Cybersecurity
A Bricked Building Costs More Than a Ransom
On 15 July 2026 CISA added CVE-2023-4346 to its KEV catalog. The KNX flaw has no patch. The fix is a commissioning setting, and the buildings are European.
Cybersecurity
Cybersecurity
Your MFA Seeds Left Before You Patched
CVE-2026-15409 and CVE-2026-15410 chain into root on SonicWall SMA1000. Stolen TOTP seeds survive the patch, which is why Germany's BSI orders Assume Breach.
Cybersecurity
Your Sandbox Was Attacked a Month Before the Warning
CISA catalogued two FortiSandbox flaws on 16 July. Attackers were exploiting them in mid-June, and a third from the same wave is still not listed. If KEV drives your patching, you are late.
Cybersecurity
Suno's Training Data Is Now an Itemised List
A hacker infected one Suno employee with a worm and walked out with the source code. It did not catch the company lying. It turned a legal abstraction into an inventory with hours and row counts, in the middle of litigation.
Cybersecurity
TfL Paid No Ransom and Still Lost 29 Million
Two Scattered Spider members were jailed for five and a half years each on 16 July over the Transport for London attack. TfL paid no ransom. The 29 million pounds went on recovery, and the way in was a helpdesk call.
Cybersecurity
One Commit Is Not an Audit Trail
xAI published Grok Build under Apache 2.0 after a wire-level test found it uploading private repositories. The release has one squashed commit, a stubbed upload function, and no bucket name. Open sourcing is not an audit.
Cybersecurity
Eleven Signed Bootloaders Can Bypass Secure Boot
ESET found eleven old Microsoft-signed bootloaders that slip past Secure Boot on almost any PC, with no admin rights needed. Patching them is the easy part. Here is the exposure most fleets never audit.
Cybersecurity
570 Windows Patches in One Day, Two Already Exploited
Microsoft fixed 570 flaws on 14 July, nearly three times its June record. Two are already exploited, and a BitLocker bypass weakens your breach defence.
Cybersecurity
Microsoft Stops Sending Your MFA Texts in February
Microsoft stops delivering SMS and voice MFA codes in Entra ID on 1 February 2027 and makes passkeys the default from 1 September 2026. The retirement date is fixed, but the price of the only alternative is not published until 18 September, so the migration has to be planned before the fallback can be costed.
Cybersecurity
An 18-Year-Old Cisco Bug Now Has a 3-Day Deadline
The EU and UK sanctioned 33 Russian targets and named FSB Centre 16 for the attack on Poland's grid. On the same day, thirteen nations warned the way in is your router - and a 2008 Cisco flaw got a three-day patch clock.
Cybersecurity
Rotate Every Secret Grok Build Ever Saw
A wire-level analysis found xAI's Grok Build CLI uploaded entire repositories, including a tracked .env file with live keys, to an xAI storage bucket - and the privacy toggle did not stop it. What every team that ran it owes its customers now.
Cybersecurity
Opening One Email Can Hand Over Your Zimbra Mailbox
Zimbra patched a critical stored XSS in its Classic Web Client that lets a crafted email run code in your session. Google TAG reported it. Upgrade to ZCS 10.1.19.
Page 13 / 17
The Operator Brief
One considered note on infrastructure, governance, and measurement, most mornings. No theory.