Security Signal Weekly: July 11-17, 2026

Overview

This one is landing Sunday instead of Friday. Friday got away from me, but the security news did not slow down while I caught up. The clearest pattern was pressure on the systems that concentrate trust: identity servers, SharePoint, security appliances, file-sharing controllers, developer pipelines, browsers, and the libraries sitting underneath internet services.

Reality check: A late roundup is still useful if it sends you back to the right consoles. Start with the exploited systems you actually run, verify the fixes landed, and then work outward into hardening and hunting.

Top 10 Security Signals

1. Microsoft’s largest Patch Tuesday put two exploited zero-days at the front of the queue

What happened: Microsoft’s July release was enormous. BleepingComputer’s Microsoft-only count came to 570 vulnerabilities, including 59 critical issues and three zero-days. Two were already being exploited, including CVE-2026-56155 in Active Directory Federation Services, while Microsoft’s Security Update Guide remains the authoritative place to map the release to products and KBs in a specific environment.

Why it matters: The headline count is less important than exposure. AD FS sits directly in the identity path, and a smaller number of reachable remote-code-execution or privilege-escalation flaws can matter far more than hundreds of scanner findings on components an organization does not use.

Action:

Prioritize AD FS, internet-facing Windows services, domain infrastructure, and systems tied to privileged administration before working through the rest of the July backlog.

Deploy the July updates through normal rings, then verify installed KBs, reboot state, and application health instead of treating deployment approval as completion.

Use the Security Update Guide to filter by the products actually present and document any systems that need compensating controls or delayed maintenance.

2. CISA warned that attackers are chaining SharePoint flaws for code execution and persistence

What happened: CISA’s July 14 SharePoint guidance says attackers are exploiting SharePoint vulnerabilities to bypass authentication, execute code, steal IIS machine keys, and maintain access. BleepingComputer identified the actively exploited set as CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 across supported on-premises SharePoint Server versions.

Why it matters: This is not a patch-only incident. Stolen machine keys and web-server persistence can survive a rushed update, and self-hosted SharePoint often holds sensitive documents while sitting close to Active Directory, service accounts, and collaboration workflows.

Action:

Apply the latest SharePoint security updates and confirm the farm reports the fixed build on every server.

Hunt for web shells, unexpected files, suspicious child processes, and machine-key theft before rotating IIS machine keys and credentials.

Remove unnecessary internet exposure and follow Microsoft’s SharePoint hardening guidance for Central Administration, farm traffic, and reverse-proxy controls.

3. CISA put two FortiSandbox command-injection flaws on the actively exploited list

What happened: CISA added CVE-2026-39808 and CVE-2026-25089 to its exploited-vulnerability priorities after evidence of attacks against FortiSandbox. Fortinet’s advisories describe CVE-2026-39808 and CVE-2026-25089 as unauthenticated command-injection flaws with a 9.1 CVSS score, while BleepingComputer reported an unusually short federal remediation deadline.

Why it matters: FortiSandbox is supposed to decide whether content is malicious. If attackers control the security appliance doing that analysis, they may gain a privileged foothold and undermine the trust other controls place in its verdicts.

Action:

Upgrade affected FortiSandbox 4.4 systems to 4.4.9 or later and affected 5.0, Cloud, or PaaS deployments to the fixed releases Fortinet lists.

Inventory management and API exposure, restrict access, and review HTTP activity for attempts against the affected endpoints.

Treat unpatched or suspicious appliances as potentially compromised and preserve logs before rebuilding or returning them to service.

4. An Oracle E-Business Suite takeover flaw moved from patched to actively exploited

What happened: CISA confirmed active exploitation of CVE-2026-46817, an unauthenticated Oracle Payments flaw in E-Business Suite. Oracle’s May Critical Security Patch Update rates it 9.8 and lists EBS 12.2.3 through 12.2.15 as affected, while BleepingComputer reported that more than 1,000 internet-exposed EBS instances were visible to Shadowserver during the response window.

Why it matters: Oracle EBS is not just another web application. It can sit in the middle of payments, suppliers, payroll, and financial operations, so a remotely exploitable takeover bug has an obvious path from technical compromise to fraud and business disruption.

Action:

Apply the May 2026 Oracle EBS security patches and verify the prerequisite and component patches required for the deployed release.

Reduce direct internet exposure and restrict access to Oracle Payments endpoints through trusted networks or application-layer controls.

Review web, application, and operating-system logs for unexpected requests, spawned processes, new files, and outbound connections before declaring the system clean.

5. Allied agencies warned that Russian intelligence keeps winning through neglected routers

What happened: The UK’s NCSC and international partners published new router-hygiene guidance after linking Russia’s FSB Centre 16 to opportunistic exploitation of poorly configured routers and network devices. The advisory connects the same activity to targeting of critical infrastructure and the December 2025 attack on Poland’s energy grid.

Why it matters: Edge devices remain attractive because they are exposed, powerful, and frequently managed outside the normal endpoint program. A forgotten router with stale firmware or an open management plane can become a durable collection point and a launchpad into the rest of the network.

Action:

Inventory externally reachable routers and network appliances, including equipment managed by carriers, MSPs, and branch-office vendors.

Patch supported devices, remove end-of-life hardware, disable unused services such as Smart Install, and restrict administration to dedicated management paths.

Centralize configuration backups and logs so teams can detect unexpected accounts, tunnels, firmware changes, and access-control modifications.

6. Progress patched the ShareFile zero-day that forced Storage Zone Controllers offline

What happened: The shutdown from last week’s edition now has a root cause and a fix. Progress confirmed a high-severity path-traversal zero-day affecting ShareFile Storage Zone Controller 5.x and 6.x, and BleepingComputer reported patched versions 5.12.5 and 6.0.2. The ShareFile status page says access was restored after recovery instructions went to account owners.

Why it matters: Storage Zone Controllers bridge a cloud sharing service to customer-managed Windows storage. That makes version verification, administrative access review, and file-integrity checks just as important as bringing the service back online quickly.

Action:

Upgrade every Storage Zone Controller to 5.12.5 or 6.0.2 before restoring normal access.

Confirm administrative accounts and recent logins, then review file activity and controller logs for unexpected reads, writes, or directory traversal behavior.

Ask providers and business partners that operate controllers on your behalf for the exact version and patch date rather than accepting a generic patched response.

7. WordPress forced security updates after a core bug chain reached remote code execution

What happened: WordPress released 7.0.2 and backported fixes for CVE-2026-60137 and CVE-2026-63030, a SQL injection and REST API batch-route confusion chain that can lead to remote code execution. The WordPress team…