Cybersecurity briefing, 2026-07-07

Agentic ransomware did not break in on its own.

• Roundcube makes university mail a foothold
• Mixed .NET builds make Cavern harder to see
• Exfiltrated resident data pushes county to pay seven figures
• AI browsing agents can be talked into paying
• Tiny Linux kernel race opens root on desktops and Android
• Guest root can break KVM host isolation
• Fake CAPTCHA fraud tools stay inside live banking sessions
• One editable bot could hijack the whole project
• Gitea Docker images trust spoofed logins by default
• The Gentlemen becomes a high-payout RaaS platform
• 404 pages became the compromise signal
• Poisoned AI tools turn agents into control planes
• Ransomware claims concentrate as AI polishes pressure
• Cyber Shield makes trust the national bottleneck
• AI-polished phishing hides a new espionage stack
• Trusted SaaS relays hide a job-interview phish
• Public issues can drive private repo leaks
• Routers become shared cover for espionage

Recent editions

• Monday, July 6, 2026: Tiny Linux kernel race opens root on desktops and Android · 15 stories
• Sunday, July 5, 2026: Ransomware claims concentrate as AI polishes pressure · 4 stories
• Saturday, July 4, 2026: Internet-facing Sentry appliances become trust-boundary footholds · 15 stories
• Friday, July 3, 2026: NetScaler risk spreads beyond SAML IdP · 19 stories
• Thursday, July 2, 2026: FortiGate credentials now feed ransomware runs · 19 stories
• Wednesday, July 1, 2026: Apple closes browser-to-kernel paths across its fleet · 18 stories
• Tuesday, June 30, 2026: Oracle Payments bug can leak the keys behind it · 17 stories