Cybersecurity briefing, 2026-07-04

Here is the security briefing for July 4.

• Internet-Facing Sentry Appliances Become Trust-Boundary Footholds
• Ransomware Claims Concentrate as AI Polishes Pressure
• Proxy Broker Takedown Cuts Off Many Abuse Campaigns
• AI-Polished Phishing Hides a New Espionage Stack
• Tiny Linux Kernel Race Opens Root on Desktops and Android
• Cursor Sandbox Breaks on Trusted AI Inputs
• Attestation Proves Code, Not the Server You Meant
• Removable Media Becomes Full Control on Embedded Gear
• Political Salience Expands the Attack Surface
• Microsoft 365 Phishing Now Leaves Long-Lived Control
• Malicious npm Packages Hide Payloads in Install Steps
• NetScaler Risk Spreads Beyond SAML IdP
• Maintainer Takeovers Put the Trust Chain in Play
• Medtronic Breach Count Lands at 3.8 Million
• Data Theft Alone Forced a Seven-Figure County Payout

Recent editions

• Friday, July 3, 2026: NetScaler Risk Spreads Beyond SAML IdP · 19 stories
• Thursday, July 2, 2026: FortiGate Credentials Now Feed Ransomware Runs · 19 stories
• Wednesday, July 1, 2026: Apple Closes Browser-to-Kernel Paths Across Its Fleet · 18 stories
• Tuesday, June 30, 2026: Oracle Payments Bug Can Leak the Keys Behind It · 17 stories
• Monday, June 29, 2026: Oracle Payments Bug Can Leak the Keys Behind It · 13 stories
• Sunday, June 28, 2026: Recovery Keys Let Messaging Account Theft Persist · 1 story
• Saturday, June 27, 2026: Repo Opens Became Live Cloud Compromise · 14 stories