“Inventory all Langflow instances across your customer base today and notify affected clients of active exploitation before EOD.”
M365 July 2026 Patch Tuesday: 'BlueHammer' and Peer Exploits Actively Used by Ransomware Groups
CISA has confirmed that previously patched Windows vulnerabilities — including 'BlueHammer', one of a series of exploits released by the researcher Nightmare-Eclipse since March 2026 — are already being actively exploited by ransomware groups. The July Patch Tuesday (14 July) is expected to deliver elevated CVE counts, continuing a trend from June's record-setting 244-CVE release. MSPs should prioritise deployment of the July update the week of 14 July, with particular attention to any KEV-listed entries.
Read more →CISA KEV: Langflow Authorization Bypass (CVE-2026-55255, CVSS 9.9) Actively Exploited — Federal Deadline Passed
CISA added CVE-2026-55255, a critical authorization bypass in Langflow (CVSS 9.9), to its Known Exploited Vulnerabilities catalog on 7 July 2026, confirming active exploitation in the wild. The federal remediation deadline of 10 July has already passed, meaning any unpatched instance should be treated as overdue and potentially compromised. Workaround: follow vendor advisory for patched Langflow versions; if a patch is unavailable, discontinue use per BOD 26-04 guidance.
Read more →Windows Defender LPE Zero-Day 'RoguePlanet' (CVE-2026-50656) Patched — PoC Public on GitHub
Microsoft has released a fix for CVE-2026-50656, a Windows Defender privilege escalation flaw affecting Windows 10 and 11 that can deliver SYSTEM-level access via low-complexity attacks. Public proof-of-concept code is live on GitHub, making exploitation likely in the near term despite Microsoft not yet confirming active in-the-wild exploitation. Workaround: verify the fixed Microsoft Malware Protection Engine version (1.1.26060.3008) is installed; systems with default auto-update should have received it automatically, but manually trigger the update on any managed endpoint that has auto-update disabled.
Read more →SonicWall SMA1000 Patched for SQL Injection and VPN Credential Enumeration Bugs
SonicWall released patches for four vulnerabilities in its SMA1000 series firewalls, including a high-severity SQL injection flaw (CVE-2026-4112) that could allow a read-only admin to escalate to primary admin rights. Three additional flaws allow remote attackers to enumerate SSL VPN user credentials or bypass TOTP authentication. SonicWall reports no evidence of active exploitation but urges immediate updates; admins should prioritise SMA1000 appliances with internet-facing management portals.
Read more →AI Accelerating Vulnerability Discovery — July 2026 Patch Tuesday Forecast Warns of Sustained High CVE Volumes
Ivanti's Senior Product Manager flagged in a July 2026 Patch Tuesday forecast that AI is now actively accelerating both vulnerability discovery and exploitation speed, raising questions about whether traditional CVE-by-CVE tracking remains practical. June 2026 set a Microsoft record with over 200 CVEs in a single Patch Tuesday, and July is forecast to continue at elevated volumes, prompting many organisations to shift toward 'patch the latest release as fast as possible' rather than per-CVE analysis. MSPs should review their patch SLAs and consider whether AI-assisted patch prioritisation tools (KEV-ranked) can reduce analyst burden.
Read more →Dicker Data Adds AvePoint to Microsoft Portfolio as AU Channel Focuses on AI Data Governance
Dicker Data has added AvePoint to its Microsoft-aligned distribution portfolio, with the move framed around growing Australian demand for AI-readiness and data governance as M365 Copilot adoption accelerates. The deal reflects a broader channel trend flagged by CRN Australia where AI adoption in Australian enterprises is increasingly gated on data governance maturity rather than technology availability. MSPs advising clients on Copilot rollouts should include a data governance assessment and consider AvePoint-class tooling as part of the engagement.
Read more →Blue Crystal Targets Australian Sovereign AI Demand via Airia Partnership
Australian technology company Blue Crystal has announced a partnership with Airia to address growing sovereign AI demand in the local market, targeting organisations that require AI processing to remain within Australian borders. This follows a broader trend of Australian government and enterprise buyers requiring data sovereignty assurances before deploying large language model-based workflows. MSPs serving government, healthcare, or legal clients should monitor sovereign AI offerings as a potential differentiator and compliance requirement.
Read more →RecordPoint Launches Channel-First Global Partner Program — AU MSPs a Key Focus
RecordPoint, a Microsoft-aligned data intelligence vendor, has gone channel-first with a new global partner program targeting MSPs and solution providers as its primary go-to-market route. The program is relevant for Australian MSPs serving regulated industries such as government, finance, and healthcare that require robust records and data management compliance. MSPs interested in adding a data governance practice on top of Microsoft 365 should review the program for margin and specialisation opportunities.
Read more →This is what you get — every weekday, free.
Subscribers get the full “From the Floor” take with every issue — not just the news summary you just read.
Written from 12 years on the helpdesk floor. Always free.