CDS Tech Tips

Monthly Security & Technology Insights

Hello from CDS,

July brought a record-breaking wave of updates from Microsoft and Apple, plus a serious warning from CISA and the NSA about state-sponsored actors targeting email systems. Here's what actually matters for you this month, and what to do about it.

Critical Alert

State-Sponsored Hackers Are Reading Email Without a Single Click

On July 23, the NSA, FBI, and CISA — along with 15+ allied intelligence agencies — issued a joint warning about a Russian state-backed group (tracked as "LAUNDRY BEAR") actively exploiting a webmail vulnerability. The unsettling part: victims don't have to click a link or open an attachment. Simply viewing a malicious email in a vulnerable webmail inbox is enough to trigger it, silently exfiltrating up to 90 days of email history and your organization's contact directory.

Why this matters to you: This campaign has been running since mid-2025 and continues today. It specifically targets business and government email systems — exactly the kind of infrastructure that stores client communications, financial details, and sensitive documents.

Your defense: If your business runs its own mail server or a hosted webmail platform (rather than Gmail/Microsoft 365, which aren't affected), make sure it's fully patched now. For everyone else: this is a good reminder that email is a prime espionage target — enable MFA on your inbox if you haven't, and be suspicious of "read receipts" or odd account activity.

Security Updates

A Record Month for Patches — Windows and Apple Both Went Big

July was one of the busiest patch months on record for both major platforms. Neither update cycle is optional this time — both include fixes for vulnerabilities already being exploited in the wild.

Windows users: Microsoft's July Patch Tuesday fixed over 600 vulnerabilities — a record — including roughly 60 rated "Critical" and at least two zero-days already being actively exploited by attackers. Go to Settings > Windows Update and install everything available. Don't defer this one.

Mac/iPhone/iPad users: Apple released its own major update wave on July 27 — iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and Safari 26.6. Go to Settings > General > Software Update (iPhone/iPad) or System Settings > General > Software Update (Mac) and install now.

How to update: If it's been more than a week since your last reboot, restart your device after installing — many of these patches don't take effect until the system restarts.

Quick Tips

3 Things to Do This Month

1	Install July's updates and reboot. With a record number of patches this month across both Windows and Apple platforms, updating alone isn't enough — restart your device so the fixes actually take effect. If you haven't rebooted in over a week, do it today.

2	Set up or review your password manager. 1Password or Apple Keychain are our recommended options — avoid saving passwords in your browser. Initial setup takes about 30-60 minutes and is worth the investment.

3	Audit your browser extensions. With email-based attacks in the news this month, take five minutes to review installed browser extensions. Remove anything you don't recognize or no longer use — they're a common way attackers gain a foothold.

Not sure if your systems are fully patched or your email is exposed?
📞 832-378-8393

Get a Security Audit

Concierge Digital Solutions

Keeping your technology running smoothly since 2017
📞 832-378-8393 | ron@cdsolutions.net
www.cdsolutions.net

You're receiving this because you're a valued CDS client.
To unsubscribe, reply with "unsubscribe" in the subject line.