Cybersecurity briefing, 2026-07-03

Coordinated disclosure has always assumed defenders hear about a bug before attackers can weaponize it.

• NetScaler Risk Spreads Beyond SAML IdP
• Internet-Facing Sentry Appliances Become Trust-Boundary Footholds
• FortiGate Credentials Now Feed Ransomware Runs
• Ransomware Claims Concentrate as AI Polishes Pressure
• PoC Repos Become the Malware Trap
• Proxy Broker Takedown Cuts Off Many Abuse Campaigns
• Cursor Sandbox Breaks on Trusted AI Inputs
• AI Fuzzing Turns One Dump Into Mass PoCs
• Agentic Browsers Leak Secrets When Context Is Faked
• Microsoft 365 Phishing Now Leaves Long-Lived Control
• Argo CD’s Internal Repo-Server Becomes the Blast Radius
• Medtronic Breach Count Lands at 3.8 Million
• AI-Polished Phishing Hides a New Espionage Stack
• Proton Drive Phishing Turns Trusted Links into Ransomware
• GitHub Enterprise Server Fixes Hidden Access Gaps
• Malicious npm Packages Hide Payloads in Install Steps
• Ransomware Power Is Consolidating Around Qilin
• Catalyst Center File-Read Bug Exposes Local Secrets
• Spyware Targets the Oversight Process Itself

Recent editions

• Thursday, July 2, 2026: FortiGate Credentials Now Feed Ransomware Runs · 19 stories
• Wednesday, July 1, 2026: Apple Closes Browser-to-Kernel Paths Across Its Fleet · 18 stories
• Tuesday, June 30, 2026: Oracle Payments Bug Can Leak the Keys Behind It · 17 stories
• Monday, June 29, 2026: Oracle Payments Bug Can Leak the Keys Behind It · 13 stories
• Sunday, June 28, 2026: Recovery Keys Let Messaging Account Theft Persist · 1 story
• Saturday, June 27, 2026: Repo Opens Became Live Cloud Compromise · 14 stories
• Friday, June 26, 2026: Bespoke Backdoor Marks CL-STA-1062’s Next Stage · 17 stories