Breaking-Alert

Published Saturday, July 18, 2026 at 10:00 AM PT BLUF: Apple has released Safari 26.5.2 containing security fixes. All macOS and iOS users running Safari should apply this update immediately. Specific CVE details require verification at Apple’s official support page. DETAILS: Apple released Safari version 26.5.2 as a security update Update is available for macOS and iOS systems running Safari Apple’s official documentation is available at support.apple.com/en-us/100100 UNCERTAINTY NOTE: Specific CVEs addressed, severity levels, and technical details of vulnerabilities are not confirmed in available information and must be verified through Apple’s official advisory No public exploit activity confirmed at this time IMPACT: ...

Published Thursday, July 16, 2026 at 12:19 PM PT BLUF: Microsoft SharePoint Server is under active exploitation via three critical vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164). CISA has issued a hardening alert. Organizations running SharePoint Server must apply patches immediately. An additional high-severity flaw was recently patched in July 2026 Patch Tuesday. DETAILS: Three Microsoft SharePoint Server vulnerabilities are confirmed under active, in-the-wild exploitation as of publication date CVE-2026-56164 was addressed in Microsoft’s July 2026 Patch Tuesday release (569 total CVEs patched that month) CISA has issued formal hardening guidance in response to active exploitation activity An additional high-severity SharePoint flaw was recently patched; specific CVE designation and severity level require confirmation from primary Microsoft advisory Exploitation appears targeted at SharePoint Server deployments; scope of affected versions not yet confirmed in available sources IMPACT: ...

Published Thursday, July 16, 2026 at 12:18 PM PT BLUF: The White House has launched the Gold Eagle Initiative, an AI-driven vulnerability coordination clearinghouse designed to accelerate identification and remediation of cybersecurity vulnerabilities affecting U.S. critical infrastructure. The platform aims to improve coordination between government and private sector on vulnerability disclosure and response timelines. No immediate threat to organizations; this is a defensive capability announcement. ...

Published Thursday, July 16, 2026 at 10:00 AM PT Apple released security updates across iOS, iPadOS, macOS Tahoe, and Safari on June 29, 2026, addressing more than 30 confirmed vulnerabilities. Organizations should prioritize deployment of these updates immediately, particularly for devices in high-risk environments. Full CVE details available at https://support.apple.com/en-us/100100. DETAILS Apple released four coordinated security updates (APPLE-SA-06-29-2026-1 through -3) patching 30+ vulnerabilities across iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2 WebKit vulnerabilities represent significant portion of patches; some vulnerabilities reportedly discovered through AI-assisted analysis methods Apple accelerated release timeline in response to emerging AI-powered exploitation risks — updates deployed ahead of standard schedule Updates address vulnerabilities affecting core system components and browser functionality Uncertainty note: Specific CVE identifiers and severity ratings not yet fully enumerated in available sources; refer to official Apple security documentation for complete technical details IMPACT ...

Published Thursday, July 16, 2026 at 06:18 AM PT BLUF: CISA has confirmed active exploitation of three vulnerabilities affecting Microsoft SharePoint on-premises deployments. Organizations must immediately apply available patches and implement hardening measures. At least one vulnerability enables remote code execution (RCE). Scope and specific CVE identifiers are confirmed in CISA advisories; full technical details available via CISA Current Activity. ...

Published Thursday, July 16, 2026 at 06:17 AM PT BLUF: Microsoft has patched two actively exploited zero-day vulnerabilities affecting on-premises SharePoint Server (CVE-2026-56164) and Active Directory Federation Services (CVE-2026-56155) as part of July 2026 Patch Tuesday. Organizations running these services should prioritize patching immediately. Exploitation is confirmed in the wild. DETAILS: CVE-2026-56164 targets on-premises Microsoft SharePoint Server with remote exploitation capability; active exploitation confirmed CVE-2026-56155 affects Active Directory Federation Services (AD FS); active exploitation confirmed Both vulnerabilities were zero-day at time of discovery and included in Microsoft’s July 2026 Patch Tuesday release Patches are available; specific CVSS scores and technical attack vectors not yet fully detailed in available reporting Note: Source material truncated; complete technical specifications require access to full Microsoft advisory IMPACT: ...

Published Thursday, July 16, 2026 at 06:17 AM PT BLUF: Two critical zero-day vulnerabilities in SonicWall SMA 1000 Series remote access appliances are being actively exploited in the wild. One requires no authentication; the other requires valid credentials. Organizations operating SMA 1000 devices must apply patches immediately. Public exploits are available. DETAILS: CVE-2026-15409 (CRITICAL): Unauthenticated Server-Side Request Forgery (SSRF) flaw in the Workplace interface. Requires no valid credentials to exploit. Confirmed public exploit available. ...

Published Wednesday, July 15, 2026 at 06:16 PM PT BLUF: CISA and U.S. Coast Guard conducted a proactive threat hunt at a U.S. critical infrastructure organization and found no evidence of active malicious cyber activity or threat actor presence. However, the assessment identified significant cybersecurity hygiene deficiencies that create exploitable vulnerabilities. Affected organization should immediately remediate identified gaps, particularly credential management and logging controls. ...

Published Wednesday, July 15, 2026 at 06:15 PM PT BLUF: CISA and FBI have issued joint advisory on Interlock ransomware, a financially motivated threat with encryptors targeting both Windows and Linux systems. Organizations should review indicators of compromise and implement defensive measures outlined in the #StopRansomware advisory. No immediate zero-day or active mass exploitation reported at this time. DETAILS: Interlock is a financially motivated ransomware variant with confirmed encryptors designed for Windows and Linux operating systems FBI has documented Interlock activity and TTPs; advisory includes indicators of compromise (IOCs) for network defense This advisory is part of CISA’s ongoing #StopRansomware campaign to provide defenders with historical and recent threat actor behavior patterns Cross-platform capability indicates potential targeting of both enterprise endpoints and server infrastructure Specific current campaign scope and victim count are not detailed in available advisory summary IMPACT: ...

Published Wednesday, July 15, 2026 at 06:14 PM PT BLUF: Palo Alto Networks Unit 42 has published updated analysis of the npm threat landscape identifying active attack vectors including wormable malware, CI/CD persistence mechanisms, and multi-stage attacks targeting JavaScript developers and their build environments. Organizations using npm packages should review dependency trees and implement supply chain controls immediately. ...