Cybersecurity briefing, 2026-06-30

Your AI coding assistant runs the repo before you read it.

• Oracle Payments bug can leak the keys behind it
• Gamaredon builds persistence through cloud and WinRAR abuse
• Defender flaw becomes ransomware’s privilege shortcut
• Exposed Langflow apps become network pivots
• Recovery Keys turn chat phishing into persistent access
• AI pushes vulnerability work past human pace
• AWS WAF can miss fragmented HTTP/2 bodies
• Edge ADC bug lets unauth caller become the perimeter
• Repo opens became live cloud compromise
• AI-branded extension quietly harvested search traffic
• Poisoned AI tools turn agents into control planes
• Agentic browsers leak secrets when context is faked
• Admin tool search leads to domain-wide ransomware
• Management console XXE exposes server-side files
• Installer abuse bypasses Chromium extension trust
• Russia’s influence machine outgrew Ukraine
• MISP flaws let users cross org boundaries

Recent editions

• Monday, June 29, 2026: Gamaredon builds persistence through cloud and WinRAR abuse · 13 stories
• Sunday, June 28, 2026: Recovery keys let messaging account theft persist · 1 story
• Saturday, June 27, 2026: Repo opens became live cloud compromise · 14 stories
• Friday, June 26, 2026: Bespoke backdoor marks CL-STA-1062’s next stage · 17 stories
• Thursday, June 25, 2026: Internet-facing PeopleSoft console becomes extortion foothold · 17 stories
• Wednesday, June 24, 2026: Criminal malware assembly lines are being torn down · 19 stories
• Tuesday, June 23, 2026: Embedded FFmpeg decoder exposes more than media players · 20 stories