Cybersecurity briefing — 2026-07-16

An old Microsoft-signed boot component you never installed can still walk right past Secure Boot.

• AsyncAPI Imports Now Trigger Malware at Load Time
• Legacy Shim Revocations Leave Secure Boot Gaps
• Gold Eagle Makes Vulnerability Triage a Federal Pipeline
• AI Pipeline Shortens the Path to Exploits
• AI Adoption Surges, Validation Still Lags
• 800-Account Laundering Web Slows Fraud Recovery
• LLMs Now Chain Prompts Into Domain Access
• Ransomware Now Enters Through Stolen Logins
• PLA Tightens Bid Discipline on Cyber Vendors
• IoT Botnet Adds Fallback Control Paths
• Trusted Metadata Lets Agents Be Steered
• Hosting Operators Move From Sanctions to Criminal Case
• A Fake Prompt Becomes the Password Theft Point
• Cursor Opens the Repo, and the Repo Runs Code
• Signed Mac Malware Turns Trust Into the Bypass
• Hosted ServiceNow Instances Already Patched, Self-Hosted Not
• Land Registry Outage Freezes Property Deals
• Tenable Agent Flaw Can Undermine Managed Fleets
• Next.js Adds a Monthly Security Release Cadence