Threat Intelligence Center

Microsoft released 92 security updates on July 14, 2026 Patch Tuesday, including multiple critical vulnerabilities spanning Windows, Office, and AI-integrated components. The CVE batch (CVE-2026-13862 through CVE-2026-58633) contains flaws that could allow remote code execution and privilege escalation across enterprise environments.

Checkmarx security researchers have identified a sophisticated supply chain attack targeting frontend developers through the npm ecosystem. Seven malicious Vite packages, part of the ChainVeil campaign, leverage blockchain-based command and control infrastructure to deploy remote access trojans.

DShield released a significant SIEM update on July 14th that enhances the ELK stack's ability to ingest, parse, and visualize Suricata intrusion detection alerts through Filebeat. The update improves alert correlation within Kibana dashboards and refines data pipeline efficiency for security teams managing network detection and response workflows.

Researchers have confirmed that the GoldenEyeDog subgroup exploited the DigiCert breach to acquire legitimate code-signing certificates, a critical capability for conducting supply chain attacks. This development connects multiple threat actors including APT-Q-27, Black Basta, and Rhysida to a coordinated campaign targeting finance, gambling, gaming, and Web3 sectors.

Security teams managing SaaS applications for banking, government, and healthcare organizations face a fundamental visibility problem: they cannot inspect the internal security controls, authentication mechanisms, or data access patterns of third-party cloud applications. This blind spot means critical security decisions rest on vendor claims rather than verified controls.

Security researchers have documented Spirals ransomware targeting IT services organizations with a rapid encryption timeline of under 24 hours from initial compromise to full network lockdown. The attack leverages Chisel, a legitimate tunneling tool, to establish persistent access and move laterally through victim environments before deploying encryption payloads.