Cybersecurity briefing, 2026-07-20

The AI agent searching GitHub for a tool to install is a user with no phishing training.

• Overdue patch follows AI-found Sentry command injection
• Langflow intrusion now targets the model itself
• AI-labeled phishing pipeline is already in production
• WordPress PoCs leave artifacts as Windmill is hit
• Oracle ERP flaw reaches HR data
• Developer IDEs became the supply-chain entry point
• Vendor breach exposes hospital relationship data
• Lagging ServiceNow instances stay exposed after patch rollout
• Microsoft 365 calendars become a durable C2 store
• OpenSSL fix misses the usual scanner signals
• Exposed cameras become state ISR tools
• Windows Update fixes Dell shutdown regressions
• Crype service turns stealth into a commodity
• AI assistants now walk into GitHub lures
• Phishing delivery is getting QA and AI
• Persistent memory turns Gemini CLI into an operator
• ViPNet updates now carry the intruder too

Recent editions

• Sunday, July 19, 2026: 7-Zip fix leaves embedded decoders behind · 7 stories
• Saturday, July 18, 2026: Siemens OT switches can keep root after reboot · 13 stories
• Friday, July 17, 2026: WordPress PoCs leave artifacts as Windmill is hit · 19 stories
• Thursday, July 16, 2026: AsyncAPI imports now trigger malware at load time · 19 stories
• Wednesday, July 15, 2026: Legacy shim revocations leave Secure Boot gaps · 18 stories
• Tuesday, July 14, 2026: Europe turns sanctions on Turla’s support network · 15 stories
• Monday, July 13, 2026: CMS upload paths are becoming server takeovers · 16 stories