Cybersecurity briefing, 2026-07-19

Stolen session tokens outlive the password reset.

• 7-Zip fix leaves embedded decoders behind
• WordPress PoCs leave artifacts as Windmill is hit
• ViPNet updates now carry the intruder too
• Run-box lures steal cloud sessions too
• Hikvision status endpoint makes cameras easier to find
• Fake CAPTCHAs shift Sandworm past installer detections
• NGINX patch bundle includes ASLR-dependent RCE

Recent editions

• Saturday, July 18, 2026: Siemens OT switches can keep root after reboot · 13 stories
• Friday, July 17, 2026: WordPress PoCs leave artifacts as Windmill is hit · 19 stories
• Thursday, July 16, 2026: AsyncAPI imports now trigger malware at load time · 19 stories
• Wednesday, July 15, 2026: Legacy shim revocations leave Secure Boot gaps · 18 stories
• Tuesday, July 14, 2026: Europe turns sanctions on Turla’s support network · 15 stories
• Monday, July 13, 2026: CMS upload paths are becoming server takeovers · 16 stories
• Sunday, July 12, 2026: Classic Web Client XSS puts mail sessions at risk · 6 stories