VMware Patches Seven Severe Avi Load Balancer Vulnerabilities

A seven-flaw Avi Load Balancer patch cycle from VMware — defender verification this week.

iCagenda and Balbooa Forms Joomla Zero-Days Reportedly Exploited in the Wild

Two Joomla-extension zero-days under active attack — Joomla operators accelerate patch verification this week.

SonicWall SMA Appliances Under Active Zero-Day Attack via CVE-2026-15409 and CVE-2026-15410

Two SonicWall SMA zero-days under active attack — immediate defender posture review this week.

Adobe Publishes Critical ColdFusion Patches as Its Vulnerability Thread Continues

Adobe's ColdFusion patch cycle continues — defender verification across deployments this week.

SAP Patches CVSS 9.9 NetWeaver ABAP Flaw, Plus Approuter and Commerce Cloud

A CVSS 9.9 NetWeaver ABAP flaw anchors SAP's critical patch cycle — defender verification across products this week.

Researchers Flag 11 Old Microsoft-Signed Linux UEFI Shims That Could Bypass Secure Boot

Eleven old Microsoft-signed shims land as bypasses of Secure Boot — Linux-boot defender review this week.

Ars Technica Documents a Decade-Old Weakness in Microsoft's Secure Boot

A decade-old Secure Boot revelation — lifecycle-security implications for defender teams this week.

Microsoft Patches SharePoint JWT Authentication-Bypass Flaw (CVE-2026-55040)

A SharePoint JWT auth bypass patched in July's Patch Tuesday — defender verification this week.

Microsoft Ships a Record 622-CVE Patch Tuesday With Two Zero-Days Under Active Attack

Microsoft's July Patch Tuesday breaks its own record — 622 CVEs, two zero-days under active attack, and defender triage stakes rise this week.

“CrashStealer” macOS Malware Reportedly Uses a Notarized Dropper to Pass Gatekeeper

A macOS notarization-abuse malware disclosure — defender review for Mac-issuing organizations this week.

Researchers Document “Forg365,” a Phishing-as-a-Service Platform Targeting Microsoft 365

A new named PhaaS platform targeting Microsoft 365 — defender teams review posture and OAuth-hygiene this week.

Researchers Disclose “MemGhost,” a Technique That Plants Persistent False Memories in AI Agents

Another AI-agent supply-chain finding — defender posture review for organizations deploying memory-enabled agents this week.