Cybersecurity briefing, 2026-07-02

Multi-factor authentication never fired, because the attacker never asked for it.

• FortiGate credentials now feed ransomware runs
• Exposed Oracle EBS servers become a mass target
• PoC repos become the malware trap
• AI access now depends on government-approved guardrails
• AI fuzzing turns one dump into mass PoCs
• Ransomware claims concentrate as AI polishes pressure
• MFA fails on the legacy OAuth path
• AI-generated domains become pre-positioned attack surface
• Signed installers hide a remote-control malware network
• Gmail access moves past the endpoint
• Paste-to-run attacks break endpoint assumptions
• Blogspot delivery hides a session-stealing loader
• ColdFusion input bugs reach code execution again
• Apple closes browser-to-kernel paths across its fleet
• Cursor sandbox breaks on trusted AI inputs
• Agentic browsers leak secrets when context is faked
• The Gentlemen becomes a high-payout RaaS platform
• Proton Drive phishing turns trusted links into ransomware
• Microsoft 365 phishing now leaves long-lived control

Recent editions

• Wednesday, July 1, 2026: Apple closes browser-to-kernel paths across its fleet · 18 stories
• Tuesday, June 30, 2026: Oracle Payments bug can leak the keys behind it · 17 stories
• Monday, June 29, 2026: Gamaredon builds persistence through cloud and WinRAR abuse · 13 stories
• Sunday, June 28, 2026: Recovery keys let messaging account theft persist · 1 story
• Saturday, June 27, 2026: Repo opens became live cloud compromise · 14 stories
• Friday, June 26, 2026: Bespoke backdoor marks CL-STA-1062’s next stage · 17 stories
• Thursday, June 25, 2026: Internet-facing PeopleSoft console becomes extortion foothold · 17 stories