Attackers are reportedly bypassing Microsoft Entra ID sign-in logs by spoofing OAuth client IDs during account enumeration against Microsoft cloud tenants. This technique involves manipulating the `client_id` parameter in authentication requests, which Entra ID records as the application ID. The way the system handles unfamiliar identifiers creates a blind spot that threat actors are exploiting to avoid detection.
In other developments, Coca-Cola disclosed a ransomware attack on July 16, 2026, which has halted milk production at its Fairlife dairy brand. The incident was reported in a Form 8-K filing with the U.S. Securities and Exchange Commission (SEC).
Progress Software has issued a warning regarding a "credible external security threat" targeting its ShareFile Storage Zone Controllers (SZC). The company disabled access to ShareFile accounts utilizing these on-premises, customer-managed server components and, on July 10, urged customers via email to manually shut down their servers hosting the SZCs.
SonicWall has addressed two actively exploited zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, affecting its Secure Mobile Access (SMA) 1000 Series appliances. The vendor is advising customers to upgrade to a patched firmware version and investigate for signs of compromise.
Microsoft's July 2026 Patch Tuesday included fixes for over 570 vulnerabilities. Among these were two actively exploited vulnerabilities, CVE-2026-56155 and CVE-2026-56164, and one previously disclosed vulnerability, CVE-2026-50661. Following the release, a researcher known as Nightmare Eclipse published a proof-of-concept exploit for an unpatched Windows elevation of privilege vulnerability, which they named LegacyHive.
WordPress released security update 7.0.2 to address two high-severity security issues, one of which is critical. Users are advised to patch immediately.
Separately, a new ransomware strain named Spirals was observed in an attack last month against an IT services company in South Asia. Symantec's Threat Hunter Team reported that the attackers achieved initial access, data theft, and network encryption in less than 24 hours.
Apple has warned iPhone and iPad users about scammers leveraging FaceTime calls to trick individuals into divulging financial and account information.
Threat researchers at Arctic Wolf have identified a financially motivated actor impersonating hundreds of brands on GitHub. This actor is distributing infostealer malware disguised as legitimate software downloads.
In related news, ESET researchers discovered that 11 outdated versions of Shim (0.9 and earlier), a Microsoft-signed first-stage bootloader used by UEFI systems, contain vulnerabilities that could undermine Secure Boot. Microsoft revoked trust in these versions as part of its June 9, 2026 Patch Tuesday update.
