Cybersecurity briefing, 2026-07-11

This week is about active compromise, not just theoretical risk.

• CMS Upload Paths Are Becoming Server Takeovers
• Malicious Jscrambler Releases Kept Coming
• One Header Can Own a Gitea Repo Fleet
• GitHub APIs Quietly Build Org Maps at Scale
• Roundcube Makes University Mail a Foothold
• Signed Driver Lets Ransomware Blind Defenses
• Hallucinated Package Names Become a New Infection Path
• Passkey Enrollment Becomes the Account-Takeover Path
• Build Repos Leak Live Cloud Keys
• Wiping Malware Learns to Spy and Pretend to Extort
• ShareFile Cloud Returns, But Customer Controllers Stay Offline
• SEO-Poisoned Installers Scale Silver Fox Intrusions
• HTTP/3 Servers Crash on Ordinary QPACK Traffic
• Police Portal Became a Shared Spy Surface
• Helpdesk Identity Checks Became the Weak Link
• Classic Web Client XSS Puts Mail Sessions at Risk

Recent editions

• Friday, July 10, 2026: Roundcube Makes University Mail a Foothold · 19 stories
• Thursday, July 9, 2026: Roundcube Makes University Mail a Foothold · 19 stories
• Wednesday, July 8, 2026: Roundcube Makes University Mail a Foothold · 19 stories
• Tuesday, July 7, 2026: Roundcube Makes University Mail a Foothold · 18 stories
• Monday, July 6, 2026: Tiny Linux Kernel Race Opens Root on Desktops and Android · 15 stories
• Sunday, July 5, 2026: Ransomware Claims Concentrate as AI Polishes Pressure · 4 stories
• Saturday, July 4, 2026: Internet-Facing Sentry Appliances Become Trust-Boundary Footholds · 15 stories