Secure Digital World (SDW)

  Two enterprise-facing vulnerabilities added to CISA’s Known Exploited Vulnerabilities Catalog require urgent patching, exposure review and forensic triage. On 22 July 2026, the U.S. Cybersecurity and Infrastructure Security Agency added two serious vulnerabilities to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation: CVE-2026-16232 — Check Point SmartConsole authentication bypass. CVE-2026-50522 — Microsoft SharePoint deserialization vulnerability. Both vulnerabilities affect high-value enterprise infrastructure. One can provide administrative control over security-management systems, while the other can enable unauthenticated remote code execution on vulnerable SharePoint servers. CISA set 25 July 2026 as the remediation deadline for affected U.S. federal civilian agencies, demonstrating the urgency attached to both flaws. 1. Check Point SmartConsole Authentication Bypass CVE: CVE-2026-16232 Type: Improper authentication ...

On July 1, 2026, CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. NVD describes the issue as a deserialization of untrusted data vulnerability in Microsoft Office SharePoint that may allow an authorized attacker to execute code over a network. This issue is especially important because SharePoint is not just a collaboration tool. In many organizations, it supports sensitive documents, internal workflows, identity-linked access, and business-critical knowledge repositories. When an actively exploited SharePoint server is exposed, the risk can move quickly from a vulnerability-management issue to broader enterprise compromise. According to NVD’s Microsoft-sourced information, the vulnerability affects Microsoft SharePoint Enterprise Server 2016 , SharePoint Server 2019 , and SharePoint Server Subscription Edition . The same entry shows a CVSS 3.1 base score of 8.8 (High). From an enterprise security perspect...

A June 12 report highlighted Google’s legal action against the operators of the “Outsider” phishing kit, a platform allegedly used to conduct large-scale phishing attacks with the support of artificial intelligence. Reuters reported that Google said the kit mimicked hundreds of trusted websites and used AI tools, including Gemini, to help generate fraudulent sites designed to steal personal and financial information. Google’s own blog said the operation was tied to 9,000 fake websites, more than 1 million fraudulent URLs, and 2.5 million messages sent to Android users over a two-week period. This case is especially important because it shows how phishing infrastructure is becoming more scalable, more convincing, and more dangerous when combined with AI-assisted content generation. Instead of relying only on manual fraud preparation, attackers can now rapidly create realistic fake websites, scam messages, and impersonation campaigns at much greater speed and volume. This is why AI-enabl...

A June 14 report highlighted a cyberattack that disrupted services at four major Iranian banks: Bank Melli, Bank Tejarat, Bank Saderat, and the Export Development Bank of Iran. According to Iranian state media, the incident targeted the shared communications infrastructure used by these institutions, causing temporary service disruption while technical teams worked to restore operations. This incident is especially important because it shows how cyber attacks against financial institutions do not always need to directly destroy systems or steal data to create real impact. Disrupting shared infrastructure, communication channels, or core service availability can quickly affect trust, access to banking services, and operational continuity. From a financial-sector cybersecurity perspective, this is a strong reminder that resilience is as important as prevention. Banks and other financial institutions depend on highly interconnected systems, and even a limited disruption in one part of the...

A June 12 threat intelligence report from Mandiant and Google Threat Intelligence Group described an active compromise and extortion campaign attributed to UNC6240, also tracked as ShinyHunters, targeting Oracle PeopleSoft infrastructure through CVE-2026-35273. The activity was observed between May 27 and June 9, before Oracle’s June 10 advisory, meaning affected organizations were exposed during a zero-day window. This issue is especially important because PeopleSoft supports core organizational functions such as human resources, finance, and supply-chain operations. Oracle says the vulnerability is remotely exploitable without authentication and may result in remote code execution. Public vulnerability records identify affected PeopleTools versions as 8.61 and 8.62, and CISA’s Known Exploited Vulnerabilities catalog includes CVE-2026-35273 as actively exploited. From an enterprise security perspective, this incident is a reminder that business-critical platforms are part of the moder...

CYBER SECURITY:   Improving Cyber Defense Through Coherent Joint Red Team and Blue Team by David Mugisha,  Student of  Ms.Digital Forensics and Information Security (Gujarat Forensic Sciences University) Abstract Over the years, the investments in security moved from nice to have to must have, and now organizations around the globe are realizing how important it is to continually invest in security. This investment will ensure that the company stays competitive in the market. Failure to properly secure their assets could lead to irreparable damage, and in some circumstances could lead to bankruptcy. Due to the current threat landscape, investing only in protection isn't enough. Organizations must enhance their overall security posture. This means that the investments in protection, detection, and response must be aligned. Due to the emerging threats and cyber security challenges, it is necessary to change the methodology from prevent breach to ass...