Cybersecurity briefing, 2026-07-12

A poisoned build dependency is not a dependency incident.

• CMS Upload Paths Are Becoming Server Takeovers
• Classic Web Client XSS Puts Mail Sessions at Risk
• Malicious Jscrambler Releases Kept Coming
• Police Portal Became a Shared Spy Surface
• Android Wireless Debugging Opens a New Shell Path
• GitHub APIs Quietly Build Org Maps at Scale

Recent editions

• Saturday, July 11, 2026: CMS Upload Paths Are Becoming Server Takeovers · 16 stories
• Friday, July 10, 2026: Roundcube Makes University Mail a Foothold · 19 stories
• Thursday, July 9, 2026: Roundcube Makes University Mail a Foothold · 19 stories
• Wednesday, July 8, 2026: Roundcube Makes University Mail a Foothold · 19 stories
• Tuesday, July 7, 2026: Roundcube Makes University Mail a Foothold · 18 stories
• Monday, July 6, 2026: Tiny Linux Kernel Race Opens Root on Desktops and Android · 15 stories
• Sunday, July 5, 2026: Ransomware Claims Concentrate as AI Polishes Pressure · 4 stories