ESET researchers found that Microsoft’s Secure Boot has been vulnerable for most of its 14‑year life because outdated shim binaries, signed by Microsoft, were never revoked. Those shims let attackers defeat firmware protection on Windows and Linux machines, leaving a massive fleet exposed to boot‑time malware.
An unauthenticated attacker can send a crafted DHCPv6 REQUEST to OpenWrt’s odhcpd service, overwriting a 512‑byte stack buffer and gaining root code execution on routers. The flaw (CVE‑2026‑53921, CVSS 9.8) is fixed in the 25.12.5 service release, so timely updates are essential.
The Wiz team discovered CosmosEscape, a flaw in Azure Cosmos DB’s Gremlin API that exposed a platform‑wide master key, letting any attacker retrieve the primary key of any Cosmos DB account. Microsoft patched the issue and eliminated the master key, reporting no evidence of customer impact.
A remote code execution flaw (CVE‑2026‑60004, CVSS 9.8) let any user with write permission inject a malicious Git hook that runs arbitrary shell commands as the Gitea service account. It affected Gitea 1.17+ up to 1.27.0. The issue is patched in the 1.27.1 release.
Amazon Threat Intelligence links the compromise of popular NPM packages, axios, debug, chalk, typo‑crypto, to a DPRK‑affiliated actor tracked as SAPPHIRE SLEET/BlueNoroff. The group coerces trusted maintainers to push malicious updates, exposing every downstream user. AWS now offers tools to detect and respond to such supply‑chain threats.
A US citizen was charged for using GrapheneOS’ duress password that wiped his phone when asked to unlock it for border officials. The case spotlights the clash between border search powers and digital privacy rights, raising constitutional questions about device protection at the border.
A new benchmark, CryptanalysisBench, tests LLMs on real-world cryptanalysis. Anthropic’s frontier model discovered novel attacks on historic ciphers, proving AI can now contribute to cryptographic research. The results suggest AI may soon rival human experts in finding flaws that underpin digital security.
You’re caught up.
That was all 7 stories in the 30 July issue.