The brief

Tuesday, July 21, 2026

Hugging Face confirms a breach exposing datasets and credentials after attackers exploited platform vulnerabilities. WordPress critical flaws are actively exploited across 90M sites, ServiceNow sandbox RCE is in-the-wild, and Romania's land registry database was wiped via credential compromise.

12 stories · 3 podcasts · get this by email each weekday

Today's stories

How "synthetic insider" attacks raise the stakes for corporate cyber defense; a Verizon analysis of 22K incidents finds 12% were carried out by internal actors (Hannah Murphy/Financial Times)
The EU is about to sell our most sensitive data to the US for visa-free travel
Hugging Face confirms breach affected internal datasets and credentials, urges users to take action
Hacker wipes Romania's land registry database
Hackers stole ‘significant’ amount of data from tech firm relied on by thousands of US hospitals and pharmacies
Pay up or not? Ransomware surge has victims facing tough choices
Hackers are exploiting recently patched WordPress bugs, putting millions of websites at risk
Safety guardrails blocked Hugging Face's defenders, not the attacker, when an AI agent breached its systems
Cybersecurity companies say hackers are exploiting vulnerable WordPress versions to take over websites; WordPress patched two critical security flaws last week (Lorenzo Franceschi-Bicchierai/TechCrunch)
ServiceNow’s sandbox escape RCE hole now exploited in the wild
Researchers found sandbox escapes or boundary bypasses in Cursor, Codex, Gemini CLI, and Antigravity by writing files trusted tools later use; most are patched (Ax Sharma/BleepingComputer)
The EU’s AI transparency deadline is weeks away. Is your enterprise ready?

Worth a listen

Hugging Face's CEO on Open Source AI, Model Routing, and the Future of Competition
Amjad Masad on Going Direct, Building Replit, and the Future of Software
Replay 2025: David Sacks on AI, Crypto, and America's Technology Future

← All editions