cybersecurity Archives

Winsage

July 15, 2026

Microsoft patches record 570 Windows security bugs with two exploited zero days

Microsoft released its July Patch Tuesday updates, addressing 570 security vulnerabilities in Windows, a record number for the company. This update includes three zero-day vulnerabilities, two of which have been exploited in real-world attacks, affecting Microsoft’s Active Directory and SharePoint, while the third concerns BitLocker encryption. The update also enhances Windows features, including changes to the Widgets app, improvements in File Explorer speed, refined Bluetooth connectivity, and a new feature allowing users to pause updates until a specific date. However, the update has been temporarily halted for certain Dell computers due to compatibility issues, with Microsoft working on a fix.

Tech Optimizer

July 15, 2026

Hundreds of GitHub repos found posing as real software to push malware

Cybersecurity firm ArcticWolf has identified 292 malicious GitHub repositories that impersonate legitimate software tools, part of a campaign to deliver a new variant of the BoryptGrab infostealer. This malware can extract sensitive information from 19 web browsers, 32 cryptocurrency wallets, messaging applications like Telegram and Discord, gaming platforms such as Steam, and Windows Credential Manager. It can also exfiltrate files from users' Desktop and Documents folders and capture screenshots. This variant bypasses Chrome’s App-Bound Encryption using direct code injection and does not include an anti-analysis layer or conceal itself, aiming to harvest data quickly without persistence. The malicious activity began in late June, with most repositories removed from GitHub, though several dozen remain active. GitHub's status as a key platform in the open-source community makes it a target for cybercriminals, emphasizing the need for developers to thoroughly vet code before integration.

Winsage

July 15, 2026

Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday

Security researcher Chaotic Eclipse has released a proof-of-concept exploit called LegacyHive, which targets a vulnerability in the Windows User Profile Service. The exploit requires standard user credentials and a third username, potentially an administrator account. It can mount the target user hive in the current user classes root and is designed to reduce the risk of public exploitation. The exploit works across all supported desktop and server versions of Windows, including those updated with the July 2026 Patch Tuesday release. Microsoft is investigating the findings related to LegacyHive. Microsoft has patched 622 vulnerabilities, including two privilege escalation flaws in SharePoint Server (CVE-2026-56164, CVSS score: 5.3) and Active Directory Federation Services (CVE-2026-56155, CVSS score: 7.8), which are actively exploited threats. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included these vulnerabilities in its Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to implement fixes by specified deadlines. CISA has also noted active exploitation of several SharePoint Server vulnerabilities, including CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, which allow unauthorized access to vulnerable instances. CVE-2026-56164 enables attackers to send crafted network requests to access functions that should require authorization, leading to privilege escalation without prior authentication. Additionally, CVE-2026-55040 (CVSS score: 9.1) allows remote unauthenticated attackers to bypass authentication on a vulnerable SharePoint server, enabling unauthorized operations.

Winsage

July 14, 2026

Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities

Microsoft's July 2026 security update addresses 622 vulnerabilities, with 57 classified as "critical." Two critical vulnerabilities, CVE-2026-56155 (Active Directory Federation Services) and CVE-2026-56164 (Microsoft SharePoint Server), have been exploited in the wild. The critical vulnerabilities include 48 remote code execution (RCE) vulnerabilities, seven elevation of privilege (EoP) vulnerabilities, one spoofing vulnerability, and one security feature bypass vulnerability. RCE vulnerabilities affect various Microsoft services, including Windows Media, Microsoft Office, and SQL Server, with eleven rated as "more likely" to be exploited. Additional important vulnerabilities include CVE-2026-49170, CVE-2026-49795, and CVE-2026-50325. Talos is releasing a new Snort ruleset to detect these vulnerabilities, and Cisco Security Firewall customers are advised to update their ruleset.

AppWizard

July 14, 2026

Chatto: Open-source team messenger with privacy at its core

Chatto is a self-hosted messaging software released under an open-source license, allowing users to run it on their own hardware. It supports builds for Linux, macOS, and Windows and requires only a single executable for installation. Chatto encrypts message texts and selected durable account fields using per-user keys, ensuring that only the account owner can access their plaintext data. When a user deletes their account, the associated keys are destroyed, rendering the data unreadable. Each Chatto server is dedicated to a single community, isolating users and messages from others. The software includes built-in voice and video calls with end-to-end encryption. A paid hosting option, Chatto Cloud, is set to enter public beta soon, operating on European infrastructure while maintaining compatibility with self-hosted versions. Chatto is available for free on GitHub.

AppWizard

July 14, 2026

Steam, Minecraft and Dota 2 simultaneously “went down” worldwide

Users globally are experiencing significant disruptions in the Steam service, with 46% facing server connection issues, 29% having login problems, and 14% encountering difficulties with downloading and updating games. Similar disruptions are reported in Minecraft and Dota 2. Additionally, the European Union has blacklisted members of a Russian intelligence group involved in espionage and cyberattacks against the EU and Ukraine since 2010.

Tech Optimizer

July 13, 2026

Best antivirus software for 2026, tested and reviewed by an expert

The digital landscape is increasingly threatened by scams and cyberattacks, necessitating robust antivirus solutions for various devices. Modern antivirus software has evolved into comprehensive security suites that include features like VPNs, email protection, and dark web monitoring. Users must balance feature richness with system performance, as costs can vary significantly after initial promotional rates. The best antivirus software includes: - Bitdefender Premium: Rated 4.5/5, priced from £49.99 per year, known for strong performance and a comprehensive feature set but limited to a single device for the free version. - Surfshark One: Rated 4/5, priced from £1.99 per month, recognized for its user-friendly interface but lacking some central features. - Norton 360 Deluxe: Rated 4/5, priced from £29.99 per year, praised for excellent performance and light system impact, though its interface is less polished. - Avira Free Security: Rated 3/5, free option available, offers basic protection but prompts users to upgrade frequently. - Avast One: Rated 4/5, free option available, features a modular design but includes persistent upgrade prompts. Each antivirus package provides solid protection against cyber threats, with many offering free trials for evaluation.

AppWizard

July 13, 2026

EU Sanctions VK for Developing Messenger App Max

The European Union has imposed sanctions on Russian tech giant VK and its subsidiary, Communication Platform LLC, due to their involvement in the development of the Kremlin-backed messaging app, Max. The development of Max was overseen by the Federal Security Service (FSB), and it has been criticized for its surveillance capabilities. These sanctions are part of a broader strategy by the EU and the UK to target entities linked to Russian cyberattacks. The EU and UK also announced additional sanctions against individuals and entities involved in Russian cyber operations, including targeting leaders of Russia's GRU military intelligence and individuals linked to the FSB’s Center 16. Apple removed VK platforms and the Max app from its App Store last month, citing compliance with sanctions. The EU plans to introduce its 21st package of sanctions against Russia soon.

AppWizard

July 12, 2026

Your free VPN on Android often offers less protection than you might think

The MVPNalyzer Study conducted by researchers at the University of Michigan analyzed various VPN services, focusing on their performance metrics, data privacy practices, and effectiveness in bypassing geographical restrictions. The study revealed that some VPNs excel in speed while others prioritize security features, and not all services provide the same level of data protection, with certain logging practices raising concerns. The findings encourage users to closely examine VPN services regarding speed, privacy policies, and data management, while urging VPN providers to improve transparency and invest in user security technologies.

Winsage

July 11, 2026

AI Threat Forces Microsoft To Update Windows Patch Guidance

Microsoft is advocating for a reevaluation of Windows patch management practices due to the rapid evolution of artificial intelligence (AI) impacting cybersecurity. The company emphasizes that traditional timelines for patch deployment, typically spanning several weeks after the monthly Patch Tuesday, are inadequate against modern cyber threats. Microsoft recommends organizations shorten deployment windows to under three days for quality updates, with immediate installation deadlines and minimal user grace periods. To support these changes, Microsoft is enhancing Windows Autopatch with a new reporting dashboard for patch compliance and security insights. The company is promoting cloud-managed deployment through Microsoft Intune and Windows Autopatch while continuing to support legacy tools. Additionally, Microsoft is introducing Windows Hotpatch technology, allowing security updates to be installed without immediate reboots, and advocating for the use of identity-based access controls to isolate unpatched devices. The guidance reflects a shift from scheduled patching to continuous risk management, encouraging organizations to prioritize high-risk assets and automate update deployments. Microsoft is also investing in AI-assisted vulnerability discovery and automated code analysis to improve defensive capabilities. The overarching message is that enterprises must adapt their update strategies to address the accelerated pace of AI-driven exploitation.