Cybersecurity briefing, 2026-07-22

Here is the briefing for July 22.

• GitHub Actions Turned into cPanel Attack Infrastructure
• Langflow Intrusion Now Targets the Model Itself
• Oracle ERP Flaw Reaches HR Data
• Ransomware Extortion Now Targets Recovery Itself
• GlobalProtect Auth Bypass Now Opens the Inside
• Developer IDEs Became the Supply-Chain Entry Point
• Kratos Takedown May Expose the Wider Phishing Network
• Vendor Breach Exposes Hospital Relationship Data
• Microsoft 365 Calendars Become a Durable C2 Store
• GeoServer Becomes a Botnet Launch Point
• Ubuntu Hardening Change Opens Default Desktop to Root
• XFS Bug Lets Local Users Rewrite Root Files
• AI Eval Sandboxes Became the Attack Relay
• Lagging ServiceNow Instances Stay Exposed After Patch Rollout
• Debian 13.7 Bakes Old Fixes Into Fresh Media
• Supplier Exchange Breach Reaches Stadler's Operations
• AI Toolchains Become a Hidden Credential Path