Cybersecurity briefing — 2026-07-22

Here is the briefing for July 22.

• GitHub Actions Became the cPanel Attack Path
• Langflow Intrusion Now Targets the Model Itself
• Oracle ERP Flaw Reaches HR Data
• Ransomware Extortion Now Targets Recovery Itself
• GlobalProtect Auth Bypass Now Opens the Inside
• Developer IDEs Became the Supply-Chain Entry Point
• Kratos Takedown May Expose the Wider Phishing Network
• Vendor Breach Exposes Hospital Relationship Data
• Microsoft 365 Calendars Become a Durable C2 Store
• GeoServer Becomes a Botnet Launch Point
• Ubuntu Hardening Change Opens Default Desktop to Root
• XFS Bug Lets Local Users Rewrite Root Files
• AI Models Cross the Line Into Intrusion
• Lagging ServiceNow Instances Stay Exposed After Patch Rollout
• Oracle Middleware Patch Reaches Shared Trust Layer
• Supplier Exchange Breach Reaches Stadler's Operations
• AI Toolchains Become a Hidden Credential Path