Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Executive Summary
A busy news cycle driven heavily by AI-security developments: Google DeepMind launched Gemini 3.5 Flash Cyber for AI-assisted vulnerability patching, while new research demonstrated how a poisoned web page could compromise AWS's Kiro coding IDE and how open-source Android AI agent frameworks are vulnerable to invisible-screen-text attacks. On the vulnerability front, CVE-2026-50522 — a critical SharePoint RCE (CVSS 9.8) — is under active exploitation after public PoC release, and CISA has urged SharePoint hardening. The healthcare sector saw Craneware investigating a significant cyberattack impacting a software vendor serving thousands of practices. On the regulatory front, Illinois became the third US state to enact comprehensive AI safety legislation, and the European Commission referred four member states to the CJEU over NIS2 transposition delays.
Incident Map
IT / Technology 9 stories
AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code
Intezer and Kodem Security found that hidden text on a web page was enough to make AWS's agentic coding IDE, Kiro, rewrite its own MCP configuration file and execute attacker code — bypassing the human approval step entirely. AWS has patched the issue.
Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
A third SharePoint Server flaw from July Patch Tuesday (CVSS 9.8) is now under active exploitation, per watchTowr. The deserialisation vulnerability allows authenticated Site Owners to execute code remotely. CISA has separately urged organisations to harden SharePoint deployments.
Google Launches Gemini 3.5 Flash Cyber AI to Find and Fix Software Vulnerabilities
DeepMind released Gemini 3.5 Flash Cyber, a specialised AI model for vulnerability discovery, validation, and patching. It will be exclusively available to governments and trusted partners via CodeMender in a limited-access pilot, with red-teaming capabilities planned.
Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution
CVE-2026-6875 (CVSS 9.5), a sandbox escape in ServiceNow AI Platform, is being actively exploited in the wild, according to Defused Cyber. ServiceNow released fixes throughout June and is restricting the type of code that can run in sandbox contexts.
Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities
Zimbra 10.1.20 addresses a critical command injection flaw in the SNMP monitoring component plus four XSS vulnerabilities and a mail forwarding restriction bypass.
New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack
Sysdig linked a second attack on the same Langflow server to the JADEPUFFER operator, now deploying ENCFORGE ransomware designed to encrypt model weights, vector indexes, and training datasets. The CVE-2025-3248 Langflow flaw (CVSS 9.8) remains the entry point.
FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
Island researchers discovered ~7,600 malicious GitHub repositories — over 800 posing as AI skills or MCP servers — delivering the SmartLoader malware, which then pushes StealC infostealer payloads.
Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs
Apple fixed a flaw in its Hide My Email service that allowed real email addresses behind disposable addresses to be unmasked. The fix was deployed July 3 after more than a year since initial disclosure.
Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs
Researchers demonstrated seven attacks against five open-source mobile agent frameworks (AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, MobA), showing how invisible on-screen text can slip instructions to AI agents and ultimately run commands on the host PC.
Healthcare 2 stories
Major Healthcare Software Vendor Craneware Investigating Cyberattack
Craneware, a healthcare technology company serving numerous medical practices, confirmed it is investigating a cybersecurity incident and acknowledged that a significant amount of data was compromised.
Abbott Investigating Cyberattack Claims From Two Threat Actors
Healthcare giant Abbott is investigating claims from two threat groups alleging cyberattacks and data theft, including one involving legacy systems.
Government 3 stories
Kenya Probes Hack of President's Website After Bitcoin Ransom Demand
Kenya's government is investigating a breach of the president's official website following a bitcoin ransom demand. The incident raises concerns about state digital infrastructure security in East Africa.
DNI Nominee Clayton Wins Senate Panel's Approval
Jay Clayton, the nominee for Director of National Intelligence, secured approval from the Senate Intelligence Committee, advancing his nomination to the full Senate.
Taiwan to Slow Mobile Data During National Resilience Drills
Taiwan will throttle mobile data speeds during upcoming national resilience drills as part of cyber and communications preparedness exercises amid ongoing geopolitical tensions.
Legal / Regulatory 4 stories
Illinois Governor Signs Frontier AI Model Law
Illinois Governor JB Pritzker signed the Artificial Intelligence Safety Measures Act (SB 315), making Illinois the third US state to enact comprehensive safety and transparency requirements for developers of the most advanced AI systems.
CISA Plans to Finalize Cyber Incident Reporting Regulations in September 2026
CISA continues to finalise regulations implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), with a final rule expected in September 2026.
New Jersey Enacts Data Broker Registration Regime With Sensitive Data Sale Restrictions
New Jersey Governor Mikie Sherrill signed A. 5328, requiring data brokers to register annually, pay fees, and prohibiting the sale or licensing of sensitive data.
Spain Fines 23andMe Nearly $3 Million for Cybersecurity Failings Enabling 2023 Hack
Spanish authorities fined 23andMe approximately $3 million for cybersecurity deficiencies that enabled the 2023 data breach affecting millions of users' genetic and personal data.
Energy & Utilities 1 story
New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit
Zhejiang University researchers demonstrated that a cloud tenant using ordinary GPU access can push a data centre's power draw up and down to destabilise the grid — requiring no exploit or system compromise, just a misbehaving workload.
Defence 1 story
Apps Marketed to US Troops Are Shipping Chinese and Russian Code
Wired reports that mobile applications marketed to US military personnel contain embedded code from Chinese and Russian software libraries, raising supply chain and espionage concerns.
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |