Cybersecurity News — 2026-07-17

Generated: 2026-07-17 | Sources: The Hacker News, BleepingComputer, SecurityWeek, Dark Reading, CISA, NSA, NCSC, DOJ

1. Microsoft's Biggest-Ever Patch Batch Arrived the Same Week Attackers Were Already Breaking Into SharePoint

Microsoft's July update fixed a record 622 security flaws in one go — more than double a typical month — including two that criminals were already using to break into systems before the fix shipped. One of those, in Microsoft SharePoint Server (the software many businesses use to run their own internal document library or intranet, as opposed to the cloud-hosted Microsoft 365 version), let an attacker with no special access at all take control of the server. CISA, the US government's cyber-defence agency, issued an emergency alert ordering federal agencies to hunt for signs of break-ins and reset a specific server security key, on top of just installing the patch — because attackers who got in before the fix shipped can stay in even after it's applied.

Why it matters for your business: if you or your IT provider run your own SharePoint server (not Microsoft 365), patch this week and ask specifically whether anyone has checked for signs of prior compromise — "we installed the update" isn't the same as "we confirmed nobody got in first." For every other piece of business software you rely on, a record-breaking patch month is a good prompt to confirm updates are actually being installed automatically rather than assumed.

2. Coca-Cola's Fairlife Dairy Brand Had to Halt US Production After a Ransomware Attack

Coca-Cola disclosed that its Fairlife dairy subsidiary suffered a ransomware attack that reached production-related systems, forcing a pause in US manufacturing (Canadian production was unaffected). Ransomware is malware that locks up a company's computer systems until a ransom is paid; here, the disruption spread far enough that the physical business of making and bottling milk had to stop, not just the office computers. No group has claimed responsibility, and Coca-Cola hasn't said whether data was stolen or whether it's being extorted, but the company has activated its incident-response plan and called in outside investigators.

Why it matters for your business: this is a reminder that ransomware doesn't just lock up email and spreadsheets — if any part of your production, ordering, or point-of-sale system is run on a computer, it can be taken hostage too, and that's the part that actually stops you trading. Know which of your systems, if frozen tomorrow, would stop you serving customers, and make sure those specific systems are backed up and can be restored without paying anyone.

3. Two Teenagers Went to Prison for Hacking Transport for London — Starting With One Phone Call to the Help Desk

Owen Flowers, 18, and Thalha Jubair, 20, were sentenced to five and a half years each for the 2024 cyberattack on Transport for London, which the UK's National Crime Agency called the biggest cybercrime prosecution in British history. The attack — attributed to the "Scattered Spider" hacker collective — started with social engineering (tricking a person, not a computer) aimed at TfL's IT help desk, and ended up disabling 148 systems, forcing all 27,000 staff into the office to have their passwords reset in person, and costing TfL an estimated £29 million and the data of 10 million travellers.

Why it matters for your business: the break-in didn't start with clever code — it started with someone on the phone convincing a help-desk employee to reset a password or bypass a check. Make sure whoever handles IT support requests for your business (in-house or outsourced) has a firm rule: no password reset or access change for anyone without verifying their identity through a second, pre-agreed method, no exceptions for urgency.

4. A Dutch Telecom Was Breached the Same Way — a Fake IT Caller Talked Their Way Past Customer Service

Dutch police now believe local hackers were behind February's breach of telecom provider Odido, which exposed the personal data — including names, addresses, phone numbers, email addresses, and some bank details — of 6.2 million customers. Investigators say the break-in began with a phone call: someone posing as an Odido IT employee talked a customer-service handler into actions that let them into Odido's systems, after which the extortion group ShinyHunters published a 15-million-record archive.

Why it matters for your business: two of this week's biggest breaches both started with someone on the phone impersonating IT — this is now a routine, proven attack method, not an edge case. Any employee who can reset a password, unlock an account, or view customer data should be trained to hang up and call back on a number you already have on file whenever a caller claims to be "IT" or a supplier asking for access or information.

5. Zoom Fixed a Flaw That Let Anyone Take Over a Windows User's Account With No Password Needed

Zoom patched a critical flaw (rated 9.8 out of 10 for severity) in its Windows desktop app that let an attacker take over a user's account over the network — without needing a password, an existing account of their own, or the victim clicking anything. It affects the Zoom Workplace desktop client and VDI client for Windows below version 7.0.0/7.0.10. There's no evidence yet that criminals have used it, which is exactly the window in which patching matters most.

Why it matters for your business: video-conferencing software sits on almost every work computer and is rarely on anyone's "important to patch" list — that's precisely why flaws like this are valuable to attackers. Update Zoom (and check that auto-update is switched on) this week rather than waiting for the next time someone happens to relaunch it.

6. The US Charged Russian Web Hosts Accused of Renting Server Space to Ransomware Gangs

The US Department of Justice unsealed charges against three Russian nationals accused of running "bulletproof" hosting services — Media Land and ML.Cloud — that knowingly rented servers and internet infrastructure to ransomware crews including LockBit, Play, and BlackSuit, shielding them from law-enforcement takedown requests. Prosecutors linked the hosts to at least $62 million in losses across 44 known victims and offered a $10 million reward for information, though Russia's lack of an extradition treaty with the US makes arrests unlikely soon.

Why it matters for your business: this doesn't change what you need to do day to day, but it's a useful reminder of how professionalised ransomware has become — gangs rent infrastructure the same way a legitimate business rents cloud servers, which is part of why attacks are so frequent and low-cost to run. The response is still the same: patching, MFA, and tested backups are what make your business a poor target regardless of how well-resourced the attacker is.

7. Malicious Code Was Slipped Into Widely-Used Developer Building Blocks — Again

Two separate supply-chain attacks hit the open-source package registry npm this month: attackers compromised the jscrambler package (widely used to protect JavaScript code) using stolen publisher credentials, hiding code that harvested credentials and secrets from developer machines; days later, packages from the @asyncapi project — used by over 2 million downloads a week — were compromised with malicious code that ran the moment the package was loaded, not just on install. Both were caught and pulled, but only after being live for hours to days.

Why it matters for your business: if your website or app was built using modern web development tools, your developer or agency's toolchain almost certainly pulls in hundreds of these small open-source packages automatically, any one of which could be swapped for a malicious version like this. Ask whoever built or maintains your site whether they pin dependency versions and review updates before applying them, rather than always taking the latest version automatically.

8. 19 Countries' Cyber Agencies Warned That Russian State Hackers Are Breaking In Through Ordinary Routers

The NSA, the UK's National Cyber Security Centre, and 17 other allied agencies issued a joint advisory warning that Russian state-linked hackers (part of the FSB, Russia's intelligence service) are systematically scanning the internet for poorly configured routers and other network devices, then using them as a foothold into energy, communications, healthcare, financial, and government-linked networks. The advisory singled out routers still running outdated management protocols and default or unchanged passwords as the way in.

Why it matters for your business: the router or firewall that connects your office to the internet is exactly the kind of device this advisory is about, and most small businesses have never changed its default password or checked for a firmware update since it was installed. Ask whoever set up your internet connection to confirm the router's admin password isn't a default, remote management is switched off unless you specifically need it, and its firmware is current.

9. A Christian College's Breach Shows How One Vendor Problem Can Expose Six Different Systems at Once

Moody Bible Institute confirmed that the extortion group ShinyHunters stole and later published more than 23 gigabytes of data on 2.3 million students, alumni, and donors, pulled from six separate systems the institute used — including its Salesforce marketing platform, a PeopleSoft admissions system, and a donor database — after the institute declined to pay. The data included names, dates of birth, addresses, phone numbers, and donor-relations records.

Why it matters for your business: small organisations — churches, charities, clubs, schools — often run donor, member, or customer data across several different cloud tools (a CRM, a donation platform, a mailing list) without realising that a weakness in any one of them can expose everything linked to it. List every outside platform holding your customers' or supporters' data, and for each one confirm MFA is switched on and check who still has access who shouldn't.

Sources

Summaries are compiled from public threat-intelligence feeds and security news sources. This digest is for awareness purposes only and does not constitute professional security advice.

Cybersecurity News