Security researchers have identified HollowGraph, a malware attributed to Cavern Manticore and associated threat actors including Lyceum, MuddyWater, and OilRig. This malware employs an unusual evasion technique: it stores command-and-control communications and exfiltrated data within Microsoft 365 calendar events timestamped far into the future (2050).

Microsoft released 92 security updates on July 14, 2026 Patch Tuesday, including multiple critical vulnerabilities spanning Windows, Office, and AI-integrated components. The CVE batch (CVE-2026-13862 through CVE-2026-58633) contains flaws that could allow remote code execution and privilege escalation across enterprise environments.

Checkmarx security researchers have identified a sophisticated supply chain attack targeting frontend developers through the npm ecosystem. Seven malicious Vite packages, part of the ChainVeil campaign, leverage blockchain-based command and control infrastructure to deploy remote access trojans.

DShield released a significant SIEM update on July 14th that enhances the ELK stack's ability to ingest, parse, and visualize Suricata intrusion detection alerts through Filebeat. The update improves alert correlation within Kibana dashboards and refines data pipeline efficiency for security teams managing network detection and response workflows.

Researchers have confirmed that the GoldenEyeDog subgroup exploited the DigiCert breach to acquire legitimate code-signing certificates, a critical capability for conducting supply chain attacks. This development connects multiple threat actors including APT-Q-27, Black Basta, and Rhysida to a coordinated campaign targeting finance, gambling, gaming, and Web3 sectors.

Security researchers have documented Spirals ransomware targeting IT services organizations with a rapid encryption timeline of under 24 hours from initial compromise to full network lockdown. The attack leverages Chisel, a legitimate tunneling tool, to establish persistent access and move laterally through victim environments before deploying encryption payloads.