Cybersecurity briefing — 2026-07-29

Here is the short version for today.

• PLC Campaign Spreads Beyond One Utility Outage
• AI Agents Can Break Out Without Prompt Help
• BMCs Stay Crackable Before Login
• Public Exploit Turns vBulletin Into a Server Foothold
• Billing Vendor Breach Spreads to Seven Providers
• Spring Boot Fat-JARs Stay Exposed After Fastjson Bypass
• Windchill Patch Window Became Cl0p's Entry Point
• AD CS Trust Check Hands Users Domain Controller Power
• OpenWrt DHCPv6 Bug Can Hand Over Root
• Infected Hosts Become Covert Operator Relays
• LLMs Now Find New Crypto Flaws Before Launch
• Model Repos Now Behave Like Code in Diffusers
• Origin Breach Puts Millions at Fraud Risk
• Kernel Version Alone Misses This Local-Root Exposure
• Confirmed Theft Extends the Fairlife Ransomware Risk
• Apple Fixes Wide iPhone and iPad Bug Set