Cybersecurity briefing, 2026-07-16

An old Microsoft-signed boot component you never installed can still walk right past Secure Boot.

• AsyncAPI Imports Now Trigger Malware at Load Time
• Legacy Shim Revocations Leave Secure Boot Gaps
• Gold Eagle Makes Vulnerability Triage a Federal Pipeline
• AI Pipeline Shortens the Path to Exploits
• AI Agents Become Identity Risk, Not Just Output Risk
• 800-Account Laundering Web Slows Fraud Recovery
• LLMs Now Chain Prompts Into Domain Access
• Ransomware Now Enters Through Stolen Logins
• PLA Tightens Bid Discipline on Cyber Vendors
• IoT Botnet Adds Fallback Control Paths
• Trusted Metadata Lets Agents Be Steered
• Hosting Providers Face Criminal Prosecution, Not Just Sanctions
• A Fake Prompt Becomes the Password Theft Point
• Cursor Opens the Repo, and the Repo Runs Code
• Signed Mac Malware Turns Trust Into the Bypass
• Lagging ServiceNow Instances Stay Exposed After Patch Rollout
• Land Registry Outage Freezes Property Deals
• Tenable Agent Flaw Can Undermine Managed Fleets
• Next.js Adds a Monthly Security Release Cadence

Recent editions

• Wednesday, July 15, 2026: AsyncAPI Imports Now Trigger Malware at Load Time · 18 stories
• Tuesday, July 14, 2026: AsyncAPI Imports Now Trigger Malware at Load Time · 15 stories
• Monday, July 13, 2026: Europe Turns Sanctions on Turla’s Support Network · 16 stories
• Sunday, July 12, 2026: CMS Upload Paths Are Becoming Server Takeovers · 6 stories
• Saturday, July 11, 2026: CMS Upload Paths Are Becoming Server Takeovers · 16 stories
• Friday, July 10, 2026: Roundcube Makes University Mail a Foothold · 19 stories
• Thursday, July 9, 2026: Roundcube Makes University Mail a Foothold · 19 stories