These news items are automatically aggregated from industry sources and are not individually reviewed. Any inaccuracies are unintentional —
let us know and we'll correct or remove it.
AWS has made Security Hub’s Microsoft Azure monitoring generally available, letting it discover Azure virtual machines, container images, function apps, and identities, then evaluate them for misconfigurations, internet exposure, and vulnerabilities alongside AWS findings in a single console. For European organisations running workloads across both clouds, a genuine reason to standardise on one security operations view instead of stitching together two vendor consoles has just appeared.
CVE-2026-43499, nicknamed GhostLock, is a use-after-free bug in the Linux kernel’s futex and real-time mutex code that has shipped by default in almost every mainstream distribution since 2011. A newly published exploit gives any local user full root access with roughly 97 percent reliability, and the same flaw lets a compromised container break out to the host. Every organisation running Linux servers or containers needs to check patch status now, not on the next maintenance window.
The European Commission has preliminarily found that Instagram and Facebook breach the Digital Services Act through addictive design features including infinite scroll, autoplay, push notifications, and personalised recommender systems. Meta faces a fine of up to 6 percent of its global turnover, and any platform built on similar engagement mechanics should treat this as a signal to review its own design choices before a regulator does it for them.
SonicWall has confirmed active, chained exploitation of two zero-day vulnerabilities in its SMA 1000 series remote access appliances since 22 June, a maximum-severity unauthenticated SSRF combined with a post-authentication command injection flaw. US federal agencies face a binding 17 July deadline to patch or disconnect affected devices, and any organisation using SMA 1000 for remote access should treat this as an active incident, not a routine patch.
Scality and OVHcloud have expanded their partnership into a joint sovereign storage platform combining GPU-direct object storage with OVHcloud’s on-premises and bare metal infrastructure. Aimed at healthcare, financial services, defense, and public sector organisations, it addresses GDPR, DORA, and NIS2 compliance by keeping AI training data and MLOps pipelines entirely within EU-controlled environments.
Germany’s Data Protection Conference has adopted a ten-point position paper pushing to shift privacy-by-design obligations onto the manufacturers and providers of standard IT products, following the model already set by the Cyber Resilience Act and AI Act. If it gains traction at EU level, the compliance burden currently carried entirely by the businesses deploying software could start shifting further upstream, to the vendors who build it.
Microsoft’s July 2026 Patch Tuesday fixes 622 vulnerabilities, more than triple June’s previous record, including 57 rated critical and two zero-days already being exploited in the wild: an AD FS privilege escalation and an unauthenticated SharePoint spoofing flaw. For any organisation running on-premises identity or collaboration infrastructure, this is not a patch cycle to schedule around.
CVE-2026-45659, a deserialization flaw in on-premises SharePoint Server patched in May with a CVSS score of 8.8, was tagged by Microsoft as unlikely to be exploited. CISA added it to its Known Exploited Vulnerabilities catalogue on July 1 after Storm-2603, the same actor behind 2025’s ToolShell campaign, was found deploying Warlock ransomware through it. The bar to trigger it is a low-privilege Site Member account, not an administrator.
July 14, 2026 is the final enforcement date in Microsoft’s multi-phase retirement of RC4 fallback in Kerberos authentication. The registry key that let administrators delay the change has been removed entirely, and domain controllers now expect explicit AES encryption types on every account. Organisations that never audited their legacy service accounts, network appliances, and older Unix integrations for RC4 dependency are about to find out about it through failed logons.
Black Kite’s first dedicated European Cyber Risk Report found ransomware incidents rose 55.1 percent year-over-year in the first four months of 2026, averaging 171 incidents a month. Germany, the UK, France, Italy, and Spain account for around 70 percent of activity, manufacturing is the most targeted sector, and supply chain compromise is becoming a primary route in, exactly the risk category NIS2 and DORA now hold organisations accountable for.
This site uses cookies. By continuing to use this website, you agree to their use.
We’ll help you resolve your infrastructure challenges
Our team of experts is ready to help you with your infrastructure challenges. We’ll give you honest and personal treatment. Get in touch to learn more.
