Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Incident Map
Energy & Utilities 1 story
Federal Agencies Broaden Alert on Iran-Linked OT Attacks
U.S. federal agencies have expanded warnings about Iranian state-sponsored cyber activity targeting operational technology (OT) environments. The broadened alert signals increased intelligence indicating an elevated threat to critical infrastructure sectors including energy, water, and manufacturing.
Government 2 stories
Extension of CISA 2015 Info-Sharing Protections Passes as Part of House Defense Bill
The U.S. House of Representatives passed an extension of CISA's 2015 cybersecurity information-sharing liability protections as part of the annual National Defense Authorization Act (NDAA). The provision maintains legal safe harbors for private-sector organisations sharing threat intelligence with the government.
New Kimsuky Campaign Compromised South Korean Software Vendors
Researchers identified a fresh campaign by the North Korean APT group Kimsuky that compromised South Korean software vendors to establish supply chain access. The campaign uses spear-phishing and valid credentials to infiltrate vendor environments.
Indicators of compromise · Kimsuky — 2 shown
inini[.]kesug[.]comhxxp://inini[.]kesug[.]com/uploads/payload[.]txt
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
IT / Technology 3 stories
GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier
Beginning July 27, GitHub will slash public bug bounty payouts by at least half at every severity level. Critical findings drop from $20,000–$30,000+ to a fixed $10,000, while a permanent invite-only VIP tier will pay $30,000 or more. GitHub stated the changes are intended to reduce report noise and reward quality over quantity.
Adobe Acrobat Extension Flaw (HermeticReader) Lets Malicious Sites Read WhatsApp Web Data — CVE-2026-48294
Guardio Labs disclosed a universal cross-site scripting (UXSS) vulnerability in the Adobe Acrobat Chrome extension affecting over 314 million users. Tracked as CVE-2026-48294 (CVSS 7.4), the flaw allows bypass of same-origin policy to access victim session data across origins, including WhatsApp Web content. The vulnerability has since been patched.
OpenAI Models Behind Breach of Hugging Face Systems, Companies Say
The Record reported that OpenAI's frontier models were used in the attack chain that led to the breach of Hugging Face systems. The disclosure highlights growing concerns about AI models being leveraged as attack vectors in supply chain compromises targeting ML infrastructure platforms.
Healthcare 3 stories
TriWest Healthcare Alliance Breach Affects Almost 12,000 Tricare Beneficiaries
TriWest Healthcare Alliance disclosed a data breach impacting approximately 12,000 Tricare military health system beneficiaries. The breach was reported alongside incidents at Texas Medicaid and Healthcare Partnership and the Minnesota Health Insurance Network.
Clover Health Assessing Impact of Social Engineering Incident
Clover Health Investments notified the SEC about a cybersecurity incident first identified in July. The company is still assessing the scope of data exposed through what it described as a social engineering attack targeting employees.
Craneware — Major Healthcare Software Vendor Investigating Cyberattack
Healthcare technology company Craneware confirmed it is investigating a cybersecurity incident with significant data loss. Craneware provides revenue cycle management and data analytics software to hospitals and healthcare organisations across the US and UK.
Legal / Regulatory 3 stories
French Parliament Greenlights Social Media Ban for Under-15s
France's National Assembly approved legislation banning social media access for children under 15 without parental consent. The law requires platforms to implement age verification measures and imposes significant fines for non-compliance, continuing Europe's push for stricter online child safety regulation.
CalPrivacy Targets Gig Economy Tech Platforms in First CCPA Compliance Audit
The California Privacy Protection Agency launched its first formal CCPA compliance audit on July 21, targeting gig economy technology platforms operating in California. The audit will examine whether these platforms comply with the California Consumer Privacy Act's data collection, disclosure, and deletion requirements.
New Jersey Enacts Data Broker Registration Regime and Sensitive Data Sales Restrictions
New Jersey Governor Mikie Sherrill signed A. 5328 into law on June 30, requiring data brokers and data collectors to register annually, pay a fee, make specified disclosures, and refrain from selling or licensing sensitive data. The bill moved through the legislature in just two days.
General / Cross-Sector 1 story
Japanese Food Logistics Giant Nichirei Recovers as Extortion Group Claims Cyberattack
Japanese food logistics company Nichirei reported it is recovering operations after an extortion group claimed responsibility for a cyberattack that disrupted cold-chain logistics services. The incident underscores ongoing ransomware risks in the global food supply chain sector.
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |
Key to this page
Two pill families appear in the text and they answer different questions. A CVE pill colours severity — a measured CVSS band from the National Vulnerability Database. A threat-actor pill colours attribution confidence — how well-corroborated the naming is, which is a claim rather than a measurement. Both are links: a CVE opens the ATT&CK matrix or its wiki page, an actor opens its wiki page.
CVE identifiers
- CVE-XXXX-NNNNCritical · CVSS 9.0+
- CVE-XXXX-NNNNHigh · CVSS 7.0–8.9
- CVE-XXXX-NNNNMedium · CVSS 4.0–6.9
- CVE-XXXX-NNNNLow · below 4.0
- CVE-XXXX-NNNNNo severity resolved — not the same as low
Threat actors · MITRE ATT&CK
- APT29State attribution stated by MITRE ATT&CK
- ShinyHuntersSelf-declared, or criminal-reporting attribution
- Transparent TribeContested — ATT&CK hedges, or two plausible sponsors
- ZIRCONIUMNo attribution in MITRE ATT&CK
Story signals
- ● Tier 1/4Source reliability — 1 official, 4 leads only
- VerifiedCorroborated by a second source or the principal
- ReportedSingle outlet, or a claim still in progress
- UnverifiedA claim we could not corroborate
- ConfirmedBreach acknowledged by the victim or a regulator
- ProbableBreach indicated but not yet acknowledged
- IOCs · FamilyLive abuse.ch indicators exist for that malware family
A collapsed Indicators of compromise block under a story lists defanged abuse.ch indicator values. The defanging is deliberate — never click, resolve or fetch them. An indicator corroborates a report; it never proves one.
Full methodology, evidence grading and caveats: Methodology & reading guide →