-Cyberattack disrupts water utilities in 30+ Minnesota communities
-New Chinese cyber contractor identified
-Denmark readies secondary banking system in case of cyberattacks
-North Korea busts bank hackers
-Cyberattack closes US clinics
-Claude chats leak online
-Bank of Baroda hack in India
-Frontier Airlines had 3 breaches
-Microsoft releases cyber model
-Tech companies launch Open Secure AI Alliance
-Moonshot open-sources Kimi K3

N: https://news.risky.biz/risky-bulletin-new-chinese-cyber-contractor-identified/
P: https://risky.biz/RBNEWS593/

Make that 30+ now:

https://mn.gov/mnit/media/blog/?id=38-761869

The number of Minnesota towns that reported hacks of their water systems is up to four

-Braham: https://dysruptionhub.com/braham-minnesota-water-cyberattack/
-Maple Plain: https://dysruptionhub.com/maple-plain-water-cyber-incident/
-Plymouth: https://dysruptionhub.com/plymouth-minnesota-water-cyberattack/
-St. Paul: https://dysruptionhub.com/south-st-paul-water-cyber-incident/

Pop star Ariana Grande has sued two hackers for stealing and unreleasing unreleased music and studio footage.

The hackers allegedly stole the materials from her photographers and producers.

https://www.tmz.com/2026/07/27/ariana-grande-sues-hackers/

The Danish central bank is building a secondary payment system that will activate in case of a cyberattack that cripples the country's normal banking sector

https://gfmag.com/news/denmark-readies-emergency-reserve-bank/

Binance has changed an internal policy and appears to intentionally delay all law enforcement requests related to scammers and money laundering investigations

https://www.nytimes.com/2026/07/28/us/binance-crypto-crime.html

Hackers are exploiting a CVSS 10 RCE in Arista VeloCloud Orchestrator on-prem servers

https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144

https://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog

The Cloud Security Alliance has released a post-mortem of the OpenAI hack of Hugging Face

HF apparently reviewed and cleared the report

https://cloudsecurityalliance.org/artifacts/hugging-face-ciso-post-mortem

Moonshot AI releases the Kimi K3 model weights and technical report

https://huggingface.co/moonshotai/Kimi-K3

https://github.com/MoonshotAI/Kimi-K3/blob/main/k3_tech_report.pdf

-RCE bug in popular Java JSON library
-Scam compounds expand in Myanmar despite crackdown
-Google has a new APT naming scheme
-Bug lets you swap executable of legitimate macOS apps
-RubyGems API leak
-Kimi lags behind Western cyber models
-Dependabot gets a 3-day cooldown
-Signal disappearing messages now cover calls too
-Social media networks are hiding their data from academics
-US lawmakers propose AI Kill Switch Act

P: https://risky.biz/RBNEWS592/
N: https://news.risky.biz/risky-bulletin-a-json-rce-bug-is-about-to-rock-the-java-world/

The ABC has these cool maps of what scam compounds have been built this year in Myanmar, despite a promised government crackdown

"The scam industry in Myanmar is morphing and heading into the jungle, according to satellite imagery, victim testimony and local investigators."

https://www.abc.net.au/news/2026-07-21/myanmar-scam-compounds-exponential-growth/106603324

XCharge EV charging stations can be hacked via the charging port because the connector apparently runs SSH with root/root as the default creds

https://www.saiflow.com/blog/the-hidden-ccs2-attack-surface-on-ev-chargers