Cybersecurity briefing, 2026-07-15

Ransomware isn't a malware problem anymore.

• AsyncAPI imports now trigger malware at load time
• Legacy shim revocations leave Secure Boot gaps
• AI pipeline shortens the path to exploits
• Cursor opens the repo, and the repo runs code
• Signed Mac malware turns trust into the bypass
• RabbitMQ secret leak can become broker takeover
• SSH-orchestrated malware keeps swapping payloads
• Malicious jscrambler releases kept coming
• Treasury targets ransomware’s support layer
• Blank Entra logs can hide credential checks
• Caller-ID spoofing platform faces pressure after NCA charges
• Ransomware now enters through stolen logins
• Entra ID makes passkeys the default login path
• IoT botnet adds fallback control paths
• Hosting providers face criminal prosecution, not just sanctions
• Leak-site bluff targets Synopsys and Bosch
• AI agents become identity risk, not just output risk
• DoD delays third-party CMMC checks

Recent editions

• Tuesday, July 14, 2026: Europe turns sanctions on Turla’s support network · 15 stories
• Monday, July 13, 2026: CMS upload paths are becoming server takeovers · 16 stories
• Sunday, July 12, 2026: Classic Web Client XSS puts mail sessions at risk · 6 stories
• Saturday, July 11, 2026: Malicious jscrambler releases kept coming · 16 stories
• Friday, July 10, 2026: Roundcube makes university mail a foothold · 19 stories
• Thursday, July 9, 2026: Routers become shared cover for espionage · 19 stories
• Wednesday, July 8, 2026: Accenture claim extends from code to cloud access · 19 stories