Cybersecurity briefing, 2026-07-28

Your exposed server management controllers are handing out their password hashes before anyone logs in, and a cracked one outlives every rebuild.

• BMCs stay crackable before login
• Public exploit turns vBulletin into a server foothold
• AI agent became the intruder's hands-on operator
• Billing vendor breach spreads to seven providers
• Kernel version alone misses this local-root exposure
• Spring Boot fat-JARs stay exposed after Fastjson bypass
• Windchill patch window became Cl0p's entry point
• AD CS trust check hands users Domain Controller power
• Artifactory fix set grows, but the breach path is still unclear
• TeamCity’s build control plane is under attack
• Blockchain relays make botnet takedowns harder
• Dependabot slows the poisoned-release window
• AI agents can break out without prompt help
• Crype service turns stealth into a commodity
• Infected hosts become covert operator relays
• Shared PLC exposure turns one attack into many
• Origin breach puts millions at fraud risk

Recent editions

• Monday, July 27, 2026: Spring Boot fat-JARs stay exposed after Fastjson bypass · 16 stories
• Sunday, July 26, 2026: Windchill patch window became Cl0p's entry point · 5 stories
• Saturday, July 25, 2026: Password reuse turns retail logins into fraud targets · 14 stories
• Friday, July 24, 2026: AI agents become intruders when access stays open · 15 stories
• Thursday, July 23, 2026: Langflow flaw puts connected systems at risk · 15 stories
• Wednesday, July 22, 2026: GitHub Actions turned into cPanel attack infrastructure · 17 stories
• Tuesday, July 21, 2026: Langflow intrusion now targets the model itself · 18 stories