On 17 July 2026 WordPress shipped forced updates 6.9.5 and 7.0.2 to close wp2shell (CVE-2026-63030), a pre-authentication remote code execution flaw in core that an anonymous request could trigger on a default install. Why the automatic patch is not where your job ends.
CISA added a critical SharePoint Server flaw to its exploited-vulnerabilities list on 17 July 2026 with a 19 July patch deadline. Attackers are stealing server keys, so patching alone leaves the door open. What on-premises owners must do.
On 15 July 2026 CISA added CVE-2023-4346 to its KEV catalog. The KNX flaw has no patch. The fix is a commissioning setting, and the buildings are European.
CVE-2026-15409 and CVE-2026-15410 chain into root on SonicWall SMA1000. Stolen TOTP seeds survive the patch, which is why Germany's BSI orders Assume Breach.
CISA catalogued two FortiSandbox flaws on 16 July. Attackers were exploiting them in mid-June, and a third from the same wave is still not listed. If KEV drives your patching, you are late.
A hacker infected one Suno employee with a worm and walked out with the source code. It did not catch the company lying. It turned a legal abstraction into an inventory with hours and row counts, in the middle of litigation.
Two Scattered Spider members were jailed for five and a half years each on 16 July over the Transport for London attack. TfL paid no ransom. The 29 million pounds went on recovery, and the way in was a helpdesk call.
xAI published Grok Build under Apache 2.0 after a wire-level test found it uploading private repositories. The release has one squashed commit, a stubbed upload function, and no bucket name. Open sourcing is not an audit.
ESET found eleven old Microsoft-signed bootloaders that slip past Secure Boot on almost any PC, with no admin rights needed. Patching them is the easy part. Here is the exposure most fleets never audit.
Microsoft fixed 570 flaws on 14 July, nearly three times its June record. Two are already exploited, and a BitLocker bypass weakens your breach defence.
Microsoft stops delivering SMS and voice MFA codes in Entra ID on 1 February 2027 and makes passkeys the default from 1 September 2026. The retirement date is fixed, but the price of the only alternative is not published until 18 September, so the migration has to be planned before the fallback can be costed.
The EU and UK sanctioned 33 Russian targets and named FSB Centre 16 for the attack on Poland's grid. On the same day, thirteen nations warned the way in is your router - and a 2008 Cisco flaw got a three-day patch clock.
Page 7 / 11
One considered note on infrastructure, governance, and measurement, most mornings. No theory.