Hackers Spoof 3.7 Million OAuth Client IDs to Stealthily Enumerate 2 Million Entra ID Users
Threat actors are increasingly exploiting spoofed OAuth client IDs to enumerate Microsoft Entra ID accounts and identify potentially
CYBERSECURITY INTELLIGENCE
News that matters, without the noise.
Search current cybersecurity reporting locally in this app. Search terms are not sent to AdvisoryLoom. The Professional plan adds Watchlists, structured My Intelligence, and AI briefings.
Private search: the term stays in this browser and is matched against a generic content feed.LATEST COVERAGE
Cyber News
Manage Vendor Risk in a Few Practical Steps
Risk tolerance, exposure visibility, board oversight — handling third-party risk is complicated but achievable with disciplined, precise governance.
5 sources
Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days
Today is Microsoft’s July 2026 Patch Tuesday, and with it comes security updates for a record-breaking 570 flaws,
Connected reporting, one intelligence threadbleepingcomputer.com · cybersecuritynews.com · krebsonsecurity.com
Windows 11 KB5101650 & KB5099414 cumulative updates released
Microsoft has released Windows 11 KB5101650 and KB5099414 cumulative updates for versions 25H2/24H2 and 23H2 to fix security vulnerabilities, bugs, and add
ClickFix’s Mushrooming Ecosystem Demands New Defense Tactics
The attack vector is available for rent at scale, and evades AV and EDR, leaving YARA analysis as
Frontier AI: The Genie’s Out of the Bottle, But Where’s the Rulebook?
Cutting-edge artificial intelligence models are deploying with more independence and less human oversight. Several state governments are trying
2 sources
Progress confirms ShareFile zero-day flaw behind Storage Zone shutdown
Progress Software has confirmed that a high-severity zero-day vulnerability is behind the emergency shutdown of ShareFile Storage Zone
Connected reporting, one intelligence threadbleepingcomputer.com · securityweek.com
Veeam security advisory (AV26-694)
<article data-history-node-id="7978" about="/en/alerts-advisories/veeam-security-advisory-av26-694" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder
US: Pentagon Suspends CMMC Phase II Requirements for Defense Contractors
The US Department of Defense announced the immediate suspension of the CMMC Phase II requirements until further review
Iran abused mobile networks’ vulnerabilities to locate US military in the Middle East, report says
The Iranian government exploited well-known flaws in cellphone networks to locate and then strike U.S. military personnel in
2 sources
AsyncAPI npm Packages With 2M Weekly Downloads Compromised via GitHub Actions
A supply chain compromise has placed AsyncAPI npm packages at the center of a developer security incident. Five
Connected reporting, one intelligence threadcybersecuritynews.com
FortiSandbox Vulnerability Exposes VNC Server to Unauthenticated Attackers
Fortinet has disclosed a high-severity vulnerability in FortiSandbox that could let unauthenticated attackers gain access to the VNC