This Week in Cybersecurity
Each week at Applied Tech we recap the biggest cybersecurity news headlines from the week to keep you informed and ready to face the latest threats. Here’s your breakdown for the week of July 5th – July 10th!
CISA Orders Feds to Prioritize Patching for Langflow, ColdFusion and Joomla Flaws
The Cybersecurity & Infrastructure Security Agency (CISA) has ordered the immediate patching for four critical vulnerabilities in Adobe ColdFusion, Langflow and two Joomla extensions by Friday, July 10. All four flaws have been exploited in the wild.
Source: SecurityWeek
Read More
Ohio County Pays $1M Ransom to Cyber Extortion Group
Kairos, a cyber extortion group that emerged in the fall of 2024, was paid $1 million by a small Ohio county in exchange for not releasing information stolen in a May 2025 intrusion. A leaked negotiation transcript shows the group demanded $3 million before eventually settling for $1 million.
Kairos claims that they stole over 2TB of data—approximately 1.6 million files.
Source: The Hacker News
Read More
Expect More Windows Security Updates from AI-Discovered Vulnerabilities Says Microsoft
Microsoft announced it’s expanding AI into its vulnerability management pipeline, using tools like MDASH (Multi-Model Agentic Scanning Harness) to scan Windows binaries and flag potential flaws earlier in development, with human experts still evaluating findings and approving fixes.
Because AI accelerates both discovery and analysis, Microsoft expects a higher volume of security updates in each release going forward, framing this as evidence defenders are keeping pace with an evolving threat landscape rather than as a sign of new weakness.
The company is also updating its Secure Development Lifecycle to account for AI-enabled attack techniques and urging customers to move from scheduled patching toward continuous, risk-based deployment using tools like Autopatch, Intune, and Defender Vulnerability Management.
Source: Microsoft
Read More
Phishing Campaign Poses as Major Brand Job Interview to Swipe Google Accounts
A phishing campaign is impersonating over 30 well-known brands (Adidas, Netflix, Coca-Cola, OpenAI, Adobe, and others) with fake job interview emails aimed at stealing Google account credentials, mostly targeting marketing professionals.
The emails abuse legitimate platforms like PeopleForce and Salesforce’s ExactTarget/Marketing Cloud, routing victims through a chain of trusted-looking redirects before landing on a fake meeting-scheduler page. There, a “Continue with Google” button triggers a convincing fake sign-in popup built with HTML/CSS (a “browser-in-the-browser” technique) rather than a real Google window, tricking victims into handing over credentials.
The campaign has reportedly been running for at least five months and even uses real recruiters’ names and photos to boost credibility.
Source: BleepingComputer
Read More
About Applied Tech, An HBS Brand
Applied Tech is a leading IT and cybersecurity services provider dedicated to helping organizations protect their digital assets and scale their IT capabilities. Our proactive services span cloud management, security, productivity, and IT growth strategy—delivered by an experienced team with solutions built around your goals.
As part of Heartland Business Systems, we now bring greater resources, broader capabilities, and deeper technical expertise to every client relationship.
Get in Touch with Us
