grc-scanSecurity & governance
← Back to homethe latest digest →
News digest4 July 2026Archived edition

Cybersecurity News

This edition was published on 4 July 2026 and is kept here unchanged as a record. The threats and cases it describes may have moved on — read the latest digest for the current picture.

The takeaway

Nearly every story here started with something a business trusts completely and rarely questions — the antivirus built into Windows, the firewall guarding the network, the tool an IT provider uses to remote in, the device routing traffic to a website, even the operating system underneath a Linux server or Android phone — becoming the way in. None of it required an employee to click something obviously wrong; it required a patch that existed but hadn't been applied, a device still running an outdated setting nobody rechecked after an upgrade, or an email built to manufacture panic rather than exploit a technical flaw. Four habits close most of that gap. First, treat "a fix exists" and "the fix is actually installed everywhere" as two different facts — ask your IT provider to confirm patch status by name and by date, not just assume routine maintenance covers it. Second, never trust urgency in an email, whether it claims to be a legal notice, a law-enforcement investigation, or anything else demanding you open a file right now — verify independently through a channel you already trust before acting. Third, make password uniqueness and multi-factor authentication non-negotiable for anything remote-facing — firewalls, VPNs, admin panels, email — since stolen or cracked credentials are the common thread behind several of today's stories. Fourth, actually test your backups, not just schedule them; several of today's attacks specifically target recovery options before the ransom note ever appears, so a backup you've never restored from is not a safety net you can count on. None of this requires deep technical expertise — it requires treating "someone else must already be checking this" as the riskiest assumption a small business can make.

Cybersecurity News — 2026-07-04

Generated: 2026-07-04 | Sources: The Hacker News, BleepingComputer, SecurityWeek, Bitdefender, Security Affairs

1. A Popular Remote-Support Tool Just Handed Attackers a Skeleton Key

SimpleHelp — remote-support software many outsourced IT companies install on customers' computers so a technician can log in and fix problems from afar — had a maximum-severity flaw (a perfect 10 out of 10 on the industry's severity scale) in its login process. By forging a piece of identity data called a token, an attacker with no password at all could trick the software into granting a fully logged-in "technician" session — the same level of access your own IT company's staff would have. Attackers used that access to install two further tools: one that quietly keeps a channel open for later commands, and a second, called Djinn Stealer, that hunts the machine for saved passwords and login tokens for cloud accounts, code repositories, AI coding assistants, and cryptocurrency wallets.

Why it matters for your business: if your business or your IT provider uses SimpleHelp — or any remote-support/remote-monitoring tool — ask them today, by name, whether it's patched to the latest version. This flaw gives an outsider the exact same remote-control access your trusted IT company has, and once inside, it goes looking for every password saved on the machine, not just ones related to IT support.

2. The Antivirus Built Into Windows Had a Bug Ransomware Gangs Are Now Using

Microsoft Defender — the security software built into every modern Windows PC — had a flaw, nicknamed BlueHammer, that lets someone already logged into a machine with an ordinary account escalate themselves to the highest level of control on that computer (known as "SYSTEM," above even a normal administrator). From there, they can read a hidden file that stores every other password on the machine and use it to move across the rest of the network. Microsoft quietly patched it back in April, but the US government's cyber agency (CISA) now confirms ransomware gangs are actively using it in real attacks, months after the fix shipped.

Why it matters for your business: Windows Update installs this fix automatically, but only if updates are actually being applied rather than postponed. Ask whoever manages your office computers to confirm every Windows machine has installed updates from April 2026 onward — ransomware gangs are now specifically hunting for PCs that skipped it.

3. Attackers Cracked the Passwords on Tens of Thousands of Business Firewalls

A campaign researchers are calling FortiBleed has extracted and cracked administrator passwords on somewhere between 30,000 and 75,000 Fortinet FortiGate firewalls worldwide — the boxes many small and mid-sized businesses rely on to control what traffic gets in and out of their network and to run staff VPN connections. The root cause is a housekeeping gap: Fortinet moved to a stronger method for scrambling stored passwords, but any password set before that upgrade stays protected by the older, weaker method until an administrator logs in again afterwards — so many devices are still guarded by the outdated scheme without anyone realizing it. Attackers combined old leaked passwords, brute-force guessing, and cracking of intercepted login data to build a database of working credentials sorted by company and country.

Why it matters for your business: if your business or your IT provider uses a Fortinet firewall or VPN, reset the administrator password and any VPN passwords now rather than waiting for a routine schedule, and turn on multi-factor authentication for anyone who logs in remotely — a freshly reset password is useless to an attacker even if they already cracked the old one.

4. A Device That Sits in Front of Business Websites Can Be Hijacked With a Single Request

Progress Kemp LoadMaster — a load balancer, hardware or software that many web hosts and IT providers use to spread traffic across a website's servers and keep it running under load — has a severe flaw that lets an attacker with no login at all send it one crafted request and have it run commands as the device's own administrator. Security researchers published full technical details of how the flaw works on June 29, and real attack attempts began within days.

Why it matters for your business: you likely don't manage this appliance yourself, but if your website or customer portal sits behind a load balancer, ask your host or IT provider by name whether they run Kemp LoadMaster and whether it's on the patched version released in response — publishing "how it works" openly accelerated real-world attacks here, so the usual grace period before patching doesn't apply.

5. A New Piece of Malware Bundles an Entire Break-In Toolkit Into One Email

Researchers uncovered a new all-in-one malware toolkit, nicknamed Avalon, spread through emails disguised as a legal document that pressure the recipient into opening a password-protected file — a common trick to stop email security scanners from looking inside. Once opened, Avalon quietly works through several stages: it steals saved passwords, spreads itself to other computers on the network, gives the attacker ongoing remote access, and disables the victim's backup and recovery options — all before finally encrypting files and demanding a ransom through a ransomware component called CrownX. Researchers believe parts of the toolkit were built with AI coding assistance, which is why it works despite showing little of the careful tradecraft skilled human hacking groups usually display.

Why it matters for your business: the ransom note is the last step, not the first — by the time you notice anything wrong, backups may already be sabotaged and passwords already stolen. Treat any email urging you to open a password-protected archive as a red flag regardless of how official it looks, and actually test that your backups restore correctly and are kept somewhere the rest of your network can't reach and disable.

6. Criminals Are Impersonating Interpol to Scare Small Businesses Into Opening Ransomware

A phishing campaign identified this month is emailing small businesses fake "investigation" notices claiming to be from Interpol or other law-enforcement bodies, accusing the company of suspicious activity and pressuring staff to open an attached file to "review the evidence." The file is a password-protected archive, nested inside several more layers, that ultimately installs a custom-built ransomware program. It has hit businesses in legal services, pharmaceuticals, food, agriculture, media, and technology across the US, Europe, Asia, and the Middle East — sectors chosen because a "you're under investigation" email plausibly demands urgent, private attention.

Why it matters for your business: no genuine law-enforcement investigation is ever launched by an unsolicited email asking you to open a password-protected file. Treat any such message as a scam regardless of the alarm it's designed to cause, verify independently — a phone call to a number you look up yourself, never one in the email — before opening anything, and make sure staff know this specific trick, since it's built entirely around panic rather than a technical exploit.

7. A Years-Old Bug Underneath Linux and Android Just Got a Reliable Exploit

Researchers disclosed a flaw nicknamed "Bad Epoll" in the Linux kernel — the core software underneath most web servers, many office NAS and backup boxes, and every Android phone — that lets a completely ordinary, unprivileged user take full administrator ("root") control of the machine. It's a timing bug: two parts of the system try to clean up the same piece of memory at almost the same instant, and a narrow window lets an attacker sneak in and hijack it. The flaw has existed since 2023, but a working, reliable exploit was only just built and published, which typically triggers a wave of copycat attacks. A fix is already available.

Why it matters for your business: if your business runs any Linux-based servers, network storage, or backup appliances — ask your IT provider whether any of your infrastructure runs Linux, since it's often invisible, baked into other products — make sure those devices are on their latest software update, and set company Android phones and tablets to install security updates automatically.

8. A Breach at a Phone and Internet Provider Exposed 14 Million Customer Logins

Japanese telecoms provider KDDI disclosed that a breach of systems shared across six internet service providers may have exposed roughly 14.2 million customers' email addresses and passwords, including accounts belonging to former and inactive customers. The company says the passwords were stored in hashed or encrypted form, but hasn't ruled out that some were still crackable. The exposure itself is the danger regardless: attackers now have a large list of real email-and-password pairs to try against other websites, banking on the fact that many people reuse the same password across services.

Why it matters for your business: if anyone at your business has ever used a work email to sign up for a personal internet or phone account, this is a reminder that a breach anywhere becomes a risk everywhere passwords are reused. Use a password manager so every account has a unique password, and turn on multi-factor authentication for your email and banking, so a leaked password from an unrelated service can't be used to reach the accounts that actually matter to your business.

Sources

Reading about a breach — could it happen to you?

Most of these stories start with something an attacker can see from the outside: an exposed service, a spoofable domain, weak encryption. You can check your own domain for the same things in about a minute — free, no login, nothing intrusive.

Run a free posture scan →Check your Cyber Essentials readiness

Summaries are compiled from public threat-intelligence feeds and security news sources. This digest is for awareness purposes only and does not constitute professional security advice.