SonicWall has issued a warning regarding the active exploitation of two zero-day vulnerabilities affecting its SMA 1000 series products. The company did not immediately disclose specific details about the nature of these vulnerabilities or the extent of the observed exploitation.
This alert comes as part of a broader landscape of cybersecurity threats. The U.S. CISA has recently added several other flaws to its Known Exploited Vulnerabilities catalog, including issues in Fortinet FortiSandbox, Microsoft SharePoint, KNX Association KNX Protocol Connection Authorization Option 1, Oracle, Cisco IOS, and additional Microsoft products.
In other developments, Zoom has addressed a critical account takeover vulnerability, identified as CVE-2026-53412. Separately, a new exploit dubbed "LegacyHive" has been unveiled, reportedly affecting fully patched Windows systems.
Supply chain attacks continue to be a concern, with malware injected into AsyncAPI npm packages, which collectively have approximately 2 million weekly downloads. Additionally, a new macOS infostealer named CrashStealer has been observed using signed applications to bypass Apple's Gatekeeper security feature.
Several organizations have reported recent cyber incidents. Ernst & Young (EY) is investigating a data breach stemming from a third-party support ticket system. Nichirei, a major Japanese food company, experienced a cyberattack that disrupted operations. Japan's largest taxi company, Nihon Kotsu, also had its systems temporarily suspended due to a cyberattack. Lidl notified online shop customers in Germany, Belgium, and the Netherlands about a data breach.
Law enforcement efforts have seen two members of the Scattered Spider group sentenced to prison in connection with a £29 million cyberattack against Transport for London. An Armenian national has pleaded guilty to a ransomware extortion conspiracy in the United States. The U.S. Treasury has also sanctioned a VPN provider and a cryptor seller implicated in billions of dollars in ransomware losses.
Persistent threats include the 13-year-old China-linked malware Daxin, which has been found active on a manufacturer's network and has resurfaced in Taiwan alongside a new backdoor. A new Russian campaign is deploying the Starland RAT through fake Webex and Zoom installers. Furthermore, a Chinese cyber espionage campaign is reportedly leveraging Claude Code and DeepSeek AI technologies.
In terms of security updates, July 2026 saw a record-breaking Patch Tuesday, with 621 CVEs addressed in a single month. OpenSSL has also released a fix for a memory exhaustion bug, dubbed "HollowByte."
Recommendations from the U.S. and allied governments emphasize securing network devices against Russian APT groups, while Australia has alerted organizations to ongoing exploitation campaigns targeting website content management systems (CMS).
