622 fixes in a single day, the Pentagon pausing its own cyber certification, Brussels planning for capacity it doesn't have, and Lidl's data walking out of a building Lidl doesn't own.
In this edition
- 01622 fixes in one day. The two being exploited scored 7.2 and 5.3.
- 02The Pentagon paused the cyber certification it spent six years building.
- 03Brussels has a plan for AI-driven attacks. Enforcement starts in three weeks.
- 04You can't patch 622 things. So stop asking whether you're patched.
- 05Lidl's customer data walked out of a building Lidl doesn't own.
Get the next GRC Brief in your inbox.
Subscribe to The GRC Brief622 fixes in one day. The two being exploited scored 7.2 and 5.3.
Microsoft's July Patch Tuesday carried fixes for 622 unique CVEs, the largest release in the programme's history. In May, Microsoft's VP of engineering had warned the monthly batches would grow because AI is accelerating vulnerability discovery. Few expected 600 plus two months later. The load: 416 flaws in Windows, 82 each in Office and Office 2016, 46 in Edge, 17 in SharePoint Server. More than 60 critical, 26 scoring above CVSS 9.0, 13 sitting at 9.8. Three zero-days, two of them already exploited: an elevation of privilege bug in Active Directory Federation Services (CVSS 7.2) and a missing authentication flaw in SharePoint Server (CVSS 5.3). Both are in CISA's known exploited catalogue, with federal deadlines of July 17 and July 28. The third, publicly known but unexploited, bypasses BitLocker device encryption with physical access. Researchers quoted called it the end of Patch Tuesday as a monthly ritual and the start of continuous, high-volume patching, and were near unanimous that CVSS-only prioritisation is finished.
Source: Dark Reading · Microsoft July 2026 Patch Tuesday, 14 Jul 2026
My take
The headline number is 622. The lesson is 7.2 and 5.3. Those are the scores of the two bugs attackers are actually using this month. Your thirteen 9.8s are not the ones eating you. If your patch programme sorts by CVSS and works down the list, you are patching in the wrong order, with more confidence than the data supports.
Here is the detail that should end the argument. Tenable pointed out that exploitability ratings do not account for how fast AI now builds exploits: one frontier model produced working proof-of-concept exploits for 13 of 14 vulnerabilities Microsoft had rated exploitation unlikely or less likely. Unlikely is a statement about the past now. It is not a prediction you can plan a month around.
What to do Monday: stop treating CVSS as the queue. Use CISA KEV and EPSS to find what is genuinely being exploited, then layer your own context, what is internet-facing, what holds privilege. Tiered SLAs, hours for anything on KEV, days for the rest. And accept the structural point: nobody patches 622 things. Prioritisation is the control now, not patch coverage.
The Pentagon paused the cyber certification it spent six years building.
On July 13 the US War Department suspended phase two of the Cybersecurity Maturity Model Certification, due to take effect in November, and opened a top-to-bottom review of the whole programme with a 60-day task force and a public request for information. CMMC, announced in early 2020, made defence contractors prove through approved private assessors that they could handle sensitive government information. The department's CIO said the current and planned requirements create prohibitive compliance costs and unacceptable bureaucratic burdens, especially for small businesses, while insisting cybersecurity remains a nonnegotiable priority and that contractors must still meet their regulatory obligations and phase one requirements. The undersecretary for acquisition framed it as putting procurement on a wartime footing rather than drowning suppliers in peacetime paperwork. And one quieter reason sits in the announcement: there are not enough assessors to run all the evaluations before the November deadline.
Source: US War Department · CMMC phase two suspension, 13 Jul 2026
My take
Read past the politics to the sentence that matters: not enough assessors. The scheme did not collapse on principle, it collapsed on capacity. That is the theme of this whole issue. A certification programme is only as real as the number of competent people who can run it, and demand for certificates always outruns the supply of people qualified to judge them. I watch the same pressure in ISO-land every year.
If you supply the US defence base, do not misread this. They suspended the certification, not the requirement. Phase one stands. Your contractual and regulatory obligations to protect that information stand. A paused audit is not a paused duty, and when the review lands in 60 days the debt you built in the meantime comes due in one lump.
And note the split with Europe. Last week Brussels dragged four governments to court for failing to implement NIS2. This week Washington paused its own scheme to lower the barrier for small suppliers. Same problem, opposite instinct: one enforces the paperwork, the other suspends it. Neither has actually solved the thing underneath, which is that the work outgrew the people available to do it.
Brussels has a plan for AI-driven attacks. Enforcement starts in three weeks.
On July 7 the European Commission presented its Action Plan on Cybersecurity and Artificial Intelligence, framing advanced AI as dual-use: it can find vulnerabilities, automate attacks and scale incidents at unprecedented speed, and it can also strengthen detection and response. Three objectives: promote the safe use of advanced AI, strengthen EU cyber resilience, and expand European AI capability for cybersecurity. Concrete pieces include building an EU evaluation capacity to support the AI Office's third-party assessment of AI models, a blueprint developed with ENISA, a secure testing environment, and roughly 100 million euros of EIC Fund investment into cyber and AI startups by the end of 2026. The plan also calls for sovereign frontier AI capability to avoid new strategic dependencies. It builds on the existing stack, the AI Act, the Cyber Resilience Act, NIS2 and DORA, and the AI Act's general-purpose AI provisions start being enforced on August 2. The evaluation capacity itself is targeted at 2027.
Source: European Commission · Action Plan on Cybersecurity and AI, 7 Jul 2026
My take
A few weeks ago I told you that access to frontier AI had become a licence Washington grants and revokes, and that you should keep an option that needs nobody's permission. It was my opinion. Now read the Commission's own plan: sovereign frontier AI capability, to avoid new strategic dependencies. That argument is no longer a newsletter take. It is EU policy, in writing.
Credit where it is due: this is a serious document that connects the AI Act, NIS2, DORA and the CRA instead of inventing another framework. That matters. But be honest about what a plan is. Evaluation capacity is targeted at 2027. The 622 CVEs at the top of this issue landed on Tuesday. The gap between the plan and the threat is measured in years, and the attacker is not waiting for ENISA's blueprint.
The date to put in your calendar is not 2027. It is August 2, when the AI Act starts being enforced against general-purpose AI providers. If you build on those models, your provider's obligations are about to become your evidence problem. Go ask them now what they will hand you, before you need it in an audit.
You can't patch 622 things. So stop asking whether you're patched.
A caveat first: this one is a vendor piece, sponsored content written by the security firm Picus. The argument is worth taking anyway, and the numbers in it are other people's. The first half of 2026 produced more CVEs than any full year before 2024, arriving at roughly one every 7.4 minutes. The Zero Day Clock, which tracks time from disclosure to working exploit across tens of thousands of CVEs, now puts the 2026 median at well under a day, down from weeks a few years ago. Only a fraction of a percent of those CVEs ever becomes a live attack. Live-fire testing cannot close the gap: an exploit can only be fired where one exists and where it is safe to fire it, which by Picus's count covers 10 to 15 percent of a typical enterprise's attack surface. The rest, flaws with no public exploit, regulated or air-gapped systems, this morning's advisory, goes unproven. Their proposal: every exploit is a chain of dependent steps, execution, defence evasion, privilege escalation, credential theft, lateral movement. Map a vulnerability to the steps it needs, test each against the controls you actually run, and if one required step has no path through your environment, the chain cannot complete on that asset even though the flaw is still sitting there.
Source: BleepingComputer · Picus sponsored post, 14 Jul 2026
My take
I am telling you this came from a vendor because you should know who is talking. Take the logic, skip the demo. And the logic holds: at one new CVE every 7.4 minutes and exploits landing in under a day, "are we patched" has stopped being an answerable question. "Can this chain complete here" still is.
Look at the top of this issue and it clicks. The two bugs being exploited scored 7.2 and 5.3. A severity queue buries them. Chain thinking finds them, because it asks what an attacker actually needs to succeed in your environment rather than how frightening the number looks in a spreadsheet.
The uncomfortable part nobody sells you: this only works if you know what your controls block, and most organisations do not. If you cannot answer "would credential dumping via shadow copy get caught here" with evidence rather than a vendor datasheet, no chain analysis saves you. Start with the honest inventory, not the platform.
Lidl's customer data walked out of a building Lidl doesn't own.
On Friday July 10, Lidl began notifying online shop customers in Germany, Belgium and the Netherlands that their data had been stolen. Not from Lidl. The breach happened at one of its IT service providers, where a separately stored file of customer data was briefly accessed and partly copied. Taken: salutation, first and last name, phone number, email address, date of birth and customer number. Lidl says there is no indication that passwords, billing or delivery addresses, bank details or payment information were affected, and that customer accounts remain secure. The provider has not been named, the number of affected customers has not been disclosed, and nobody has claimed the attack. The provider restored its systems, filed a police report and brought in forensics; the data protection authorities were notified. Lidl, part of the Schwarz Group, runs roughly 12,900 stores across 32 countries. For context, the Dutch DPA's annual report on July 8 logged more than 39,000 breach notifications in 2025, with cyberattack-related reports up from about 1,500 to 2,400, and account takeover reports up from around 600 to more than 1,700.
Source: The Record · Lidl third-party breach, disclosed 10 Jul 2026
My take
No card numbers, so people will shrug. Do not. Name, date of birth, phone, email and customer number is a ready-made phishing kit aimed at someone who already shops there, and Lidl said as much itself when it told customers to watch for phishing and identity fraud. Account takeover reports in the Netherlands nearly tripled in a year. That is what this data is for.
Now the part for you. Lidl was not breached. Lidl's supplier was. And yet the notifications, the regulator, the customer emails and the headlines are all Lidl's. You can outsource the processing. You cannot outsource the accountability. Under GDPR you are the controller, that provider is your processor, and Article 28 is not a formality you signed once in 2019.
Go ask this on Monday, out loud: which of our suppliers is holding a separately stored file of our customer data? Who approved it? When was it last checked? And would we hear about an incident from them, or from the press? Lidl did not name its provider. The interesting question is whether yours would name you.