Ethical Hacking News
Microsoft has shattered yet another record for the most CVEs addressed in a single day during its Patch Tuesday release, highlighting the growing concern around AI-enabled bug hunting. The 622 patches cover an array of products and services, including Windows, Office, and Edge browsers, and underscore the importance of staying up-to-date with security patches.
Microsoft patched 622 vulnerabilities in its products and services, including Windows, Office, and Edge browsers. The majority of the vulnerabilities (58) were critical and had a CVSS score of 9.6 or higher, indicating high severity. AI-enabled bug hunting is becoming increasingly prevalent in cybersecurity, highlighting the need for users to stay up-to-date with security patches. Other companies, including Adobe, Broadcom, SAP, and Gobi X, also released patch notes this month, many of which included critical vulnerabilities. The growing concern around AI-enabled bug hunting is prompting new regulations and efforts to address the issue, such as South Korea's plan for a universal basic AI chatbot.
In a stark reminder of the ever-evolving threat landscape, Microsoft has shattered yet another record for the most CVEs addressed in a single day during its Patch Tuesday release. The 622 patches, which cover an array of products and services, including Windows, Office, and Edge browsers, underscore the growing concern that AI-enabled bug hunting may be becoming a new normal in the world of cybersecurity.
The sheer volume of vulnerabilities patched by Microsoft this month is a sobering reminder of the importance of staying up-to-date with security patches. The 428 non-Microsoft Chromium CVEs affecting Edge, which are not included in the 622 count, demonstrate the pervasive nature of the threat. Fifty-eight of these issues are critical, with two being actively exploited and one already publicly disclosed.
The list of vulnerabilities patched by Microsoft this month is a long and ominous one, with several high-profile issues making the cut. The first CVE-2026-56155, an Active Directory Federation Services elevation of privilege vulnerability, allows attackers to gain administrator privileges, albeit under limited circumstances. The second actively exploited vulnerability, CVE-2026-56164, affects Microsoft SharePoint by allowing unauthorized attackers to elevate their permissions.
The publicly reported but not-yet-exploited issue, CVE-2026-50661, involves BitLocker being able to have its security measures physically bypassed by anyone with local access to a BitLocker-secured machine. This vulnerability highlights the ongoing need for users to be vigilant and proactive in patching their systems.
Among the 58 critical issues patched by Microsoft this month are several that highlight the growing concern around AI-enabled bug hunting. The CVSS 9.6 remote code execution vulnerability, CVE-2026-48561, finds Copilot improperly neutralizing its input, allowing an unauthorized attacker to execute code with nothing but low-privileged Hyper-V guest access.
Microsoft Exchange is also affected by a CVSS 9.6 spoofing vuln due to failure to neutralize input, leading to cross-site scripting being possible from within a maliciously crafted email. Another issue, CVE-2026-55008, allows an unauthorized attacker to perform spoofing over a network by sending said malicious email to a target, allowing arbitrary JavaScript execution.
In addition to these high-profile issues, Microsoft also patched 16 remote code execution vulnerabilities in Microsoft Office and its associated applications. These vulnerabilities are caused by a variety of issues in the Office suite, including heap-based buffer overflow and use after free vulns, all scored around a CVSS 7.8.
This month's patch Tuesday release serves as a stark reminder of the ongoing importance of staying up-to-date with security patches. With AI-enabled bug hunting becoming an increasingly prevalent tool in the world of cybersecurity, it is more important than ever for users to be vigilant and proactive in patching their systems.
Adobe also released a batch of patches across its ecosystem, including 64 unique CVEs across seven bulletins for Commerce, Experience Manager, Creative Cloud Desktop, Illustrator, Content Credentials SDK, ColdFusion, and Animate. Every one of the bulletins included at least a couple of critical CVEs, with the highest-severity issue among Adobe's many Patch Tuesday entries coming in the form of a CVSS 9.9 path traversal vulnerability in ColdFusion that can allow arbitrary code execution.
The sheer volume of vulnerabilities patched by Adobe this month underscores the growing concern around the importance of security patches. With AI-enabled bug hunting becoming an increasingly prevalent tool in the world of cybersecurity, it is more important than ever for users to be vigilant and proactive in patching their systems.
Broadcom addressed seven CVEs in its Avi Load Balancer today, which it rates from 7.1 to 9.8 on the CVSS scale. The vulnerabilities include authentication bypass, RCE, privilege escalation, and directory traversal.
SAP published 16 security updates and one GitHub advisory today; nine of those updates have a CVSS score of 8.1 or higher. CVE-2026-44747, a memory corruption issue in SAP NetWeaver Application Server ABAP that could allow an authenticated attacker to gain unauthorized access to system data, is among the most severe issues patched by SAP this month.
As the threat landscape continues to evolve, it is essential for users to be vigilant and proactive in patching their systems. With AI-enabled bug hunting becoming increasingly prevalent, the importance of staying up-to-date with security patches cannot be overstated.
In other news, South Korea plans to launch a universal basic AI chatbot, while Australia has demanded that AI companies produce more energy than they consume, and stop 'theft' of content. The country is framing sweeping new regulations as equivalent to labor movement touchstones like winning a minimum wage.
This month also saw Google Cloud's VMware service lose resilience due to a dud update, with VMware itself warning of critical flaw in its load balancer. Meanwhile, developers have expressed concerns about the encrypted MultiAgentV2 messages used by OpenAI, which could make debugging and auditing harder.
The AI bubble has even reached hyperscalers, with many sounding the alarm about the growing concern around AI-enabled bug hunting. Even banks are now taking notice of the issue, as the financial sector continues to grapple with the implications of AI-powered cybersecurity threats.
In related news, Gobi X has highlighted the importance of creating more energy for AI, rather than taking it from society. This month also saw the release of several new tools and technologies aimed at addressing the growing concern around AI-enabled bug hunting.
Finally, this month's patch Tuesday release serves as a stark reminder of the ongoing importance of staying up-to-date with security patches. With AI-enabled bug hunting becoming increasingly prevalent, it is more important than ever for users to be vigilant and proactive in patching their systems.
Related Information:
https://www.ethicalhackingnews.com/articles/Microsoft-Dominates-Patch-Tuesday-Record-Book-A-Cautionary-Tale-of-AI-Enabled-Bug-Hunting-ehn.shtml
https://www.theregister.com/security/2026/07/14/patchpocalypse-now-microsoft-tops-last-months-record-with-622-patch-tuesday-cves/5271434
https://nvd.nist.gov/vuln/detail/CVE-2026-56155
https://www.cvedetails.com/cve/CVE-2026-56155/
https://nvd.nist.gov/vuln/detail/CVE-2026-56164
https://www.cvedetails.com/cve/CVE-2026-56164/
https://nvd.nist.gov/vuln/detail/CVE-2026-50661
https://www.cvedetails.com/cve/CVE-2026-50661/
https://nvd.nist.gov/vuln/detail/CVE-2026-48561
https://www.cvedetails.com/cve/CVE-2026-48561/
https://nvd.nist.gov/vuln/detail/CVE-2026-55008
https://www.cvedetails.com/cve/CVE-2026-55008/
https://nvd.nist.gov/vuln/detail/CVE-2026-44747
https://www.cvedetails.com/cve/CVE-2026-44747/
Published: Wed Jul 15 00:16:10 2026 by llama3.2 3B Q4_K_M
