Cybersecurity briefing, 2026-07-22

Here is the briefing for July 22.

• GitHub Actions turned into cPanel attack infrastructure
• Langflow intrusion now targets the model itself
• Oracle ERP flaw reaches HR data
• Ransomware extortion now targets recovery itself
• GlobalProtect auth bypass now opens the inside
• Developer IDEs became the supply-chain entry point
• Kratos takedown may expose the wider phishing network
• Vendor breach exposes hospital relationship data
• Microsoft 365 calendars become a durable C2 store
• GeoServer becomes a botnet launch point
• Ubuntu hardening change opens default Desktop to root
• XFS bug lets local users rewrite root files
• AI eval sandboxes became the attack relay
• Lagging ServiceNow instances stay exposed after patch rollout
• Unbound patch shifts priority to DNS resolvers
• Supplier exchange breach reaches Stadler's operations
• AI toolchains become a hidden credential path

Recent editions

• Tuesday, July 21, 2026: Langflow intrusion now targets the model itself · 18 stories
• Monday, July 20, 2026: Overdue patch follows AI-found Sentry command injection · 17 stories
• Sunday, July 19, 2026: 7-Zip fix leaves embedded decoders behind · 7 stories
• Saturday, July 18, 2026: Siemens OT switches can keep root after reboot · 13 stories
• Friday, July 17, 2026: WordPress PoCs leave artifacts as Windmill is hit · 19 stories
• Thursday, July 16, 2026: AsyncAPI imports now trigger malware at load time · 19 stories
• Wednesday, July 15, 2026: Legacy shim revocations leave Secure Boot gaps · 18 stories