UAC-0145 ClickFix Campaign Uses Fake CAPTCHAs to Drop Malware
CERT-UA says UAC-0145, a Sandworm-linked cluster, is using fake CAPTCHA prompts on compromised sites to make targets run malware on Windows and Android devices.
News desk
Cybersecurity News & Analysis
Security incidents, exploited vulnerabilities, breach reports, and urgent patch notes, arranged for fast scanning like a daily cyber newspaper.
July 19, 2026Latest reports
SharePoint CVE-2026-58644 Added to CISA KEV After Exploitation
CISA added Microsoft SharePoint CVE-2026-58644 to KEV after exploitation was detected. Patch on-premises SharePoint Server 2016, 2019, and Subscription Edition quickly, then check for...
Zoom CVE-2026-53412: Critical Windows Account Takeover Flaw Fixed
Zoom fixed CVE-2026-53412, a critical Windows account-takeover flaw. Check Zoom Workplace and VDI Client versions and update from official channels.
AsyncAPI npm Packages Hit by Miasma Botnet Malware
Five malicious AsyncAPI npm releases briefly shipped a require-time Miasma loader through trusted GitHub Actions publishing. Developers should check lockfiles and rotate exposed CI...
Microsoft July Patch Tuesday Fixes AD FS and SharePoint Zero-Days
Microsoft fixed exploited AD FS and SharePoint Server zero-days in July Patch Tuesday. Prioritize CVE-2026-56164 and CVE-2026-56155 before routine CVEs.
SonicWall SMA1000 CVEs Hit CISA KEV After Zero-Day Attacks
SonicWall patched actively exploited SMA1000 SSRF and code-injection flaws. Admins should move to fixed hotfix builds and review IOC logs, not just patch.
Microsoft: ShinyHunters Abuse Salesforce OAuth for Data Theft
Microsoft says ShinyHunters-linked actors abused Salesforce OAuth apps, vendor integrations, and guest access to steal CRM data without exploiting a Salesforce platform flaw.
Cisco IOS CVE-2008-4128 Hits CISA KEV After Active Exploitation
CISA added Cisco IOS CVE-2008-4128 to KEV after active exploitation. Check Cisco 871 IOS 12.4 routers, restrict management access, and replace unsupported devices.
Evilginx Microsoft 365 Phishing Exposes Device Code Risk
Lexfo exposed three Evilginx Microsoft 365 phishing operations, including device code flow abuse that can leave valid tokens even when users pass MFA.
