Cybersecurity briefing, 2026-07-02

Here is the uncomfortable part of today's biggest identity story.

• FortiGate Credentials Now Feed Ransomware Runs
• Exposed Oracle EBS Servers Become a Mass Target
• PoC Repos Become the Malware Trap
• AI Access Now Depends on Government-Approved Guardrails
• AI Fuzzing Turns One Dump Into Mass PoCs
• Ransomware Claims Concentrate as AI Polishes Pressure
• MFA Fails on the Legacy OAuth Path
• AI-Generated Domains Become Pre-Positioned Attack Surface
• Signed Installers Hide a Remote-Control Malware Network
• Gmail Access Moves Past the Endpoint
• Paste-to-Run Attacks Break Endpoint Assumptions
• Blogspot Delivery Hides a Session-Stealing Loader
• ColdFusion Input Bugs Reach Code Execution Again
• Apple Closes Browser-to-Kernel Paths Across Its Fleet
• Cursor Sandbox Breaks on Trusted AI Inputs
• Agentic Browsers Leak Secrets When Context Is Faked
• The Gentlemen Becomes a High-Payout RaaS Platform
• Proton Drive Phishing Turns Trusted Links into Ransomware
• Microsoft 365 Phishing Now Leaves Long-Lived Control

Recent editions

• Wednesday, July 1, 2026: Apple Closes Browser-to-Kernel Paths Across Its Fleet · 18 stories
• Tuesday, June 30, 2026: Oracle Payments Bug Can Leak the Keys Behind It · 17 stories
• Monday, June 29, 2026: Oracle Payments Bug Can Leak the Keys Behind It · 13 stories
• Sunday, June 28, 2026: Recovery Keys Let Messaging Account Theft Persist · 1 story
• Saturday, June 27, 2026: Repo Opens Became Live Cloud Compromise · 14 stories
• Friday, June 26, 2026: Bespoke Backdoor Marks CL-STA-1062’s Next Stage · 17 stories
• Thursday, June 25, 2026: Internet-Facing PeopleSoft Console Becomes Extortion Foothold · 17 stories