Cybersecurity Roundup July 2026

Microsoft's biggest ever Patch Tuesday, and two zero-days that didn't wait for it

July's release fixed roughly 570 vulnerabilities, the largest single Patch Tuesday on record, including two flaws already under active exploitation before patches existed: an Active Directory Federation Services elevation-of-privilege bug (CVE-2026-56155) and a SharePoint Server flaw (CVE-2026-56164).

A third SharePoint vulnerability (CVE-2026-50522) was exploited within hours of a public proof-of-concept appearing later in the month, with attackers stealing machine keys to keep their access even after the hole was patched.

If you run on-premises SharePoint or AD FS, patching alone won't fully close this one, rotate your machine keys regardless of patch status.

Russian state actors are working through the world's routers

The NCSC and 18 partner agencies have attributed a global campaign against energy, water, transport and telecoms infrastructure to Russia's FSB Centre 16. The method: scanning for routers and network devices still running default credentials, outdated firmware, or unrestricted management access. Routers and VPN gateways are frequently the least-monitored devices on a network, this advisory is a prompt to check whether yours are an exception.

SharePoint attackers are using machine keys to keep access after patching

The NCSC has urged UK organisations to act after active exploitation of vulnerabilities affecting on-premises Microsoft SharePoint Server products. CISA also warned that attackers are exploiting multiple SharePoint flaws to gain unauthorised access, establish remote code execution, steal IIS machine keys, and deploy malware.

For organisations still running SharePoint on-premises, this is not just a patching issue. If attackers have stolen machine keys, they may be able to maintain access even after the original vulnerability is closed. Security teams should apply updates, confirm AMSI is enabled, deploy endpoint protection, rotate SharePoint ASP.NET machine keys, and hunt for signs of compromise.

Threat intelligence moves into Defender and Sentinel at no extra cost

Microsoft Defender Threat Intelligence (MDTI) reaches end of life on 1 August 2026, but nothing is being taken away.

The standalone licence is being retired because its threat intelligence capabilities, used to understand emerging threats, investigate incidents, and inform response, are now built directly into Microsoft Defender and Microsoft Sentinel. Customers already using either product get access at no additional cost and with no migration or deployment work required.

It's part of a wider pattern from Microsoft of consolidating security tooling into fewer portals and licences rather than maintaining separate standalone products, and a welcome one for any team that previously had to budget for MDTI as a separate line item.

This month's priority actions