“Patch Tuesday” is an unofficial term used to refer to the second Tuesday of each month, when Microsoft, Adobe, Oracle, Google and other vendors regularly release software patches for their software products. Critical security updates are occasionally released outside of the normal Patch Tuesday cycle, but these are known as “Out-of-band” releases. Security updates for July 9th 2024 include a critical URI Spoofing vulnerability in Microsoft Windows among a total of 139 vulnerabilities this month.

This article covers recent vulnerabilities found to be actively exploited. They are categorised based not only on the category of exploitation, but their impact, and versions affected. This article also informs on any official fix and remediation guidance for the listed vulnerabilities.

A critical vulnerability – CVE-2024-6387 – has been discovered in OpenSSH, a widely used suite of secure networking utilities. This flaw, stemming from a signal handler race condition, poses critical risks including potential unauthorised remote code execution (RCE). Affected versions include 8.5p1 up to, but not including, 9.8p1, impacting numerous major Linux distributions such as Red Hat, Debian, and Ubuntu.