Cybersecurity briefing, 2026-07-21

Your commit review cannot see this malware, because it lives in the config your AI assistant obeys.

• Langflow intrusion now targets the model itself
• GlobalProtect auth bypass now opens the inside
• Oracle ERP flaw reaches HR data
• Hidden PR text can steer review agents
• Developer IDEs became the supply-chain entry point
• SharePoint patch leaves trusted access behind
• Vendor breach exposes hospital relationship data
• Edge appliances become ransomware’s preferred front door
• Microsoft 365 calendars become a durable C2 store
• AI-labeled phishing pipeline is already in production
• Overdue patch follows AI-found Sentry command injection
• AI assistants now walk into GitHub lures
• Exposed cameras become state ISR tools
• Windows Update fixes Dell shutdown regressions
• Lagging ServiceNow instances stay exposed after patch rollout
• Forged JWTs can impersonate Opcenter X admins
• SmartPlug update closes inherited wireless flaws
• Crype service turns stealth into a commodity

Recent editions

• Monday, July 20, 2026: Overdue patch follows AI-found Sentry command injection · 17 stories
• Sunday, July 19, 2026: 7-Zip fix leaves embedded decoders behind · 7 stories
• Saturday, July 18, 2026: Siemens OT switches can keep root after reboot · 13 stories
• Friday, July 17, 2026: WordPress PoCs leave artifacts as Windmill is hit · 19 stories
• Thursday, July 16, 2026: AsyncAPI imports now trigger malware at load time · 19 stories
• Wednesday, July 15, 2026: Legacy shim revocations leave Secure Boot gaps · 18 stories
• Tuesday, July 14, 2026: Europe turns sanctions on Turla’s support network · 15 stories