Zoom's wake-up call, zero-day SonicWall patch, 23andMe's growing breach bill

[00:00:00]From the CISO series, it's cybersecurity headlines.

[00:00:05]>> [music] >> These are the cybersecurity headlines for Thursday, July 16th, 2026. I'm Sarah Lane.

[00:00:14]Zoom's account takeover wake-up call.

[00:00:17]Zoom patched a critical input validation flaw in its Windows software that could let an attacker take over a Zoom account over the network. The attack doesn't require a login, and the victim doesn't have to click anything. The bug affects older versions of Zoom Workplace for Windows, the Windows VDI client, and the Windows Meeting SDK. Zoom hasn't said the flaw is being exploited, but because a successful attack could expose meetings, chats, contacts, and other account data, the company is urging customers to update.

[00:00:53]Two zero-days, one urgent SonicWall patch. SonicWall says attackers are exploiting two flaws in its SMA 1000 remote access appliances, the boxes that companies use to give employees and contractors secure access to internal networks. One is a maximum-severity server-side request forgery bug that can be reached without authentication. The other is a code injection flaw that can let an authenticated administrator run operating system commands on the device.

[00:01:28]CISA has added both bugs to its known exploited vulnerabilities catalog.

[00:01:32]Federal agencies have until July 17th to patch. Private organizations are being asked to treat this with the same urgency.

[00:01:44]23andMe's breach bill keeps growing.

[00:01:47]23andMe's 2023 breach has produced another settlement with a coalition of 42 state attorneys general. The states will receive $18 million from the company's bankruptcy funds to resolve claims tied to the breach, which exposed genetic and personal information belonging to 6.9 million people around the world. Attackers initially broke into about 14,000 accounts using reused passwords, then used the DNA relatives feature to reach data connected to millions more profiles, which included ancestry details, birth years, locations, family connections, and some health and genetic data. This comes after a June $46.75 million class action settlement for US customers.

[00:02:39]The e-card with remote access.

[00:02:42]Researchers at Forescout have detailed seasonal invite, a phishing campaign that turns the familiar e-card into a remote access trap. Since at least January, attackers have been sending fake holiday and party invitations that persuade Windows and Mac users to install legitimate remote monitoring and management software. Tools that are normally used by IT teams, which means they're signed, trusted, less likely to set off the same alarms as custom malware. But once installed, they give the attacker persistent control of the computer and a path to steal data or deploy more malicious software.

[00:03:23]Forescout says parts of the campaign appear to have with AI assistants, making them easier to create and change as the calendar moves from one seasonal event to the next.

[00:03:36]>> [music] >> Huge thanks to our sponsor, ThreatLocker. Every security leader is being asked the same question [music] right now. How do we enable innovation without creating unnecessary risk?

[00:03:49]That's [music] the challenge behind cloud adoption, behind AI, behind automation, and behind every major technology decision. ThreatLocker helps organizations [music] take a zero trust approach to that challenge, giving them greater control over what can execute, what can access their environment, and what users and applications are allowed to do. That's [music] why ThreatLocker is proud to support cybersecurity headlines, because security [music] works when innovation and control move together.

[00:04:21]>> Okobot goes seed hunting. Kaspersky researchers say Okobot is not a single piece of malware, but a modular framework with more than 20 payloads for stealing files, browser data, credentials, and cryptocurrency. One component known as seed hunter waits for a Ledger or Trezor hardware wallet to be connected, then injects a fake recovery screen directly into the legitimate desktop wallet app. Because these surrounding software is real, the request for the recovery phase can look much more convincing than an ordinary phishing page. If the user enters the words, Okobot sends the seed phrase and device details to its command and control server, giving the criminals everything they need to drain that wallet. The campaign has reached hundreds of victims in more than 25 countries, with infections spreading through click fixlers and fake software packages on GitHub.

[00:05:22]Patch Tuesday breaks the bug counter.

[00:05:25]Microsoft's July Patch Tuesday set a new record with fixes for 570 security flaws, nearly three times the previous month's total. The release included 59 critical bugs, 145 remote code execution flaws, and 254 privilege escalation issues. Two zero days were already being used in attacks. One in Active Directory Federation Services and another in SharePoint, both of which can help an attacker gain higher privileges after getting a foothold. Microsoft also fixed a publicly disclosed BitLocker bypass, bringing the month zero-day count to three. The big total doesn't mean that 570 bugs are being actively exploited, that would suck, but it does give Windows and enterprise administrators an unusually large testing and patching job.

[00:06:22]IBM rallies cybersecurity, accidentally?

[00:06:26]Cybersecurity stocks surged after IBM CEO Arvind Krishna described customers as being distracted by rapidly changing security threats. Companies are still pouring a lot of money into scarce AI servers and storage and memory, but Krishna's comments suggested those projects aren't pushing cybersecurity out of the budget. Investors apparently took that as a signal the AI boom is creating more systems, data, and identities that need protection.

[00:06:57]CrowdStrike, Okta, Palo Alto Networks, and Fortinet stocks all rose as a result, even though IBM's own shares fell on disappointing preliminary results.

[00:07:11]Gemini gets a botnet side hustle. Trend Micro researchers say a Russian-speaking attacker used Google's open-source Gemini CLI as a hands-on assistant for building and running a small botnet. It wasn't a flaw in Gemini itself, instead the attacker supplied a jailbreak prompt and a detailed playbook that told the tool it was doing authorized penetration testing. Then Gemini helped write code, move the command and control system to a new server, configure a Cloudflare tunnel, and troubleshoot the migration when infected machines failed to reconnect. This all took about 6 minutes, and the attacker later used ordinary natural language prompts to check which computers were online, list files, and generate new infection links.

[00:08:02]In practice, the botnet controlled eight machines at a dental clinic and had access to its open dental database.

[00:08:11]If you have any thoughts on the news from today or about our show in general, be sure to reach out to us [email protected].

[00:08:20]We'd love to hear from you. I am Sarah Lane reporting for the CISO Series. Stay cool and stay safe.

[00:08:27]>> [music] >> Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.