These news items are automatically aggregated from industry sources and are not individually reviewed. Any inaccuracies are unintentional — let us know and we'll correct or remove it.
Security researchers have documented Avalon, a modular malware framework delivered through legal-document phishing lures that specifically hunts down and disables Veeam, Acronis, vCenter, Hyper-V and other backup and recovery infrastructure before detonating its CrownX ransomware payload. The framework includes tailored evasion for nine major EDR products and shows signs of AI-assisted development.
As of July 1, 2026, Microsoft no longer allows new purchases or renewals of Azure Reserved VM Instances across a long list of legacy VM series, including Dv2, Ev3 and the entire Av2, Bv1, F and G families. Existing reservations run out their term as normal, but once one expires it cannot be renewed, and the workload quietly reverts to pay-as-you-go pricing that can run up to 72 percent higher.
DigitalOcean has moved OpenID Connect single sign-on for its Managed Kubernetes service (DOKS) to general availability, letting clusters authenticate through Okta, Keycloak, Auth0, authentik or JumpCloud instead of long-lived tokens. Each cluster gets its own independent policy, and deactivating a user in the identity provider now revokes cluster access immediately.
GitHub has put workflow execution protections into public preview across Enterprise, organisation, and repository settings, letting administrators define exactly which actors and which events are allowed to trigger a GitHub Actions run. The feature arrives after a string of 2026 incidents, including the Cordyceps pipeline hijack and a critical GitHub Enterprise Server RCE, that all traced back to the same root problem: almost anything could kick off a workflow with write access to your secrets.
The Bashe ransomware group has publicly claimed a breach of Flazio, an Italian SaaS website-building platform, threatening to leak stolen data unless it is paid. Because Flazio hosts and manages websites on behalf of thousands of small and medium businesses, a confirmed breach does not stay contained to one vendor. It becomes a downstream incident for every customer whose site, data, and reputation sat on that platform.
Researchers at Sekoia and YesWeHack have identified at least seven GitHub repositories distributing a Python-based remote access trojan called ChocoPoC, hidden not in the exploit code itself but in a malicious dependency pulled in from PyPI when the proof-of-concept runs. The repositories impersonate working exploits for recent flaws in FortiWeb, PAN-OS, Check Point VPN, Ivanti Sentry, and other widely deployed products, meaning the researchers and DevOps engineers most likely to run them are security teams racing to test their own exposure.
Researcher Jaeyoung Chung disclosed CVE-2026-46242, a race-condition flaw in the Linux kernel’s epoll subsystem that lets an unprivileged user become root on desktops, servers, and Android devices. The underlying bug was fixed in the mainline kernel in April, but the fix has not been backported across most long-term-support distributions, leaving self-managed Linux fleets across Europe exposed months after a patch already existed.
The Centre for Cybersecurity Belgium has warned organisations to patch CVE-2026-12569, an unauthenticated remote code execution flaw in PTC’s Windchill and FlexPLM product lifecycle management software, after CISA confirmed active exploitation and added it to its Known Exploited Vulnerabilities catalog. Attackers are dropping JSP webshells on unpatched servers, and Windchill’s deep footprint across European automotive, aerospace, and defence supply chains makes this a manufacturing-sector emergency, not a routine patch cycle.
Adobe fixed 11 vulnerabilities across ColdFusion 2025, ColdFusion 2023, and Campaign Classic 7.4.3, seven of them rated a full CVSS 10.0, covering improper authorization, path traversal, and unsafe file upload flaws that chain into arbitrary code execution. Adobe assigned its highest Priority 1 rating to both updates, its own signal that exploitation is expected soon even though no public exploit exists yet.
CISA added CVE-2026-45659, an authenticated remote code execution flaw in on-premises SharePoint Server, to its Known Exploited Vulnerabilities catalog on 1 July, setting a remediation deadline of 4 July for US federal agencies. Microsoft shipped the fix in May, but SharePoint Server Subscription Edition, 2019, and 2016 remain widely deployed across European government bodies, law firms, and manufacturers that have not migrated to SharePoint Online.
Our team of experts is ready to help you with your infrastructure challenges. We’ll give you honest and personal treatment. Get in touch to learn more.
Get in touch!