☕️ Microsoft patches record 622 flaws two under attack

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

🛡️ Microsoft patches record 622 flaws two under attack

🚕 Cyberattack downs Japan's biggest taxi operator

📌 Secure Boot broken for a decade unnoticed

🔓 SonicWall VPN flaws let hackers run code

Plus: 💡 4 strategies & tactics, 🎁 7 other news you might like, 🧰 6 tools, and 📚 5 papers.

• Microsoft's July Patch Tuesday set a record by fixing 622 CVEs across its products, 58 of them critical, with two already under active attack and one publicly disclosed but not yet exploited.
• One actively exploited flaw lets an attacker who already has local access gain administrator privileges due to weak access control, while a SharePoint bug missing authentication also allows privilege escalation over a network.
• The publicly disclosed but unexploited issue lets anyone with local access to a BitLocker-secured machine physically bypass its protections; Microsoft recommends installing all the patches as soon as possible.

• Nihon Kotsu, Japan's largest taxi and chauffeur operator, was hit by a cyberattack over the weekend that forced it to shut down parts of its infrastructure, with its taxi dispatch system still offline today.
• The company confirmed a malware infection gave attackers unauthorized external access to internal systems, and it responded by disconnecting systems to prevent further damage, knocking out car hire, web booking, reservation management, and the telephone dispatch service.
• The firm has engaged external cybersecurity experts and is investigating whether data was leaked, though no leak has been confirmed and no ransomware group has claimed the attack; it warns customers to avoid suspicious attachments and links claiming to come from the company.

• Researchers at ESET found that Secure Boot, the Microsoft-invented standard protecting Windows and Linux devices from firmware infections, has been trivial to bypass for 13 of its 14 years because of old signed boot components.
• The issue stems from 11 firmware images called shims, at least one dating to 2013, that were known to be defective yet Microsoft, which oversees shim signing, never revoked them, letting even novice hackers reuse them to bypass the protection built into the UEFI.
• Affecting both Windows and Linux users since a shim runs on either OS, an attacker can subvert the chain of signed firmware to install malicious firmware that loads early in boot and persists after an OS reinstall or hard drive replacement.

• SonicWall is warning that hackers are exploiting two flaws in its SMA1000 VPN appliances as zero-days, and has released hotfixes that customers are urged to install immediately.
• The main flaw is a maximum severity server-side request forgery bug in the Appliance Work Place interface that lets a remote, unauthenticated attacker force the appliance to make requests to unintended locations.
• SonicWall confirmed active exploitation in multiple incidents, says there are no workarounds other than the hotfixes, and shared log-based indicators of compromise like unexpected requests to /__api__/login and /wsproxy.

💡 Strategies & Tactics

Other news & articles you might like

• China-Linked Hackers Weaponize Claude Code and DeepSeek in Government Intrusion Campaign LINK

• LabubaRAT Rust Malware Masquerades as NVIDIA Software to Backdoor Windows Systems LINK

• New Qilin Ransomware Attack Uses DCSync Technique to Abuse AD Replication Protocol LINK

• Iran abused mobile networks’ vulnerabilities to locate US military in the Middle East, report says LINK

• Critical Vulnerabilities Patched With Fresh Chrome 150, Firefox 152 Updates LINK

• Vulnerabilities Patched by Fortinet, Ivanti, ServiceNow LINK

• 7 Severe Vulnerabilities Patched in VMware Avi Load Balancer LINK

🛠️ Trending tools

📚 Trending research papers