Rashevskyi, and Belarusian national Yegeniy Vladimirovich Silayev for allegedly supporting ransomware operations. Authorities said 1VPNS infrastructure and cryptors were used by ransomware groups to hide attacks, deploy malware, and manage stolen data, affecting U.S. businesses, hospitals, municipalities, and financial services firms. #FirstVPN #1VPNS #DmytroRashevskyi #YegeniyVladimirovichSilayev

SAP’s July 2026 security updates address 16 vulnerabilities across multiple products, including critical flaws in NetWeaver AS ABAP, SAP Approuter, and SAP Commerce Cloud. Although SAP has no evidence of active exploitation yet, several of the patched issues could enable memory corruption, request smuggling, unauthorized access, and data modification. #SAPNetWeaver #SAPApprouter #SAPCommerceCloud #CVE-2026-44747 #CVE-2026-27690 #CVE-2026-44761

Two new phishing kits, Jalisco and OmegaLord, are targeting Microsoft 365 accounts with methods designed to bypass multi-factor authentication. Jalisco uses device-code phishing while OmegaLord steals credentials and phone numbers through a fake PDF Reader page to help attackers hijack MFA approvals. #Jalisco #OmegaLord #Microsoft365 #EntraID