Cybersecurity briefing, 2026-07-25

Here is the short read.

• Spring Boot Fat-JARs Stay Exposed After Fastjson Bypass
• Windchill Patch Window Became Cl0p's Entry Point
• Password Reuse Turns Retail Logins Into Fraud Targets
• AD CS Trust Check Hands Users Domain Controller Power
• Edge Appliances Become Ransomware’s Preferred Front Door
• AI Agent Became the Intruder's Hands-On Operator
• Hotel Wi‑Fi Turns into a Corporate Credential Trap
• Redis RESTORE Becomes the Code-Execution Gate
• GitLab Patch Missed the Security Signal
• Corepack Search Trap Steals Dev Credentials
• NodeBB Auth Checks Fail on Alternate Paths
• AI Agents Become Intruders When Access Stays Open
• Supplier Nodes Now Drive Ransomware Outages
• Azure Automation Defaults Cross Tenant Identity Trust

Recent editions

• Friday, July 24, 2026: AI Agents Become Intruders When Access Stays Open · 15 stories
• Thursday, July 23, 2026: Langflow flaw puts connected systems at risk · 15 stories
• Wednesday, July 22, 2026: GitHub Actions Turned into cPanel Attack Infrastructure · 17 stories
• Tuesday, July 21, 2026: Langflow Intrusion Now Targets the Model Itself · 18 stories
• Monday, July 20, 2026: Overdue Patch Follows AI-Found Sentry Command Injection · 17 stories
• Sunday, July 19, 2026: 7-Zip Fix Leaves Embedded Decoders Behind · 7 stories
• Saturday, July 18, 2026: Siemens OT Switches Can Keep Root After Reboot · 13 stories