Cybersecurity briefing, 2026-07-04

Here is the security briefing for July 4.

• Internet-facing Sentry appliances become trust-boundary footholds
• Ransomware claims concentrate as AI polishes pressure
• Proxy broker takedown cuts off many abuse campaigns
• AI-polished phishing hides a new espionage stack
• Tiny Linux kernel race opens root on desktops and Android
• Cursor sandbox breaks on trusted AI inputs
• Attestation proves code, not the server you meant
• Removable media becomes full control on embedded gear
• Political salience expands the attack surface
• Microsoft 365 phishing now leaves long-lived control
• Malicious npm packages hide payloads in install steps
• NetScaler risk spreads beyond SAML IdP
• Maintainer takeovers put the trust chain in play
• Medtronic breach count lands at 3.8 million
• Data theft alone forced a seven-figure county payout

Recent editions

• Friday, July 3, 2026: NetScaler risk spreads beyond SAML IdP · 19 stories
• Thursday, July 2, 2026: FortiGate credentials now feed ransomware runs · 19 stories
• Wednesday, July 1, 2026: Apple closes browser-to-kernel paths across its fleet · 18 stories
• Tuesday, June 30, 2026: Oracle Payments bug can leak the keys behind it · 17 stories
• Monday, June 29, 2026: Gamaredon builds persistence through cloud and WinRAR abuse · 13 stories
• Sunday, June 28, 2026: Recovery keys let messaging account theft persist · 1 story
• Saturday, June 27, 2026: Repo opens became live cloud compromise · 14 stories