Ernst & Young (EY) is investigating a potential data breach that reportedly involves third-party support tickets. The company has not yet confirmed the scope or nature of the incident, nor has it publicly identified the third-party vendor involved.
The investigation follows claims of a compromise, though details regarding the type of data exposed or the number of individuals affected remain unverified. EY, a global professional services network, typically handles sensitive client and internal information, making any breach of its systems or those of its partners a significant concern.
This incident is one of several cybersecurity events reported recently. Japan's Nichirei, a major food company, also confirmed it was hit by a cyberattack, though specific details about that incident, such as the type of attack or its impact, were not immediately available.
Meanwhile, a 13-year-old China-linked malware, Daxin, has reportedly been found active on a manufacturer's network, indicating its continued use in sophisticated operations. The discovery suggests the malware, known for its stealth and persistence, may have resurfaced in Taiwan alongside a new backdoor.
In other developments, the U.S. CISA has updated its Known Exploited Vulnerabilities catalog to include several critical flaws. These additions include vulnerabilities in Fortinet FortiSandbox, Microsoft SharePoint, KNX Association KNX Protocol Connection Authorization Option 1, and Oracle products. CISA also added flaws affecting SonicWall and other Microsoft products to the catalog, urging organizations to patch these vulnerabilities promptly.
SonicWall specifically issued a warning about active exploitation of two zero-day vulnerabilities affecting its SMA 1000 series products. The company advised users to take immediate action to mitigate potential risks.
The npm package ecosystem has also seen a supply chain attack, with malware reportedly injected into AsyncAPI packages that collectively receive two million weekly downloads. This type of attack can widely distribute malicious code to developers and their projects.
Further, a new Russian campaign has been observed deploying the Starland RAT through fake Webex and Zoom installers, leveraging common communication tools to trick users. Similarly, a financially motivated campaign, identified by the Claude for-Chrome Extension-Bypass UAT-11795, is deploying a novel Starland RAT and a bespoke WLDR C2 implant.
In the realm of patching, July 2026 saw a record-setting Patch Tuesday, with 621 CVEs addressed in a single month, marking the largest update ever. This extensive update covered a wide array of software and systems, underscoring the ongoing challenge of managing software vulnerabilities.
Zoom recently fixed CVE-2026-53412, a critical account takeover bug, while OpenSSL addressed a memory exhaustion bug dubbed HollowByte. Separately, researchers unveiled a "Chaotic Eclipse" exploit affecting fully patched Windows systems, highlighting the persistent threat of sophisticated attacks even against updated environments.
In legal news, two members of the Scattered Spider group were sentenced to prison for their involvement in a cyberattack against Transport for London (TfL), which resulted in an estimated £29 million in damages. The U.S. Treasury also sanctioned a VPN provider and a cryptor seller, alleging their involvement in ransomware operations responsible for billions in losses.
