Cybersecurity briefing, 2026-07-27

The AI agent didn't get hacked.

• Spring Boot Fat-JARs Stay Exposed After Fastjson Bypass
• AI Agent Became the Intruder's Hands-On Operator
• Blockchain Relays Make Botnet Takedowns Harder
• Windchill Patch Window Became Cl0p's Entry Point
• AD CS Trust Check Hands Users Domain Controller Power
• LockBit Fell When Its Trust Broke
• Heapdump Scans Can Leak Backend Secrets
• Ransomware Now Kills EDR First
• Billing Vendor Breach Spreads to Seven Providers
• Linux Rootkits Can Lie to Live-Response Tools
• Serv-U Admin Roles Do Not Contain Blast Radius
• Crype service turns stealth into a commodity
• Public Wi‑Fi Gateways Become Cross-Tenant Phishing Points
• Dependency Automation Gets a Time Lock
• Dependabot Slows the Poisoned-Release Window
• Open AI Security Moves Toward Self-Hosted Control

Recent editions

• Sunday, July 26, 2026: Spring Boot Fat-JARs Stay Exposed After Fastjson Bypass · 5 stories
• Saturday, July 25, 2026: Spring Boot Fat-JARs Stay Exposed After Fastjson Bypass · 14 stories
• Friday, July 24, 2026: AI Agents Become Intruders When Access Stays Open · 15 stories
• Thursday, July 23, 2026: Langflow flaw puts connected systems at risk · 15 stories
• Wednesday, July 22, 2026: GitHub Actions Turned into cPanel Attack Infrastructure · 17 stories
• Tuesday, July 21, 2026: Langflow Intrusion Now Targets the Model Itself · 18 stories
• Monday, July 20, 2026: Overdue Patch Follows AI-Found Sentry Command Injection · 17 stories