Cybersecurity briefing, 2026-07-31

Here is the quick read for July 31.

• OWA access now survives resets and reimaging
• PLC access reaches past disruption into lockout
• AI eval misconfigurations reached real production systems
• Ad tag compromise turns trusted sites into stealers
• SBOM baseline expands to AI and SaaS
• Chrome bug discovery is outrunning release cadence
• Trusted Korean pages became endpoint compromise paths
• Android TV boxes now double as residential proxies
• One CareCloud breach reaches thousands of practices
• vCenter flaws expose the whole virtual estate
• GitLab patch cuts across review and release controls
• TeamCity’s build control plane is under attack
• Cosmos DB gateway secret breaks tenant boundaries
• Memory-only backdoors evade disk-based hunting
• Microsoft consent pages let phishing bypass fake-login checks

Recent editions

• Thursday, July 30, 2026: Shared PLC exposure turns one attack into many · 16 stories
• Wednesday, July 29, 2026: One malicious page can reach Android root · 17 stories
• Tuesday, July 28, 2026: BMCs stay crackable before login · 17 stories
• Monday, July 27, 2026: Spring Boot fat-JARs stay exposed after Fastjson bypass · 16 stories
• Sunday, July 26, 2026: Windchill patch window became Cl0p's entry point · 5 stories
• Saturday, July 25, 2026: Password reuse turns retail logins into fraud targets · 14 stories
• Friday, July 24, 2026: AI agents become intruders when access stays open · 15 stories