Cybersecurity briefing, 2026-07-29

Password resets and device wipes no longer evict the attacker when the mailbox itself is the foothold.

• OWA access now survives resets and reimaging
• One malicious page can reach Android root
• Patch windows get their own runtime Guard
• AI agents can break out without prompt help
• Infected hosts become covert operator relays
• Imported npm betas can hand over Node hosts
• Linux botnet turns process kills into reboots
• vCenter flaws expose the whole virtual estate
• Public exploit turns vBulletin into a server foothold
• Spring Boot fat-JARs stay exposed after Fastjson bypass
• Shared PLC exposure turns one attack into many
• TeamCity’s build control plane is under attack
• Ruflo’s default bridge leaves AI memory open
• BMCs stay crackable before login
• Critical services need a disconnected survival mode
• FCC puts new robot and inverter imports at risk
• Public Android RAT builder expands China credential theft

Recent editions

• Tuesday, July 28, 2026: BMCs stay crackable before login · 17 stories
• Monday, July 27, 2026: Spring Boot fat-JARs stay exposed after Fastjson bypass · 16 stories
• Sunday, July 26, 2026: Windchill patch window became Cl0p's entry point · 5 stories
• Saturday, July 25, 2026: Password reuse turns retail logins into fraud targets · 14 stories
• Friday, July 24, 2026: AI agents become intruders when access stays open · 15 stories
• Thursday, July 23, 2026: Langflow flaw puts connected systems at risk · 15 stories
• Wednesday, July 22, 2026: GitHub Actions turned into cPanel attack infrastructure · 17 stories