Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Incident Map
IT / Technology 9 stories
AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code
Intezer and Kodem Security found that hidden text on a web page was enough to make AWS's agentic coding IDE, Kiro, rewrite its own MCP configuration file and execute attacker code — bypassing the human approval step entirely. AWS has patched the issue.
Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
A third SharePoint Server flaw from July Patch Tuesday (CVSS 9.8) is now under active exploitation, per watchTowr. The deserialisation vulnerability allows authenticated Site Owners to execute code remotely. CISA has separately urged organisations to harden SharePoint deployments.
Google Launches Gemini 3.5 Flash Cyber AI to Find and Fix Software Vulnerabilities
DeepMind released Gemini 3.5 Flash Cyber, a specialised AI model for vulnerability discovery, validation, and patching. It will be exclusively available to governments and trusted partners via CodeMender in a limited-access pilot, with red-teaming capabilities planned.
Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution
CVE-2026-6875 (CVSS 9.5), a sandbox escape in ServiceNow AI Platform, is being actively exploited in the wild, according to Defused Cyber. ServiceNow released fixes throughout June and is restricting the type of code that can run in sandbox contexts.
Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities
Zimbra 10.1.20 addresses a critical command injection flaw in the SNMP monitoring component plus four XSS vulnerabilities and a mail forwarding restriction bypass.
New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack
Sysdig linked a second attack on the same Langflow server to the JADEPUFFER operator, now deploying ENCFORGE ransomware designed to encrypt model weights, vector indexes, and training datasets. The CVE-2025-3248 Langflow flaw (CVSS 9.8) remains the entry point.
FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
Island researchers discovered ~7,600 malicious GitHub repositories — over 800 posing as AI skills or MCP servers — delivering the SmartLoader malware, which then pushes StealC infostealer payloads.
Indicators of compromise · Stealc +1 — 8 shown
ayelife57[.]resthxxp://144[.]31[.]151[.]8/hxxp://31[.]56[.]19[.]29/hxxp://62[.]60[.]226[.]232/hxxp://213[.]176[.]73[.]162/api/hxxp://185[.]10[.]68[.]110/api/7d70e6d7d4fa8d888bd46680aa604dd9f56285dc78c429ac8ab8e4d88266651f3a2f83a62307345bbf273a4292f190636e09110162c7f12a51cb98018c17f27a
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs
Apple fixed a flaw in its Hide My Email service that allowed real email addresses behind disposable addresses to be unmasked. The fix was deployed July 3 after more than a year since initial disclosure.
Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs
Researchers demonstrated seven attacks against five open-source mobile agent frameworks (AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, MobA), showing how invisible on-screen text can slip instructions to AI agents and ultimately run commands on the host PC.
Healthcare 2 stories
Major Healthcare Software Vendor Craneware Investigating Cyberattack
Craneware, a healthcare technology company serving numerous medical practices, confirmed it is investigating a cybersecurity incident and acknowledged that a significant amount of data was compromised.
Abbott Investigating Cyberattack Claims From Two Threat Actors
Healthcare giant Abbott is investigating claims from two threat groups alleging cyberattacks and data theft, including one involving legacy systems.
Government 3 stories
Kenya Probes Hack of President's Website After Bitcoin Ransom Demand
Kenya's government is investigating a breach of the president's official website following a bitcoin ransom demand. The incident raises concerns about state digital infrastructure security in East Africa.
DNI Nominee Clayton Wins Senate Panel's Approval
Jay Clayton, the nominee for Director of National Intelligence, secured approval from the Senate Intelligence Committee, advancing his nomination to the full Senate.
Taiwan to Slow Mobile Data During National Resilience Drills
Taiwan will throttle mobile data speeds during upcoming national resilience drills as part of cyber and communications preparedness exercises amid ongoing geopolitical tensions.
Legal / Regulatory 4 stories
Illinois Governor Signs Frontier AI Model Law
Illinois Governor JB Pritzker signed the Artificial Intelligence Safety Measures Act (SB 315), making Illinois the third US state to enact comprehensive safety and transparency requirements for developers of the most advanced AI systems.
CISA Plans to Finalize Cyber Incident Reporting Regulations in September 2026
CISA continues to finalise regulations implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), with a final rule expected in September 2026.
New Jersey Enacts Data Broker Registration Regime With Sensitive Data Sale Restrictions
New Jersey Governor Mikie Sherrill signed A. 5328, requiring data brokers to register annually, pay fees, and prohibiting the sale or licensing of sensitive data.
Spain Fines 23andMe Nearly $3 Million for Cybersecurity Failings Enabling 2023 Hack
Spanish authorities fined 23andMe approximately $3 million for cybersecurity deficiencies that enabled the 2023 data breach affecting millions of users' genetic and personal data.
Energy & Utilities 1 story
New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit
Zhejiang University researchers demonstrated that a cloud tenant using ordinary GPU access can push a data centre's power draw up and down to destabilise the grid — requiring no exploit or system compromise, just a misbehaving workload.
Defence 1 story
Apps Marketed to US Troops Are Shipping Chinese and Russian Code
Wired reports that mobile applications marketed to US military personnel contain embedded code from Chinese and Russian software libraries, raising supply chain and espionage concerns.
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |
Key to this page
Two pill families appear in the text and they answer different questions. A CVE pill colours severity — a measured CVSS band from the National Vulnerability Database. A threat-actor pill colours attribution confidence — how well-corroborated the naming is, which is a claim rather than a measurement. Both are links: a CVE opens the ATT&CK matrix or its wiki page, an actor opens its wiki page.
CVE identifiers
- CVE-XXXX-NNNNCritical · CVSS 9.0+
- CVE-XXXX-NNNNHigh · CVSS 7.0–8.9
- CVE-XXXX-NNNNMedium · CVSS 4.0–6.9
- CVE-XXXX-NNNNLow · below 4.0
- CVE-XXXX-NNNNNo severity resolved — not the same as low
Threat actors · MITRE ATT&CK
- APT29State attribution stated by MITRE ATT&CK
- ShinyHuntersSelf-declared, or criminal-reporting attribution
- Transparent TribeContested — ATT&CK hedges, or two plausible sponsors
- ZIRCONIUMNo attribution in MITRE ATT&CK
Story signals
- ● Tier 1/4Source reliability — 1 official, 4 leads only
- VerifiedCorroborated by a second source or the principal
- ReportedSingle outlet, or a claim still in progress
- UnverifiedA claim we could not corroborate
- ConfirmedBreach acknowledged by the victim or a regulator
- ProbableBreach indicated but not yet acknowledged
- IOCs · FamilyLive abuse.ch indicators exist for that malware family
A collapsed Indicators of compromise block under a story lists defanged abuse.ch indicator values. The defanging is deliberate — never click, resolve or fetch them. An indicator corroborates a report; it never proves one.
Full methodology, evidence grading and caveats: Methodology & reading guide →