Cybersecurity briefing, 2026-07-11

This week is about active compromise, not just theoretical risk.

• CMS upload paths are becoming server takeovers
• Malicious jscrambler releases kept coming
• One header can own a Gitea repo fleet
• GitHub APIs quietly build org maps at scale
• Roundcube makes university mail a foothold
• Signed driver lets ransomware blind defenses
• Hallucinated package names become a new infection path
• Passkey enrollment becomes the account-takeover path
• Build repos leak live cloud keys
• Wiping malware learns to spy and pretend to extort
• ShareFile cloud returns, but customer controllers stay offline
• SEO-poisoned installers scale Silver Fox intrusions
• HTTP/3 servers crash on ordinary QPACK traffic
• Police portal became a shared spy surface
• Helpdesk identity checks became the weak link
• Classic Web Client XSS puts mail sessions at risk

Recent editions

• Friday, July 10, 2026: Roundcube makes university mail a foothold · 19 stories
• Thursday, July 9, 2026: Routers become shared cover for espionage · 19 stories
• Wednesday, July 8, 2026: Accenture claim extends from code to cloud access · 19 stories
• Tuesday, July 7, 2026: Mixed .NET builds make Cavern harder to see · 18 stories
• Monday, July 6, 2026: Tiny Linux kernel race opens root on desktops and Android · 15 stories
• Sunday, July 5, 2026: Ransomware claims concentrate as AI polishes pressure · 4 stories
• Saturday, July 4, 2026: Internet-facing Sentry appliances become trust-boundary footholds · 15 stories