Cybersecurity Week in Review: SharePoint Persistence, PLC Integrity and Patch Pressure

The week of July 22–28 brought a clear message for regulated organizations: exposure is not limited to a single vulnerable application or an overloaded patch queue. Attackers are pursuing durable access to internet-facing systems, while defenders are also being asked to verify the integrity of the engineering tools and reusable code modules that influence industrial safety logic. At the same time, the volume of disclosed fixes and reported incidents is raising the operational cost of deciding what must happen first.

This week’s developments

SharePoint exploitation moved from patching concern to access-and-persistence concern. Attackers are exploiting the unauthenticated SharePoint remote-code-execution vulnerability CVE-2026-50522 to extract IIS machine keys, which can support long-term access; CISA added the vulnerability to its Known Exploited Vulnerabilities catalog with a July 25 federal remediation deadline.¹ For organizations running on-premises SharePoint, the implication is direct: applying the fix is essential, but machine-key theft means teams must also consider whether an already-compromised server requires validation and broader response.

CISA expanded its industrial-control warning. The July 22 update to advisory AA26-097A named Siemens TIA Portal, Schneider Electric EcoStruxure and Rockwell Studio 5000 as engineering software used to access and modify PLC safety logic in critical-infrastructure facilities. It also added guidance for detecting malicious changes in reusable code modules leveraged within those environments.² The focus is therefore not only on network access to a controller, but on whether approved engineering workflows and shared logic components have been altered.

Microsoft’s patch burden reached exceptional scale. Reporting this week said Microsoft issued fixes for well over 600 flaws in a record-sized Patch Tuesday cycle.³ A release of that size makes sequencing, testing and evidence of remediation especially important for organizations that cannot safely update every system at once.

Incident volume remained high worldwide. Hackmanac counted 451 cyberattacks across 64 countries during the week, providing a broad measure of the pressure facing defenders even though the figure is not a forecast for any one organization.⁴

What it means for regulated IT teams

For a Central Valley healthcare provider, school district, county agency or financial organization, the immediate priority is to identify any internet-exposed on-premises SharePoint instances, confirm remediation of CVE-2026-50522, and investigate whether machine-key exposure could have created continuing access; the same review should produce dated evidence for internal governance and regulatory reporting processes. Teams supporting agricultural, water, manufacturing or other operational environments should separately inventory PLC engineering workstations and toolchains, restrict and review access to safety-logic repositories, and compare reusable code modules against known-good versions. With more than 600 Microsoft fixes and a reported 451 attacks in 64 countries, a risk-based queue—focused first on actively exploited, internet-facing and safety-relevant systems—provides a more defensible operating model than treating every update as equal.

Sources

Footnotes

1. Top 5 Cybersecurity News Stories July 24, 2026 - DIESEC — 2026-07-24 ↩

2. Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure | CISA — 2026-07-22 ↩

3. Cyber Attack News - Risk Roundup - July 2026 — 2026-07-28 ↩

4. HACK TUESDAY WEEK 22 - 28 JULY 2026 - Hackmanac — 2026-07-28 ↩