CISA Urges Immediate Patch for Exploited SharePoint Vulnerabilities
PremiumCISA warns of actively exploited SharePoint vulnerabilities and flags a stealthy ransomware family and law-enforcement takedowns.
Friday, July 17
Microsoft-Revoked UEFI Shims Pose Secure Boot Bypass Risk
PremiumEleven Microsoft-signed legacy UEFI shims can be abused to bypass Secure Boot, undermining platform integrity across devices.
Critical Vulnerabilities Patched in F5 NGINX and BIG-IP Systems
PremiumF5 patched multiple NGINX and BIG-IP flaws that could allow configuration tampering, process termination, memory leaks, or code execution.
Security Breach at India's Largest Nuclear Plant Raises Concerns
PremiumHackers published alleged blueprints and supplier data from an Indian nuclear project, risking sensitive national infrastructure disclosure.
Ofcom Scrutinizes TikTok's Age Verification Amid Safety Concerns
PremiumOfcom probes TikTok over alleged insufficient age verification that may expose minors to online harms under UK safety laws.
Cyberattack on Nichirei Logistics Shakes Japan's Food Supply Chain
PremiumCyberattack on Nichirei Logistics disrupted cold-chain operations, causing KFC and supermarket supply shortages across Japan.
Advanced Malware Daxin and New Backdoor Stupig Target Taiwan Manufacturer
PremiumDaxin kernel rootkit resurfaces with a new Stupig pre-login backdoor targeting a Taiwan manufacturing firm for persistence.
LegacyHive Zero-Day Exploit Puts Windows User Profiles at Risk
PremiumResearcher published LegacyHive Windows zero-day PoC impacting User Profile Service, enabling arbitrary hive load privilege escalation.
Critical Vulnerability in Laravel Livewire Leads to Massive Credential Theft
PremiumAttackers exploited Laravel Livewire CVE-2025-54068 to run PHP deserialization payloads and steal credentials and secrets at scale.
Spirals Ransomware Poses Urgent Challenge with Rapid Network Encryption
PremiumSpirals ransomware completes intrusion-to-encryption in under 24 hours, stressing the need for rapid detection and response.
Federal Agencies Urged to Patch Oracle Vulnerability Amid Active Exploits
PremiumCISA issued an emergency order forcing federal agencies to patch an actively exploited Oracle E-Business Suite vulnerability immediately.
Critical Vulnerabilities in SonicWall SMA1000 Series Under Active Attack
PremiumSonicWall SMA1000 zero-days (including SSRF CVE-2026-15409) are actively exploited; apply mitigations and emergency patches.
Microsoft's Largest Patch Tuesday Addresses Over 600 Vulnerabilities, Including Active Zero-Day Exploits
PremiumMicrosoft released its largest Patch Tuesday, fixing hundreds of CVEs including two zero-days actively exploited, requiring prioritization.
Wednesday, July 15
Forg365 PhaaS: A New Threat to Microsoft 365 Security
Forg365 phishing-as-a-service uses device-code phishing, AitM, AI lures, and mailbox operations to compromise Microsoft 365 accounts for customers.
Misconfigured Server Unveils Trio of Phishing Operations Targeting Microsoft 365
Directory listing on misconfigured server exposed three Evilginx phishing operations that bypass MFA to target Microsoft 365 users.
SonicWall Urges Immediate Patching of SMA1000 Vulnerabilities Amid Active Exploitation
SonicWall discloses CVE-2026-15409 and CVE-2026-15410 in SMA1000 actively exploited in zero-day attacks; customers urged to patch immediately.
Security Breach: AsyncAPI npm Packages Compromised via GitHub Actions
AsyncAPI packages were trojanized after attacker stole an npm publishing token via GitHub Actions, risking developer and CI compromise.
Miasma v3 Exploits npm Packages to Breach Developer Systems
Miasma v3 delivered via trojanized AsyncAPI packages creates persistent backdoors on developer machines and build servers.
Sophisticated OAuth Client ID Spoofing Tactics Threaten Microsoft Entra Security
Novel OAuth client ID spoofing enables attackers to validate stolen Microsoft Entra credentials and enumerate accounts while evading telemetry.
New Phishing Kits Exploit MFA Vulnerabilities in Microsoft 365
Jalisco and OmegaLord phishing kits target Microsoft 365, using MFA-evasion techniques to steal credentials and session tokens.
Get these articles delivered to your inbox.
Subscribe free