Daily threat & patch briefing • 15 July 2026 • bndas
▶ Microsoft's July Patch Tuesday Fixes a Record Haul of Flaws and 3 Zero-Days — Update Now
Category: Patch Now
Summary
Microsoft's July 2026 Patch Tuesday is a big one, fixing a record-breaking batch of vulnerabilities — reported at around 570 — including three zero-day flaws that attackers were already exploiting before fixes shipped. Zero-days under active attack are the most urgent kind, because criminals are using them right now. Home users should make sure Windows Update has run and their PC is fully patched, then reboot. IT teams should prioritize testing and deploying these updates quickly, tackling the actively exploited bugs first. Given the scale of this release, don't sit on it — patching promptly closes the door on known, in-the-wild attacks.
Why it matters to you
- Three of the fixed flaws were already being exploited in the wild.
- Running Windows Update and rebooting protects home PCs.
- IT teams should prioritize the actively exploited bugs first.
▶ SonicWall SMA1000 Appliances Under Active Attack — Patch Immediately
Category: Zero-Day
Summary
SonicWall is warning that flaws in its SMA1000 secure-access appliances are being exploited in zero-day attacks, and it's urging customers to patch without delay. These appliances sit at the edge of corporate networks and provide remote access, making them a prized target — a compromise can hand attackers a foothold into the wider environment. Any organization running SMA1000 should apply SonicWall's fixes now, review logs for signs of intrusion, and restrict management access. Internet-facing edge devices like these are repeatedly abused because they're exposed and often overlooked, so treating this as urgent is the right call for defenders.
Why it matters to you
- The flaws are already being exploited, not just theoretical.
- SMA1000 appliances guard remote access to corporate networks.
- Patch now, check logs, and lock down management access.
▶ New Phishing Kits Are Beating MFA on Microsoft 365 Accounts
Category: Phishing
Summary
Security researchers are tracking new phishing kits built to steal Microsoft 365 logins and slip past multi-factor authentication. These kits typically trick users into entering credentials and codes on convincing fake pages, then relay them in real time to hijack the session — meaning MFA alone may not save you. Defenders should push toward phishing-resistant sign-in like passkeys or hardware keys, tighten conditional-access rules, and train staff to spot lookalike login pages. Users should be wary of unexpected login prompts and links arriving by email. MFA is still essential, but it's no longer a silver bullet against determined attackers.
Why it matters to you
- Attackers can bypass standard MFA by relaying your codes live.
- Passkeys and hardware keys resist these phishing tricks.
- Be suspicious of unexpected login pages reached via email links.
▶ Fake 'Security Alerts' Are Targeting LastPass and Bitwarden Users
Category: Phishing
Summary
Attackers are sending bogus security alerts to LastPass and Bitwarden users, hoping to scare them into handing over master passwords or installing malicious software. The lures play on fear — warning of a breach or suspicious activity — to rush you into clicking. Because a password manager holds the keys to your entire digital life, these attacks are especially dangerous. Never act on alerts through email links; instead, open the app or website directly and check your account there. Enable multi-factor authentication on your vault, and remember that legitimate providers won't ask for your master password. When in doubt, slow down and verify.
Why it matters to you
- Your password manager protects every other account you own.
- Don't trust security alerts via email links — verify directly.
- Turn on MFA and never share your master password.
▶ Nearly 300 Fake GitHub Repos Are Posing as Real Software to Spread Malware
Category: Malware / Supply Chain
Summary
Researchers have uncovered close to 300 GitHub repositories disguised as legitimate software and tools, all designed to trick people into downloading malware. The campaign preys on developers and everyday users who grab code and utilities from open-source sites, where a polished-looking project can hide a nasty payload. Before downloading, check a repository's history, star count, and community activity, and be cautious of projects that look brand new or too good to be true. Stick to well-known, verified sources where possible. It's a reminder that "open source" doesn't automatically mean safe — a quick sanity check can prevent an infection.
Why it matters to you
- Malicious repos are dressed up to look like trusted software.
- Check a project's history and reputation before downloading.
- Prefer verified, well-established sources for tools and code.
▶ US Sanctions VPN and Malware Providers Tied to Ransomware Gangs
Category: Threat Intel
Summary
US authorities have issued sanctions against VPN and malware providers accused of enabling ransomware attacks, a notable move against the support services that keep cybercrime running. Rather than only chasing the gangs themselves, officials are targeting the infrastructure — the tools and hosting — that helps attackers hide and operate. For defenders, it's a reminder that ransomware is a full supply chain, not a lone hacker. Sanctions won't stop attacks overnight, but they raise the cost and risk for those propping up criminal operations. Organizations should keep prioritizing backups, patching, and incident-response planning as their core defenses.
Why it matters to you
- Officials are targeting the services that enable ransomware, not just gangs.
- Ransomware runs on a broad support network of tools and hosting.
- Backups, patching, and response plans remain your best defenses.
▶ US and Allies Warn of Russian Attacks on Critical-Infrastructure Routers
Category: Threat Intel
Summary
The US and allied governments have jointly warned that Russian state-linked hackers are targeting routers connected to critical infrastructure. Network routers are attractive targets because they can give attackers persistent, hard-to-detect access and a launchpad for deeper intrusions. The advisory urges organizations — especially those in essential sectors — to harden and monitor these devices. Practical steps include replacing default credentials, applying firmware updates, disabling unused remote-management features, and watching for unusual traffic. Even smaller organizations and home users benefit from the same basics, since neglected routers are a common weak point that attackers of all kinds like to exploit.
Why it matters to you
- Routers give attackers stealthy, long-term network access.
- Update firmware, change default passwords, and disable remote admin.
- The same router hygiene protects homes and small businesses too.
▶ 'LabubaRAT' Malware Disguises Itself as NVIDIA Software to Hijack Windows PCs
Category: Malware
Summary
A newly documented malware strain dubbed LabubaRAT is masquerading as NVIDIA software to take remote control of Windows computers. By posing as trusted graphics-related tools, it aims to trick users into installing it — a classic tactic that abuses well-known brand names. Once in, a remote-access trojan can let attackers spy, steal data, and run commands on your machine. To stay safe, only download drivers and software from NVIDIA's official website or your device maker, avoid "cracked" or third-party installers, and keep security software active. If you've grabbed NVIDIA-branded tools from an unofficial source recently, it's worth scanning your system.
Why it matters to you
- The malware abuses NVIDIA's name to trick you into installing it.
- Only download drivers from official NVIDIA or vendor sites.
- Avoid third-party or "cracked" installers, and keep antivirus on.
▶ Unpatched Claude for Chrome Flaw Could Let Extensions Read Your Gmail and Calendar
Category: AI Security
Summary
Researchers have disclosed an unpatched flaw in the Claude for Chrome AI extension that could allow other browser extensions to read sensitive data such as your Gmail and Calendar. As AI assistants gain deeper access to your accounts and browsing, they also become a bigger target — and a weak link if not carefully sandboxed. Until a fix arrives, be cautious about which browser extensions you install, review the permissions AI tools request, and remove add-ons you don't actively use. AI-in-the-browser is powerful, but this is a timely reminder to treat those broad permissions with the same care you'd give any app.
Why it matters to you
- A browser AI tool could expose email and calendar data to other extensions.
- Review permissions and remove extensions you don't need.
- Broad AI access is convenient but expands your attack surface.