Assess promptly

Plus: The FBI eyes AI-powered tech to detect future crimes, Russia charges Telegram’s founder, xAI sues to stop a state’s “nudification” ban, and the Democrats learn a lesson about getting scammed.

Assess promptly

Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system. It has been described as a case of incorrect authorization that could result in

Patch now

WordPress 7.0.2 addresses two serious security issues, including a flaw chain that could lead to remote code execution on affected installations.

Update promptly

Google released Chrome 150.0.7871.128/129 with seven security fixes, led by a critical use-after-free vulnerability in CameraCapture.

Program guidance

Google Cloud's Mandiant team published a practical model for using AI agents in vulnerability management without surrendering deterministic controls or human accountability.

Governance update

The Federal Reserve, FDIC and OCC announced enhanced procedures intended to reduce the cyber risk associated with highly sensitive bank examination information.

Review your policy

A new multi-agency cybersecurity information sheet urges organizations to establish accessible, inclusive and well-governed coordinated vulnerability disclosure programs.

Assess and update

Cisco's July advisory bundle includes a RoomOS hardening release with multiple high-severity issues and a separate Identity Services Engine path-traversal vulnerability.

Review inventory

Cisco's 2026 advisory stream shows why organizations need current network-device inventory, supported software branches and evidence-driven upgrade processes.

Professional opportunity

ISC2 opened participation in development of an AI security certification, reflecting growing demand for professionals who can secure AI systems and govern AI risk.

Review access design

Google Cloud corrected a Developer Connect privilege-escalation path by requiring both the calling principal and the service agent to hold permission on referenced secrets.

Review exposure

Google mitigated CVE-2026-14934, a missing-authorization issue that could enable cross-tenant repository takeover in BigQuery, Dataform and Colab Enterprise workflows.

Patch self-managed hosts

Google disclosed CVE-2026-53359, a KVM use-after-free that could let a nested virtual machine cross the hypervisor boundary, and deployed live host hotpatches across managed Compute Engine.

Upgrade affected products

Cisco released fixes for ClamAV vulnerabilities, including CVE-2026-20216, that can let a crafted file terminate scanning and consume system resources.

Review certificate governance

Mozilla Root Store Policy version 3.1 became effective July 1, changing the governance baseline for certificate authorities trusted by Mozilla products.

Career planning

ISC2 surveyed more than 1,500 cybersecurity professionals about how certifications affect skills, credibility, career progression and organizational confidence.

Assess affected proxies

Google Cloud warned that blocked QPACK decoding in Envoy can trigger denial of service against the HTTP/3 stack, affecting some Cloud Service Mesh deployments.

Review WAF guidance

AWS published guidance for CVE-2026-13762 and CVE-2026-13763 involving inspection of HTTP/2 requests distributed across multiple frames.

Update managed devices

Apple's security releases page lists iOS and iPadOS 26.5.2, giving mobile administrators a new baseline to verify across supported devices.

Deploy and verify

Apple released macOS Tahoe 26.5.2 and updated its official security-release inventory for supported Mac systems.