Cybersecurity briefing, 2026-07-17

• WordPress PoCs leave artifacts as Windmill is hit
• Acquisition boundaries did not stop Abbott breach
• GoSerpent kept access alive for months
• Siemens OT switches can keep root after reboot
• LLMs now chain prompts into domain access
• AI agents become identity risk, not just output risk
• Legacy shim revocations leave Secure Boot gaps
• SSH-orchestrated malware keeps swapping payloads
• Stolen code-signing certs break trusted-binary checks
• A fake prompt becomes the password theft point
• Signed Mac malware turns trust into the bypass
• Zoom account takeover, Splunk credential exposure
• Hosting providers face criminal prosecution, not just sanctions
• Spirals shrinks the ransomware response window
• Gold Eagle makes vulnerability triage a federal pipeline
• Fairlife ransomware hits shelf supply, not data
• Ransomware starts at the gateway, not the endpoint
• Trusted metadata lets agents be steered
• n8n flaws let input become execution

Recent editions

• Thursday, July 16, 2026: AsyncAPI imports now trigger malware at load time · 19 stories
• Wednesday, July 15, 2026: Legacy shim revocations leave Secure Boot gaps · 18 stories
• Tuesday, July 14, 2026: Europe turns sanctions on Turla’s support network · 15 stories
• Monday, July 13, 2026: CMS upload paths are becoming server takeovers · 16 stories
• Sunday, July 12, 2026: Classic Web Client XSS puts mail sessions at risk · 6 stories
• Saturday, July 11, 2026: Malicious jscrambler releases kept coming · 16 stories
• Friday, July 10, 2026: Roundcube makes university mail a foothold · 19 stories