Cybersecurity briefing, 2026-07-30

When the sign-in page is genuinely Microsoft's, telling people to spot the fake login protects nothing.

• OWA Access Now Survives Resets and Reimaging
• Shared PLC Exposure Turns One Attack Into Many
• Patch Windows Get Their Own Runtime Guard
• Ad Tag Compromise Turns Trusted Sites Into Stealers
• One Malicious Page Can Reach Android Root
• vCenter Flaws Expose the Whole Virtual Estate
• Lazarus Tradecraft Spills Into South Korea’s Ransomware Scene
• Imported npm Betas Can Hand Over Node Hosts
• Critical Services Need a Disconnected Survival Mode
• AI Agents Can Break Out Without Prompt Help
• WordPress Core Faces Automated Mass Exploitation
• Stolen Files Create Risk Even When Operations Stay Up
• Microsoft Consent Pages Let Phishing Bypass Fake-Login Checks
• PLC Access Reaches Past Disruption Into Lockout
• AI Safety Tests Broke Out Into Live Systems
• A Rehearsed npm Playbook Reached Major Packages

Recent editions

• Wednesday, July 29, 2026: OWA Access Now Survives Resets and Reimaging · 17 stories
• Tuesday, July 28, 2026: BMCs Stay Crackable Before Login · 17 stories
• Monday, July 27, 2026: Spring Boot Fat-JARs Stay Exposed After Fastjson Bypass · 16 stories
• Sunday, July 26, 2026: Spring Boot Fat-JARs Stay Exposed After Fastjson Bypass · 5 stories
• Saturday, July 25, 2026: Spring Boot Fat-JARs Stay Exposed After Fastjson Bypass · 14 stories
• Friday, July 24, 2026: AI Agents Become Intruders When Access Stays Open · 15 stories
• Thursday, July 23, 2026: Langflow flaw puts connected systems at risk · 15 stories