Cybersecurity briefing, 2026-07-06

A malware scanner has to open every hostile file it inspects, so ClamAV's parsers are attack surface, not armor.

• Tiny Linux kernel race opens root on desktops and Android
• ColdFusion exposure window collapses to hours
• Mixed .NET builds make Cavern harder to see
• Ransomware claims concentrate as AI polishes pressure
• Gitea Docker images trust spoofed logins by default
• AI browsing agents can be talked into paying
• Poisoned AI tools turn agents into control planes
• Guest root can break KVM host isolation
• Air-gapped PCs leak files through video cables
• Extradition turns Scattered Spider into an evidence trail
• Generative video turns liveness checks into guessing
• ClamAV parsers carry decades-old memory risks
• Maintainer takeovers put the trust chain in play
• Blogspot delivery hides a session-stealing loader
• Silent Opera GX mods leak data across sites

Recent editions

• Sunday, July 5, 2026: Ransomware claims concentrate as AI polishes pressure · 4 stories
• Saturday, July 4, 2026: Internet-facing Sentry appliances become trust-boundary footholds · 15 stories
• Friday, July 3, 2026: NetScaler risk spreads beyond SAML IdP · 19 stories
• Thursday, July 2, 2026: FortiGate credentials now feed ransomware runs · 19 stories
• Wednesday, July 1, 2026: Apple closes browser-to-kernel paths across its fleet · 18 stories
• Tuesday, June 30, 2026: Oracle Payments bug can leak the keys behind it · 17 stories
• Monday, June 29, 2026: Gamaredon builds persistence through cloud and WinRAR abuse · 13 stories