Cybersecurity briefing, 2026-07-16

An old Microsoft-signed boot component you never installed can still walk right past Secure Boot.

• AsyncAPI imports now trigger malware at load time
• Legacy shim revocations leave Secure Boot gaps
• Gold Eagle makes vulnerability triage a federal pipeline
• AI pipeline shortens the path to exploits
• AI agents become identity risk, not just output risk
• 800-account laundering web slows fraud recovery
• LLMs now chain prompts into domain access
• Ransomware now enters through stolen logins
• PLA tightens bid discipline on cyber vendors
• IoT botnet adds fallback control paths
• Trusted metadata lets agents be steered
• Hosting providers face criminal prosecution, not just sanctions
• A fake prompt becomes the password theft point
• Cursor opens the repo, and the repo runs code
• Signed Mac malware turns trust into the bypass
• Lagging ServiceNow instances stay exposed after patch rollout
• Land registry outage freezes property deals
• Tenable Agent flaw can undermine managed fleets
• Next.js adds a monthly security release cadence

Recent editions

• Wednesday, July 15, 2026: Legacy shim revocations leave Secure Boot gaps · 18 stories
• Tuesday, July 14, 2026: Europe turns sanctions on Turla’s support network · 15 stories
• Monday, July 13, 2026: CMS upload paths are becoming server takeovers · 16 stories
• Sunday, July 12, 2026: Classic Web Client XSS puts mail sessions at risk · 6 stories
• Saturday, July 11, 2026: Malicious jscrambler releases kept coming · 16 stories
• Friday, July 10, 2026: Roundcube makes university mail a foothold · 19 stories
• Thursday, July 9, 2026: Routers become shared cover for espionage · 19 stories