Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack

This collection summarizes a large set of July 2026 security incidents and updates: Microsoft released a record Patch Tuesday covering 622 CVEs including two zero-days under active exploitation; SAP fixed a critical NetWeaver ABAP out-of-bounds write (CVE-2026-44747, CVSS 9.9); CISA added two Joomla extension zero-days (including CVE-2026-48939) to its KEV catalog. Other notable items: a new Rust-based LabubaRAT masquerading as NVIDIA software, RabbitMQ access-control flaws that can leak OAuth secrets and cross-tenant metadata, 11 Microsoft-signed UEFI shims that can bypass Secure Boot, and a恶