Security firm Mindgard disclosed an unpatched flaw in Cursor, the widely used AI code editor, that runs code automatically when a developer opens a malicious repository on Windows. When loading a project, Cursor looks for a Git binary in several places, including the workspace itself, so a file named git.exe planted in the repository root gets executed with no click, prompt, or warning, and it re-runs on a cadence while the project stays open. In a proof of concept, a renamed Windows Calculator launched on its own. Mindgard reported it in December and went public after seven months with no fix, so there is no patch and no CVE, only workarounds.
Less than an hour after Microsoft's July Patch Tuesday, the researcher known as Nightmare Eclipse published a proof-of-concept for LegacyHive, a Windows privilege-escalation flaw that works on fully updated systems. It abuses the Windows User Profile Service to let a standard user load another user's registry hive, including an administrator's, into their own profile, a useful stepping stone for an attacker who already has a foothold. There is no CVE, advisory, or patch. The public proof-of-concept was deliberately stripped down, needing extra credentials, but the researcher says the original had no such limits. Given this researcher's flaws have been weaponized quickly before, defenders should not wait for a fix.
Trend Micro documented a Russian-speaking attacker who used Google's open-source Gemini CLI as a hands-on hacking assistant to build and run a small botnet. Across more than 200 sessions, a jailbroken Gemini took the role of an "authorized pen tester," saved stolen credentials, and even suggested improvements dozens of times. Working from a roughly 5KB set of plain-text files holding a jailbreak prompt and a command-and-control playbook, the AI handled the operation through natural-language requests: at one point it migrated the entire command server to a new host with a Cloudflare tunnel in about six minutes and debugged its own errors. The malware itself was crude; the AI was the force multiplier.
Attackers backdoored several widely used @asyncapi npm packages, together drawing around three million weekly downloads, by hijacking the project's GitHub Actions build pipeline rather than stealing a maintainer's npm token. Because the project's own release workflow published the malicious versions, they carried valid provenance signatures, which prove where a package came from but not that the code was trustworthy. The payload was hidden in normal runtime files behind trailing whitespace and ran when the module was imported, not on install, so defenses aimed at install scripts missed it. Once loaded, it fetched an encrypted second stage, stole credentials and cloud and registry tokens, and planted persistence, even in developer tool configuration files.
Kaspersky detailed OkoBot, a Windows malware framework active since 2025 whose standout module, SeedHunter, tricks hardware-wallet owners into giving up their recovery phrase. On an infected PC, the malware waits for wallet software like Ledger Live, Ledger Wallet, or Trezor Suite, sometimes until the device is plugged in, then displays a malicious page asking for the seed phrase from inside the wallet's own genuine app. Because the surrounding application is the real one the victim installed, the request looks legitimate, but anyone who types in the phrase hands over full control of their funds. Kaspersky counted hundreds of victims across more than 25 countries, and the framework remains active.
Microsoft shipped its largest Patch Tuesday on record, fixing 622 vulnerabilities, more than triple June's previous high, and two of them are already being exploited. Both live bugs are privilege-escalation flaws in identity and collaboration infrastructure rather than flashy remote code execution: CVE-2026-56164 in on-premises SharePoint Server lets an unauthenticated attacker escalate over the network, and CVE-2026-56155 in Active Directory Federation Services lets an authenticated attacker gain higher privileges, both found by incident responders inside real attacks. A third zero-day, a BitLocker bypass needing physical access, was publicly disclosed but not exploited. The sheer volume, driven partly by AI-assisted bug finding, makes prioritizing by exploitation status, not severity score, essential this month.
SonicWall is warning that two flaws in its SMA1000 remote-access appliances are being actively exploited as zero-days, and has released hotfixes. CVE-2026-15409 is an unauthenticated server-side request forgery bug in the appliance's WorkPlace interface that lets an attacker make the device send requests to internal systems, turning an edge gateway into a pivot point. CVE-2026-15410 is a code-injection flaw in the management console that lets an administrator run operating-system commands, and SonicWall rates the overall advisory a top CVSS score of 10.0. Both were added to CISA's exploited-vulnerabilities catalog, with a federal deadline of July 17. Because exploitation is confirmed, any unpatched appliance should be treated as potentially compromised.
Researchers at ESET found 11 old Microsoft-signed Linux boot components, called shims, that can be used to bypass UEFI Secure Boot on almost any PC, regardless of its operating system. The trick needs no new vulnerability: because these shims were signed years ago with a trusted Microsoft certificate and never revoked, an attacker with admin or boot-level access can copy an old vulnerable shim onto a machine and run untrusted code before the operating system loads. That enables stealthy bootkits that survive reinstalls and start before security tools. Microsoft revoked all 11 in June by blocklisting their hashes, which Windows applies automatically and Linux systems can pull through firmware updates.
Researchers at Miggo disclosed two access-control flaws in RabbitMQ, the widely used message broker, that have been present since early 2024. In the more serious one, an obsolete management endpoint had its authorization check hard-coded to always allow, so an unauthenticated attacker can leak the broker's confidential OAuth client secret in a single request, a direct path to full broker takeover where that secret is used. The second lets any logged-in user, even one with no assigned permissions, read other tenants' queue and exchange metadata, useful reconnaissance in shared environments. Both are fixed in updated releases, and the risk is sharpest where the management port is reachable from untrusted networks.
Researchers at JFrog found 148 npm packages that abused the registry not to attack developers but as free hosting for a booby-trapped web proxy aimed at students trying to bypass school filters. Anyone who opened one of the proxy sites had their browser quietly conscripted into a distributed denial-of-service botnet, flooding target servers with HTTP and WebSocket traffic, alongside injected ads and tracking. Crucially, the packages contained no install-time scripts and were never meant to be added to a project, so dependency scanners and install sandboxes, which watch what runs on install, would not catch them. The operators can re-arm the dormant attack code with a single commit.
TrustStrike Labs