🔴 SonicWall SMA Zero-Days Exploited, 🔴 Record 622 Microsoft CVEs, 🔴 Claude for Chrome Unpatched, 🎯 GitHub BoryptGrab Campaign, 🎯 Russian Bulletproof Hosting Charged

The day's defining story is the cluster of actively exploited vulnerabilities. SonicWall confirmed two SMA1000 zero-days that chain into unauthenticated remote code execution on VPN appliances, Microsoft shipped its largest Patch Tuesday ever at 622 CVEs with two exploited flaws, and Rapid7 disclosed a SharePoint authentication bypass that also leads to unauthenticated RCE. The Joomla extensions added to KEV days ago remain under exploitation. Perimeter and web-facing platforms are being hit before organizations patch. Two CVSS 10 Joomla Extensions Under Active Zero-Day Exploitation, Added to CISA KEV

Claude for Chrome remains vulnerable to a flaw that lets any extension with claude.ai DOM access read Gmail, Docs, and Calendar, unpatched eight versions after disclosure. Disabling the act-without-asking mode is the only control. Claude for Chrome: Unpatched Flaw Lets Rogue Extensions Read Gmail, Calendar, and Docs

Progress confirmed the ShareFile shutdown was a high-severity path traversal and released patches. The BoryptGrab campaign used 292 fake GitHub repositories and DLL side-loading, and its variant bypasses Chrome's App-Bound Encryption, removing a control defenders rely on. Device-code phishing kits keep improving, with Jalisco regenerating OAuth device codes in real time. On policy, Treasury sanctioned a VPN service for the first time for aiding ransomware gangs, and the White House launched the Gold Eagle AI vulnerability clearinghouse.

Watchlist: patch SMA1000 appliances before the July 17 federal deadline, disable act-without-asking in Claude for Chrome, and audit browser extensions with claude.ai permissions.