Cybersecurity briefing, 2026-07-29

Password resets and device wipes no longer evict the attacker when the mailbox itself is the foothold.

• OWA Access Now Survives Resets and Reimaging
• One Malicious Page Can Reach Android Root
• Patch Windows Get Their Own Runtime Guard
• AI Agents Can Break Out Without Prompt Help
• Infected Hosts Become Covert Operator Relays
• Imported npm Betas Can Hand Over Node Hosts
• Linux Botnet Turns Process Kills Into Reboots
• vCenter Flaws Expose the Whole Virtual Estate
• Public Exploit Turns vBulletin Into a Server Foothold
• Spring Boot Fat-JARs Stay Exposed After Fastjson Bypass
• Shared PLC Exposure Turns One Attack Into Many
• TeamCity’s Build Control Plane Is Under Attack
• Ruflo’s Default Bridge Leaves AI Memory Open
• BMCs Stay Crackable Before Login
• Critical Services Need a Disconnected Survival Mode
• FCC Puts New Robot and Inverter Imports at Risk
• Public Android RAT Builder Expands China Credential Theft

Recent editions

• Tuesday, July 28, 2026: BMCs Stay Crackable Before Login · 17 stories
• Monday, July 27, 2026: Spring Boot Fat-JARs Stay Exposed After Fastjson Bypass · 16 stories
• Sunday, July 26, 2026: Spring Boot Fat-JARs Stay Exposed After Fastjson Bypass · 5 stories
• Saturday, July 25, 2026: Spring Boot Fat-JARs Stay Exposed After Fastjson Bypass · 14 stories
• Friday, July 24, 2026: AI Agents Become Intruders When Access Stays Open · 15 stories
• Thursday, July 23, 2026: Langflow flaw puts connected systems at risk · 15 stories
• Wednesday, July 22, 2026: GitHub Actions Turned into cPanel Attack Infrastructure · 17 stories