Microsoft's July Patch Tuesday ships 570 fixes by BleepingComputer's count, 621 by ZDI's — two exploited zero-days in AD FS and SharePoint included. June's all-time record lasted exactly one month, and Microsoft spent the preceding week explaining why: an AI discovery harness now feeds the pipeline, and volumes go up from here.
Apple shipped iOS 26.5.2 on June 29 with more than two dozen security fixes and no actively exploited zero-day. The real story is the timing: Apple is now pushing patches out ahead of the next major release, and told Reuters that AI-accelerated hacking is why.
A leaked database of working Fortinet VPN and admin credentials — CISA counts roughly 74,000 affected devices — is being used to break into networks. Upgrading FortiOS doesn't retroactively fix the weak password hashes; here's what to check and do.
A researcher dropped a seventh Windows zero-day hours after Patch Tuesday: RoguePlanet spawns a SYSTEM shell on fully-patched Windows 10 and 11, with no CVE and no fix. The exploit is narrower than it sounds — but the disclosure war that produced it is the part worth watching.
The largest Patch Tuesday ever shipped: roughly 200 vulnerabilities, 33 Critical, three publicly disclosed zero-days, and a CVSS 9.8 in Nuance PowerScribe that radiology shops should not sit on. The Secure Boot certificate deadline is 17 days out — this is the last Patch Tuesday before it.
Anthropic launched the Claude Compliance API on May 21 with 28 partner integrations spanning CrowdStrike, Palo Alto Networks, Okta, Zscaler, Microsoft Purview, Wiz, and IBM Guardium. It does the unglamorous job of routing Claude traffic into the same dashboards your security team already runs for everything else.
OCR's May 2026 target for finalizing the HIPAA Security Rule update is on track to slip — but the agency is enforcing the existing rule aggressively. Here's where the proposed rule stands, what OCR is actually doing today, and what healthcare organizations need to have in place either way.
Microsoft's May Patch Tuesday addresses 120 vulnerabilities and contains no zero-days — the first such month since June 2024. Among the Critical fixes are three RCEs at CVSS 9.8 or higher: Netlogon, Windows DNS Client, and Microsoft Dynamics 365. The Secure Boot certificate deadline is 45 days out.
iOS 26.5 ships encrypted RCS, but actually seeing the lock icon in a conversation requires three things to line up — and only one of them is on the iPhone side. Most Android contacts won't get there without being asked.
Apple released iOS 26.5 and iPadOS 26.5 on May 11, 2026. The headline change is a beta of end-to-end encrypted RCS messaging — and AT&T, T-Mobile, and Verizon are all signed on day one. The download is also unusually large: roughly 11 GB on an iPhone 16 Pro.