Cybersecurity briefing, 2026-07-03

Agentic browsers don't get exploited.

• NetScaler risk spreads beyond SAML IdP
• Internet-facing Sentry appliances become trust-boundary footholds
• FortiGate credentials now feed ransomware runs
• Ransomware claims concentrate as AI polishes pressure
• PoC repos become the malware trap
• Proxy broker takedown cuts off many abuse campaigns
• Cursor sandbox breaks on trusted AI inputs
• AI fuzzing turns one dump into mass PoCs
• Agentic browsers leak secrets when context is faked
• Microsoft 365 phishing now leaves long-lived control
• Argo CD’s internal repo-server becomes the blast radius
• Medtronic breach count lands at 3.8 million
• AI-polished phishing hides a new espionage stack
• Proton Drive phishing turns trusted links into ransomware
• GitHub Enterprise Server fixes hidden access gaps
• Malicious npm packages hide payloads in install steps
• Ransomware power is consolidating around Qilin
• Catalyst Center file-read bug exposes local secrets
• Spyware targets the oversight process itself

Recent editions

• Thursday, July 2, 2026: FortiGate credentials now feed ransomware runs · 19 stories
• Wednesday, July 1, 2026: Apple closes browser-to-kernel paths across its fleet · 18 stories
• Tuesday, June 30, 2026: Oracle Payments bug can leak the keys behind it · 17 stories
• Monday, June 29, 2026: Gamaredon builds persistence through cloud and WinRAR abuse · 13 stories
• Sunday, June 28, 2026: Recovery keys let messaging account theft persist · 1 story
• Saturday, June 27, 2026: Repo opens became live cloud compromise · 14 stories
• Friday, June 26, 2026: Bespoke backdoor marks CL-STA-1062’s next stage · 17 stories