July 2026 Patch Tuesday: what Security and IT teams should prioritise
July 2026 Patch Tuesday covers 135 approved patch records and 682 unique CVEs across Microsoft, Adobe and SAP.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
SonicWall Patched Two Zero-Days. Then the Replacement Builds Were Exploited Too.
SonicWall confirmed exploitation of two SMA1000 vulnerabilities. If compromise indicators are present, defenders must rebuild the appliance and reset credentials, not merely install the hotfix.
Spain’s Cybercrime Numbers Need Context
Compare crime reports, operational incidents and breach notifications without creating a misleading total. Keep definitions and reporting periods visible.
Mean Time to Exploit Just Went Negative: The Patch Window Is Gone
Mandiant’s M-Trends 2026 report, published 23 March 2026, puts a number on something defenders have felt for a while: the mean time to exploit (MTTE) a vulnerability is now an estimated -7 days. Exploitation is routinely happening before a patch…
The AssuranceAmerica Breach Affected Nearly Seven Million People
A breach reported by AssuranceAmerica affected 6,998,886 people and included driver-licence information. The long-term risk is identity abuse, not only an immediate phishing campaign. US motor insurer AssuranceAmerica began notifying people after an incident affecting 6,998,886 individuals. Public notices and…
1.4 Million Sites Were on the List. 25,195 Had Evidence of Compromise.
WP-SHELLSTORM's exposed server showed how target lists, validated compromises and active webshells are different measures of a mass-exploitation operation.
Alicante’s Recovery Began With Shutdown
Recovery planning should prioritise the work people must complete. Test dependencies, reconnection decisions and acceptance evidence.
JADEPUFFER Compresses a Ransomware Intrusion into Minutes
Sysdig describes JADEPUFFER as the first documented end-to-end agentic ransomware operation. Its speed changes how defenders should think about containment and AI infrastructure exposure. Sysdig reported an operation it calls JADEPUFFER on 1 July. The attacker exploited an internet-facing Langflow…
Kenya Expanded Its Cybercrime Law. The Courts Have Already Drawn a Boundary.
Kenya expanded its cybercrime law in 2025, then saw the High Court invalidate administrative website blocking and a vague speech offence in 2026.
When a Government Can Switch Off Your AI
Claude, export controls and the case for keeping local models within reach On Tuesday, 9 June 2026, Anthropic released Claude Fable 5 and Claude Mythos 5. Three days later, neither model was available to anyone. The reason was not a…