The Watch
Breaches, disclosure, and the vendors selling the fix — what actually changed for defenders today.
Check Point's telemetry puts the education sector at more than double the cross-industry average, with July the worst month. That makes back-to-school a rota problem, not an awareness campaign.
Reality
KB5121003 shipped Secure Boot changes alongside fixes for 400 vulnerabilities. Microsoft now says it is checking whether the same update stops software from running on 24H2 and 25H2.
Reality
Cynthia Kaiser says infrastructure operations have pushed some crews off US targets entirely. The numbers are the bureau's own, but the cadence is something defenders can plan around.
Reality
US Cyber Command disrupted Iranian air defenses during June's Operation Midnight Hammer by hitting a mapped network node, not the hardened core, according to Recorded Future News.
Reality
The Linux Foundation's coalition for AI-generated vulnerability reports starts taking automated submissions next month. Its membership terms set the ceiling on what it can absorb.
Reality
A bipartisan bill would force labs to shut down, throttle or suspend their models. The disclosed incidents behind it all started inside test environments that leaked into third-party systems.
Reality
A registrar who was censured this month for threatening staff says he will make a convicted election-systems thief his deputy. The controls that would stop it are personnel controls.
Reality
Google says the first version of its Advanced Flow is rolling out for installs from unverified developers. The reported announcement carries no criteria, no dates and no scope.
Reality
Intel 471 says sanctions thinned the top tier of criminal hosting and upstarts filled the gap. The practical effect is that each takedown and each ASN block now covers less of the market.
Reality
Brinqa says PlexTrac will keep operating standalone. That is the sentence PlexTrac customers should get into their next renewal in writing.
Reality
A six-day intrusion in one AWS environment exposed SSNs, driver's license numbers and, for a subset, full payment card data. The federal tally rose tenfold this week.
Perspective Coverage
3 publishersReality
Body camera footage of a Florida officer who stalked a woman he met on a TV set shows no perimeter was breached. An authorized user made authorized-looking queries, and nothing stopped him.
Reality
An archive of payment receipts going back to 2008 at Latvia's CSDD exposed 1.2 million people and 200,000 businesses, and cost the agency's supervisory board its jobs.
Reality
Malwarebytes found a 41-site network whose download buttons hold genuine Steam and VideoLAN links, then use JavaScript to send the click elsewhere. Awareness training needs a rewrite.
Reality
Ray never authenticated its job endpoints, and the User-Agent check meant to keep browsers out is spoofable in Firefox and Safari. DNS rebinding does the rest.
Reality
Okta Threat Intelligence says as-a-service phishing kits now let a caller change what the target sees in real time, synced to genuine MFA prompts. Push and OTP were not built to survive that.
Reality
Huntress counted 81 million login attempts against Azure CLI in two weeks of June and 78 compromises. Most of the victims had MFA. It just did not apply to the flow the attacker used.
Reality
CVE-2026-20349 lets an unauthenticated attacker crash any ASA or FTD running Remote Access SSL VPN. There is no workaround, exploitation is confirmed, and attribution is a blank page.
Reality
Sophos X-Ops confirmed 38 AI-related MDR cases across twelve months. Impersonation of AI software accounted for 30 of them, and conventional payload controls were what stopped them.
Reality
Microsoft has set an end-of-updates date for 24H2 Home and Pro plus Windows 10 Enterprise LTSB 2016. Automatic upgrades to 25H2 exist, but users can defer the restart.
Reality
Cifas logged a record 220,000-plus UK fraud cases in the first half of 2026. Identity fraud and account takeover dominate the mix, and telco-issued phone numbers are doing credential work.
Reality
Computer Weekly says a Czech firm rehacked France's EncroChat implant and found GitHub exploit code for Bad Binder, an Android bug unpatched in 2.5 billion phones. Lawyers expect a stalled UK case to restart.
Reality
Ransomnews says it found more than 50,000 exposed Stripe merchant secret keys and tested a sample. One live key to a customer list and a test charge took 17 hours.
Reality
The regulator found inconsistent data protection compliance across the forces it audited, and says significant improvements are still needed, including for street stops using operator initiated matching.
Reality
Ten months of production use, 12 assigned CVEs, and a two-day sweep of stolen repositories. Discovery has stopped being the bottleneck; human validation has become one.
Reality
The NBU says NERO R-ONE cameras bought under a 30-million-euro EU-funded project are rebadged Russian hardware carrying an SMS-triggered backdoor. The contract was the vulnerability.
Reality
NIST stopped enriching every CVE, HackerOne paused the Internet Bug Bounty, Pwn2Own turned entrants away, and Cisco began bundling flaws under one ID. Attackers barely changed method.
Reality
CISA's advisory for its own network traffic analysis suite lists denial of service and arbitrary code execution: unbounded archive extraction, traversal in two layers, and uploads that run PHP as www-data.
Reality
ARMA says intruders reached its servers just before the bid deadline for managing seized assets tied to Mikhail Fridman. The milestone set the clock, not the infrastructure.
Reality
Pageloot's leak was caught by a search box, not a control. "Anyone with the link" behaves like public, and most secrets programs never look inside the documents where credentials actually get parked.
Reality