Cybersecurity briefing, 2026-07-17

• WordPress PoCs Leave Artifacts as Windmill Is Hit
• Acquisition Boundaries Did Not Stop Abbott Breach
• GoSerpent Kept Access Alive for Months
• Siemens OT Switches Can Keep Root After Reboot
• LLMs Now Chain Prompts Into Domain Access
• AI Agents Become Identity Risk, Not Just Output Risk
• Legacy Shim Revocations Leave Secure Boot Gaps
• SSH-Orchestrated Malware Keeps Swapping Payloads
• Stolen Code-Signing Certs Break Trusted-Binary Checks
• A Fake Prompt Becomes the Password Theft Point
• Signed Mac Malware Turns Trust Into the Bypass
• Zoom account takeover, Splunk credential exposure
• Hosting Providers Face Criminal Prosecution, Not Just Sanctions
• Spirals Shrinks the Ransomware Response Window
• Gold Eagle Makes Vulnerability Triage a Federal Pipeline
• Fairlife Ransomware Hits Shelf Supply, Not Data
• Ransomware Starts at the Gateway, Not the Endpoint
• Trusted Metadata Lets Agents Be Steered
• n8n Flaws Let Input Become Execution

Recent editions

• Thursday, July 16, 2026: AsyncAPI Imports Now Trigger Malware at Load Time · 19 stories
• Wednesday, July 15, 2026: AsyncAPI Imports Now Trigger Malware at Load Time · 18 stories
• Tuesday, July 14, 2026: AsyncAPI Imports Now Trigger Malware at Load Time · 15 stories
• Monday, July 13, 2026: Europe Turns Sanctions on Turla’s Support Network · 16 stories
• Sunday, July 12, 2026: CMS Upload Paths Are Becoming Server Takeovers · 6 stories
• Saturday, July 11, 2026: CMS Upload Paths Are Becoming Server Takeovers · 16 stories
• Friday, July 10, 2026: Roundcube Makes University Mail a Foothold · 19 stories