IT Pros Weekly Roundup July 20-24, 2026

IT professionals spent the past several days juggling a record-breaking Microsoft security release, a disruptive Microsoft 365 outage, a high-profile supply-chain exposure involving critical infrastructure, and a major U.S. government software consolidation deal. Here’s what mattered most.

The Pentagon awarded Oracle a nearly $7 billion, up-to-10-year Enterprise Software Agreement to consolidate on-premises software licenses across the Department of Defense, Coast Guard, and intelligence community. Negotiated by the Department of the Navy, the deal aims to replace fragmented purchasing with a single contract and is projected to save at least $441 million.

Microsoft’s Secure Future Initiative also released its July 2026 progress report, highlighting advances in secure foundations, multi-agent AI systems for vulnerability assessment, and preparation for future threats including quantum computing.

A ransomware group calling itself World Leaks posted nearly 19,000 files (about 14.3 GB) related to India’s Kudankulam Nuclear Power Plant. The material included drawings of cooling systems, floor layouts, and vendor details primarily tied to Units 3 and 4 under construction. NPCIL stated the data covered only conventional facilities handled by contractor Reliance Infrastructure and that no nuclear safety systems were affected. Reliance confirmed a partial breach on a third-party server. The incident underscores ongoing supply-chain risks for critical infrastructure.

On July 23, Microsoft 365 experienced a significant outage that began around 10:44 a.m. Eastern Time in the West U.S. Azure region. It caused intermittent connectivity issues and high latency affecting Teams, Outlook, SharePoint, the admin center, and related services. Microsoft tracked the incident as MO1437424, rerouted traffic, and advised administrators to monitor the Service Health dashboard. Some pro-Iran-linked actors claimed responsibility, though Microsoft treated it as an infrastructure issue.

Microsoft’s July 2026 Patch Tuesday (released July 14 and still dominating admin workloads this week) set a new record with roughly 570–622 CVEs addressed. It included three zero-days: two under active exploitation (an Active Directory Federation Services elevation-of-privilege and a SharePoint Server elevation-of-privilege) and one publicly disclosed Windows BitLocker bypass. Fifty-nine vulnerabilities were rated Critical. A compatibility hold temporarily blocked the main Windows 11 update (KB5101650) on certain Dell Intel devices due to reported shutdowns, performance issues, heat, and battery drain; Microsoft later released an out-of-band fix.

Microsoft Security also highlighted practical gains from Security Copilot Analyst Notes (automatic incident summarization) and announced a collaboration with AXA XL to deliver Defender Experts Cybersecurity Incident Response services to cyber-insurance policyholders.

• Prioritize the actively exploited AD FS and SharePoint zero-days. Enable full-request-body AMSI scanning on SharePoint where possible.

• For the recent outage: review your continuity plans and confirm you have offline access paths for critical Teams/Outlook workflows. Check the Service Health dashboard before escalating tickets.

• Supply-chain lesson from Kudankulam: inventory third-party repositories and data centers that hold drawings, vendor lists, or configuration data for critical systems—even “non-safety” ones.

• Patch Tuesday scale is the new normal. Automate testing rings and keep a clean rollback plan; the volume makes manual validation increasingly unrealistic.

The combination of a 600-CVE Patch Tuesday followed days later by a multi-hour Microsoft 365 outage produced the expected mix of dark humor on admin Slack channels. One recurring theme: “I finally finished testing the July updates… right as Teams went offline.” Another classic: “At least the nuclear plant leak wasn’t the nuclear part.”

Stay patched, keep your runbooks current, and maybe keep a local copy of that critical spreadsheet. See you next week—hopefully with fewer zero-days and more uptime.