Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Microsoft released patches for over 570 vulnerabilities in its July 2026 Patch Tuesday, the largest security update in the company’s history, including two zero-days already under active exploitation. Among them, one stands out for how it is being exploited right now: an unauthenticated vulnerability in SharePoint Server that allows an unauthenticated attacker to elevate privileges to Farm Administrator.

SilverFox is expanding its toolkit. In this campaign, the group combines new vulnerable-driver abuse, newly observed abuse of legitimate applications for DLL sideloading, defense evasion, and layered recovery mechanisms to keep ValleyRAT running. We investigated an active campaign targeting a Japanese organization in the industrial manufacturing sector. The attack begins with an invoice-themed phishing lure and uses attacker-controlled content hosted through legitimate QQ and Tencent Cloud services.

New GenAI code security research shows a stubborn truth: as AI is generating more of the code entering production, secure output is not improving at the same pace. The result is a GenAI code security challenge defined by scale, model choice, and the growing need for verification. AI coding has moved past experimentation. For many teams, it is now part of how software gets built every day. That’s the opportunity. It’s also the risk.

Many organizations still rely on legacy applications to run core business processes. But that comes with limitations. According to the Workforce Agility Report, 50% of CIOs said legacy applications hold back digital transformations. More importantly, they create major security gaps. Most legacy applications, such as Oracle EBS, PeopleSoft, SAP, and JD Edwards, use authentication methods that do not fit modern identity requirements.