Zero-Day Patch Alert: What Windows, Apple, Linux, and Browser Users Must Update Now

Zero-day warning does not mean “panic,” but it does mean patch in the right order. As of July 30, 2026, Windows and Microsoft server administrators face confirmed active exploitation involving SharePoint and AD FS; Apple users should make sure February’s targeted zero-day fix and July’s newer security updates are installed; Linux administrators should check whether their distribution, running kernel, and enabled modules are exposed to Copy Fail or Dirty Frag and install a fixed kernel where affected; and Chrome users should verify that the browser has restarted since a June in-the-wild V8 fix.

This report separates confirmed exploitation, publicly disclosed zero-days, public exploit code, and ordinary security updates. That distinction matters: a vulnerability can be serious without being a zero-day, and a new entry in CISA’s catalog may describe a flaw that was patched years ago.

The fast answer: what should you patch first?

First, what counts as a zero-day?

A zero-day vulnerability is a flaw that attackers exploited—or that became public—before defenders had a vendor patch ready. Security teams sometimes use the term more narrowly for confirmed in-the-wild exploitation before a fix. News headlines often use it more broadly for any publicly known, unpatched weakness.

• Actively exploited: attacks have been observed. This deserves the highest priority.
• Publicly disclosed: technical information or an exploit became public, but attacks may not have been observed.
• Proof of concept available: working code exists. That increases urgency, but it is not proof that criminals are using it.
• CISA KEV: CISA has evidence that the vulnerability has been exploited. The addition date is not necessarily the discovery or patch date.
• Ordinary security update: important to install, but it should not be called a zero-day unless the disclosure or exploitation timeline supports that label.

There is no single universal “official zero-day website.” For this report we used the CISA Known Exploited Vulnerabilities Catalog to confirm observed exploitation, then checked Microsoft, Apple, Google, Ubuntu, AlmaLinux, Debian, Red Hat, and Linux kernel sources for affected products and fixes. Trend Micro’s Zero Day Initiative was used as an independent technical cross-check—not as a replacement for vendor patch instructions.

Windows and Microsoft: July’s urgent items

1. The on-premises SharePoint attack cluster

The most urgent Microsoft story is not a normal home Windows PC flaw. It is a coordinated exploitation wave against on-premises SharePoint Server. In its alert revised July 28, CISA said it was aware of active exploitation involving:

• CVE-2026-32201
• CVE-2026-45659
• CVE-2026-56164
• CVE-2026-58644
• CVE-2026-50522

CISA says the vulnerabilities affect supported on-premises SharePoint Server Subscription Edition, 2019, and 2016. Attackers have used the weaknesses for remote-code-execution and post-exploitation activity, including stealing IIS machine keys, maintaining persistence, and deploying malware. SharePoint Online is not the product identified in this on-premises server alert.

Our earlier July 2026 Patch Tuesday guide contains the broader Windows and server update breakdown. The new CISA alert raises SharePoint above routine monthly patching because exploitation has now been confirmed across multiple CVEs.

2. AD FS CVE-2026-56155 is actively exploited

Microsoft classifies CVE-2026-56155 as an elevation-of-privilege vulnerability in Active Directory Federation Services. Microsoft’s official update data marks it as exploited. An attacker needs an existing foothold, but successful exploitation can lead to administrator privileges—especially concerning on identity infrastructure.

Install the July 14, 2026 security update or a later cumulative update on every AD FS server. After installation, Microsoft says the AD FS service audits the Distributed Key Manager container permissions at startup and every 24 hours. Administrators should review the AD FS Admin log for Event ID 1132. We explained the staged permission changes and October enforcement timeline in our AD FS DKM hardening guide.

3. Windows BitLocker CVE-2026-50661: public, but not reported exploited

CVE-2026-50661 was publicly known when Microsoft released the July fixes, so it qualifies under the broad “zero-day” definition. Microsoft’s data says exploitation was not detected and rated it less likely. The attack requires physical access and could bypass BitLocker Device Encryption to reach protected data.

Home and business users should still install July’s cumulative update or later. Before firmware changes or recovery work, confirm that the BitLocker recovery key is backed up to an approved location. Never send a recovery key through ordinary email or chat.

4. Defender RoguePlanet now has a fixed engine

Microsoft disclosed CVE-2026-50656, publicly called RoguePlanet, in June. Microsoft’s July 8 revision says the Microsoft Malware Protection Engine update addressed the vulnerability. The last affected engine was 1.1.26050.11; the first fixed engine was 1.1.26060.3008. Microsoft still says it has not detected exploitation.

Defender normally updates automatically, but isolated PCs, broken update policies, and managed endpoints can lag. Open Windows Security → Virus & threat protection → Protection updates and check for updates. Administrators can also verify engine deployment through their endpoint-management console. Our original RoguePlanet report now has an important conclusion: a fixed engine is available.

Do not confuse RoguePlanet with CVE-2026-41091, a separate Defender elevation-of-privilege vulnerability that Microsoft marked as publicly disclosed and exploited. Microsoft included that fix in the June security cycle, and CISA added it to KEV on May 20. Current Defender engine and platform updates are therefore important even on Windows PCs that already installed the July cumulative operating-system update.

5. June’s publicly disclosed Windows flaws are covered by current cumulative updates

June also included publicly disclosed fixes for Windows CTFMON (CVE-2026-45586), HTTP.sys (CVE-2026-49160), and BitLocker (CVE-2026-50507). Microsoft did not mark those three as exploited at release. Installing the newest cumulative update on a supported Windows version is more useful than hunting for each older KB separately.

Apple: one possible targeted zero-day, plus important July updates

Apple says CVE-2026-20700 may have been used in a sophisticated targeted attack

Apple’s clearest 2026 zero-day disclosure remains CVE-2026-20700. Apple said the memory-corruption flaw “may have been exploited in an extremely sophisticated attack against specific targeted individuals” on iOS versions before iOS 26. The issue could allow arbitrary code execution when an attacker already had memory-write capability.

Apple fixed it in February’s iOS/iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3, and visionOS 26.3 releases. Anyone running a newer supported release already has that specific fix—but should still install subsequent security updates.

The July 27 Apple updates are important, but Apple did not label them zero-days

As of July 27, Apple lists iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, Safari 26.6, watchOS 26.6, tvOS 26.6, and visionOS 26.6 as current security releases. We checked the official advisories and found no Apple statement that the July 27 vulnerabilities were known to be exploited. That means they are important security updates—not automatically “new Apple zero-days.”

For Mac-specific update details, see our July 27 Apple security-update guide. On an iPhone or iPad, use Settings → General → Software Update. On a Mac, use System Settings → General → Software Update. Install only updates delivered by Apple, not pop-ups claiming your device is infected.

Linux: public root exploits make kernel updates urgent

Copy Fail — CVE-2026-31431

Ubuntu’s security team says Copy Fail was publicly disclosed on April 29 with a working local privilege-escalation exploit. The flaw is in the Linux kernel’s algif_aead cryptographic interface. It can let an unprivileged local user become root; container environments may also face container-escape risk depending on configuration. CISA added CVE-2026-31431 to KEV on May 1, confirming observed exploitation.

Ubuntu released fixed kernels and says a reboot is required after installation. For Ubuntu systems:

sudo apt update && sudo apt upgrade
sudo reboot
uname -r

The exact fixed kernel depends on the Ubuntu release and hardware-enablement branch. Ubuntu says 26.04 is not affected, while its tracker shows release, hardware-enablement, and specialty-kernel exceptions that must be checked individually. Consult the Ubuntu CVE tracker rather than comparing against one universal kernel number.

Dirty Frag — CVE-2026-43284 and CVE-2026-43500

Dirty Frag is a pair of Linux kernel bugs involving IPsec ESP and RxRPC networking paths. AlmaLinux’s technical advisory says the disclosure embargo broke before distributions could coordinate and that working exploit code became public. The chain can give a local unprivileged user root access. That created a genuine zero-day exposure window even though the vulnerabilities were not listed in CISA KEV catalog version 2026.07.29.

AlmaLinux has shipped patched production kernels. Exposure is not universal: its advisory says the RxRPC half affects AlmaLinux 9 and 10 only when the optional kernel-modules-partner package is installed, while AlmaLinux 8 does not build that module. Its current update instruction for affected systems is:

sudo dnf clean metadata && sudo dnf upgrade
sudo reboot
uname -r

Debian, Red Hat, SUSE, Fedora, Ubuntu, cloud images, appliances, and managed hosting platforms may use different package names and fixed builds. Follow your distribution’s advisory. Do not copy a module-blacklist mitigation from another distribution unless your vendor confirms it is appropriate; disabling IPsec or RxRPC components can break legitimate workloads.

Why an old Linux CVE appeared in CISA’s 2026 list

CISA added Linux kernel CVE-2022-0492 to KEV on June 2, 2026. The CVE and fix date back to 2022. Its 2026 KEV addition means exploitation was observed recently; it does not make it a newly discovered 2026 zero-day. Systems still vulnerable to a four-year-old kernel flaw are likely running unsupported or seriously overdue software.

For more Linux patching context, see our guide to the CVE-2026-23111 local-root kernel flaw. The practical lesson is the same: installing a kernel package without rebooting often leaves the vulnerable kernel running.

Cross-platform browser alert: Chrome CVE-2026-11645

Windows, Mac, and Linux users share one additional risk through Google Chrome. Google said an exploit for the V8 out-of-bounds memory-access flaw CVE-2026-11645 existed in the wild, and CISA added it to KEV on June 9. Other Chromium-derived browsers may incorporate the affected code on different schedules, so use each browser vendor’s advisory rather than assuming Chrome’s exact build number applies.

Google’s first fixed Chrome baseline was 149.0.7827.102/.103 for Windows and macOS and 149.0.7827.102 for Linux. By now, use the newest version offered by your browser—not merely that June baseline. Open the browser’s Help → About page, let it update, and restart the browser. A downloaded update does not protect the running browser process until restart. Edge and other Chromium-derived browser users should follow their own vendor’s current release guidance. Our browser restart security tip explains how to verify that step.

A safe patch plan for homes and small businesses

For home users

1. Back up important files before major operating-system or firmware updates.
2. Update browsers first, then close and reopen them.
3. Run Windows Update or Apple Software Update and install supported security updates.
4. Restart the computer, even if the updater says it can wait.
5. Run the update check again after restart; some patches are offered in stages.
6. Never install a “zero-day repair tool” from an advertisement or unsolicited email.

For businesses and server administrators

1. Inventory internet-facing SharePoint, AD FS, RDP, VPN, browser, and Linux kernel exposure.
2. Preserve logs and snapshots appropriate to your incident-response plan before changing a potentially compromised server.
3. Patch a representative system, verify application health, and then accelerate deployment based on exposure and exploitation—not CVSS alone.
4. Confirm the update actually installed: correct KB/build, SharePoint farm version, Defender engine, Apple OS version, browser version, or running Linux kernel.
5. Reboot where required. A new Linux kernel package sitting on disk does not replace the running kernel.
6. For compromised or suspicious SharePoint servers, patching is containment—not a complete forensic cleanup.

Common mistakes to avoid

• Calling every CVE a zero-day: this creates alert fatigue and makes truly exploited flaws harder to prioritize.
• Assuming a low or moderate score means low risk: SharePoint CVE-2026-56164 scored 5.3 yet was actively exploited over the network.
• Installing but not rebooting: common with Linux kernels, browsers, and some Windows updates.
• Patching only the most visible SharePoint server: every server in the farm must be handled correctly.
• Trusting a vulnerability scanner without checking context: disabled Defender files can still trigger version-based scanner findings even when Microsoft says the disabled configuration is not exploitable through RoguePlanet.
• Downloading fixes from unofficial sites: fake updates are a common malware-delivery technique.
• Ignoring end-of-life systems: a KEV entry for a years-old flaw is often a warning that unsupported devices remain exposed.

Frequently asked questions

Is every item in the CISA KEV catalog a zero-day?

No. KEV means CISA has evidence of exploitation. A vulnerability can be added months or years after a patch was released. Always compare the disclosure, exploitation, and patch dates.

Do ordinary Windows 11 users run SharePoint Server or AD FS?

Usually not. Those are business server products. Home users should focus on the current Windows cumulative update, Defender engine updates, and browser updates. Businesses should ask whoever manages their servers whether on-premises SharePoint or AD FS is present.

Are the July 27 Apple updates emergency zero-day patches?

Apple’s advisories do not say the July 27 vulnerabilities were known to be exploited. Install them promptly, but do not describe the whole release as a zero-day event. CVE-2026-20700 is the earlier Apple flaw that the company says may have been exploited in a highly targeted attack, and it was fixed in February.

Can I patch Linux without rebooting?

A live-patching service may cover some kernel vulnerabilities, but coverage varies by distribution, kernel, and CVE. Unless your vendor explicitly confirms live-patch coverage, install the fixed kernel and reboot. Verify the running kernel afterward with uname -r.

If SharePoint is patched, is the incident over?

Not if the server was exploited before patching. CISA specifically warns about stolen IIS machine keys, persistence, and malware. Treat signs of compromise as an incident-response matter; after patching, follow Microsoft/CISA guidance to rotate and secure ASP.NET/IIS machine keys and investigate persistence rather than assuming the update removed the attacker.

Bottom line

The biggest immediate risk is the actively exploited on-premises SharePoint cluster, followed by exploited AD FS. Google Chrome should be updated and restarted promptly on every platform. Linux administrators should check whether their running kernels and modules are affected by Copy Fail or Dirty Frag, then install the distribution’s fixed kernel and reboot where applicable. Apple users should confirm they are on a current supported release, while recognizing that Apple did not label the July 27 bundle as a new zero-day event.

Good security reporting is not about calling everything an emergency. It is about identifying what attackers are actually using, applying the correct vendor fix, confirming the fix took effect, and investigating systems that may already have been compromised.

Primary and technical sources

• CISA: SharePoint hardening after new exploitation — revised July 28, 2026
• CISA Known Exploited Vulnerabilities Catalog — catalog version checked: 2026.07.29
• Microsoft: CVE-2026-56155 AD FS advisory
• Microsoft: CVE-2026-56164 SharePoint advisory
• Microsoft: CVE-2026-58644 SharePoint advisory
• Microsoft: CVE-2026-50522 SharePoint advisory
• Microsoft: CVE-2026-50661 BitLocker advisory
• Microsoft: CVE-2026-50656 Defender/RoguePlanet advisory
• Apple security releases
• Apple: iOS/iPadOS 26.3 security content and CVE-2026-20700
• Ubuntu: Copy Fail fixes and patch instructions
• AlmaLinux: Dirty Frag patches and fixed kernels
• Debian Security Tracker: CVE-2026-43284
• Red Hat CVE tracker: CVE-2026-43284
• Google Chrome: CVE-2026-11645 exploited in the wild
• Zero Day Initiative: July 2026 Microsoft update review

Last reviewed July 30, 2026. Exploitation status can change quickly; consult the linked vendor advisory and CISA KEV catalog before making operational decisions.