Cyber news on July 14, 2026

1. 0117:00 UTC

   FTC data shows 14,263 vacation and travel fraud reports in Q3 2025

   5 outlets · first: wsbtv.com Threat intelligence

   Machine summary Data from the Federal Trade Commission shows 14,263 vacation and travel fraud reports were filed between July and September of 2025, with estimated losses of about $40 million, according to reports citing the FTC data. SmartCustomer, a review platform, said it conducted a review of the summer 2025 FTC data and that reviewers have flagged travel scams this year.

   1. According to FTC data cited in the reports, 14,263 vacation and travel fraud reports were filed between July and September of 2025.
   2. The reports state that losses in the third quarter of 2025 reached an estimated $40 million, surpassing second-quarter losses by 18%.
   3. The reports state that California had the largest estimated total loss among states in 2025's third quarter, about $6.3 million, with a per-report average loss of $4,814.
   4. The reports state that, based on FTC data linking every report to the consumer's own state, Nevada residents had the highest reporting rate nationwide, with Florida and Connecticut residents next.
   5. SmartCustomer said it conducted a review of summer 2025 FTC data and that reviewers have flagged travel scams this year, according to the reports.

   Reported by wsbtv.com, 99jamzmiami.com, kissrocks.com, hits973.com and powerorlando.com.

   • FTC
   • California
   • Florida
   • SmartCustomer

2. 0211:17 UTC

   SAP July 2026 Patches: 9.9 CVSS NetWeaver Flaw, 2 More Critical Fixes

   2 outlets · first: securityweek.com Vulnerability

   Machine summary SAP's July 2026 security update addresses three critical vulnerabilities, including a 9.9-rated memory corruption in NetWeaver AS ABAP.

   1. SAP released 19 new and updated security notes on its July 2026 patch day, covering critical to low-severity vulnerabilities.
   2. CVE-2026-27690 (CVSS 9.1) enables unauthenticated HTTP Request Smuggling in SAP Approuter, leading to request-response desynchronization and potential data exposure.
   3. CVE-2026-44761 (CVSS 9.1) stems from hardcoded credentials in Commerce Cloud sample scripts, permitting unauthorized API access if the OAuth2 client secret is not changed post-testing.
   4. CISA has previously added 14 SAP vulnerabilities to its Known Exploited Vulnerabilities catalog, though no active exploitation of the new July 2026 flaws has been confirmed.

   Reported by securityweek.com and bleepingcomputer.com.

   • CISA
   • SAP
   • Commerce Cloud
   • Approuter

3. 0321:23 UTC

   SonicWall confirms active exploitation of two SMA1000 zero-day flaws

   2 outlets · first: bleepingcomputer.com Vulnerability

   Machine summary SonicWall confirmed active exploitation of two zero-day vulnerabilities in SMA1000 appliances. Details on SSRF and code injection risks, affected models, and IOCs.

   1. CVE-2026-15409 is a critical (CVSS 10.0) unauthenticated SSRF vulnerability in the SMA1000 Work Place interface, enabling remote attackers to force the appliance to make unintended requests.
   2. CVE-2026-15410 designates a high-severity post-authentication code injection flaw (CVSS 7.2) in the Appliance Management Console, and it enables authenticated admins to run arbitrary OS commands.
   3. SonicWall PSIRT confirmed multiple incidents of active exploitation and has released indicators of compromise (IOCs) to aid detection.
   4. Volexity assisted the investigation, but the threat actor behind the zero-day attacks remains unidentified as of publication.

   Reported by bleepingcomputer.com and securityweek.com.

   • SMA1000
   • SonicWall
   • Volexity

4. 0411:30 UTC

   Carbon60 says it was named to 2026 MSP 501 ranking

   2 outlets · first: Pr Newswire Mostly press releases

   Machine summary Carbon60 made an announcement: inclusion in the 2026 MSP 501, which ranks managed service providers. The company said the recognition reflects its growth and approach to delivering cloud operations.

   1. According to Carbon60, the company announced its selection for the 2026 MSP 501.
   2. Carbon60 said that the MSP 501, now in year 19, reviews financial performance, long-term business health, operational efficiency, and recurring revenue strength.
   3. Carbon60 said it has served organizations in Financial Services, Healthcare and the Public Sector since 1998.
   4. Ryan Smyth, President & CEO of Carbon60, said the recognition validates what the team has built over nearly three decades.
   5. Carbon60 said it holds certifications including SOC 2, ISO 27001 and PCI DSS.

   Reported by Pr Newswire and thestarphoenix.com.

   • MSP 501
   • Carbon60

5. 0502:15 UTC

   Coverage recordgovinfosecurity.com: “Sentra CEO: Small AI Models Cut Cost of Data Classification”

   1 outlet · first: govinfosecurity.com Security

   The outlets that reported this event are listed with links to their reports; no summary of ours passed our automated checks for it, which says nothing about the event (how they work).

   Reported by govinfosecurity.com.

   • Sentra

Each summary and its key facts are a machine summary of the reports linked under it; the outlets, times and counts come from those reports' own records. How a rundown is built.