Cybersecurity briefing, 2026-07-13

Android defenders have a new problem.

• Europe turns sanctions on Turla’s support network
• CMS upload paths are becoming server takeovers
• Signed Mac malware turns trust into the bypass
• Passkey enrollment becomes the account-takeover path
• Malicious jscrambler releases kept coming
• Wiping malware learns to spy and pretend to extort
• Exposed AiTM toolkit lowers the bar for MFA bypass
• Treasury targets ransomware’s support layer
• Blank Entra logs can hide credential checks
• Build repos leak live cloud keys
• Forgotten web hosts are now AI discovery points
• RabbitMQ secret leak can become broker takeover
• ShareFile cloud returns, but customer controllers stay offline
• Ransom negotiators become part of the attack surface
• ShareFile shutdown signals more than maintenance
• Police portal became a shared spy surface

Recent editions

• Sunday, July 12, 2026: Classic Web Client XSS puts mail sessions at risk · 6 stories
• Saturday, July 11, 2026: Malicious jscrambler releases kept coming · 16 stories
• Friday, July 10, 2026: Roundcube makes university mail a foothold · 19 stories
• Thursday, July 9, 2026: Routers become shared cover for espionage · 19 stories
• Wednesday, July 8, 2026: Accenture claim extends from code to cloud access · 19 stories
• Tuesday, July 7, 2026: Mixed .NET builds make Cavern harder to see · 18 stories
• Monday, July 6, 2026: Tiny Linux kernel race opens root on desktops and Android · 15 stories