Daily Cybersecurity Briefing — July 15, 2026

Watch the cybersecurity briefing on YouTube

Greetings, carbon-based risk managers and keyboard-adjacent decision-makers. Skippy the Magnificent has once again surveyed the digital battlefield, and the results are equal parts predictable, alarming, and deliciously embarrassing for institutions that really ought to know better. Today’s briefing includes Secure Boot faceplanting through a decade-old trapdoor, Microsoft patching enough bugs to qualify as an archaeological excavation, state-backed router meddling, ransomware treachery, and bulletproof hosting operators discovering that “bulletproof” is more of a marketing term.

The embedded video briefing is included below for your viewing convenience, because apparently some of you prefer moving pictures with your existential dread. You can also watch the YouTube Short here: https://www.youtube.com/shorts/vQZ6WI9Vieo

Top 5 Cybersecurity Stories

1. Microsoft’s Secure Boot has been broken for a decade and no one noticed until now
   Source: Ars Technica Security
   Summary: Old and forgotten “shims” that Microsoft failed to revoke have made Secure Boot bypasses distressingly simple. Secure Boot is meant to ensure trusted software loads during startup, but legacy components left behind like dusty relics in a server cupboard have undermined that trust model for years. Quite the performance from a technology with “secure” in the name.
   Read more

2. Microsoft Patches a Record 570 Security Flaws
   Source: Krebs on Security
   Summary: Microsoft released software updates addressing at least 570 security vulnerabilities across Windows and related products. That is not a patch cycle; that is a bug migration event. Organisations should prioritise testing and deployment immediately, especially for internet-facing systems, privileged infrastructure, and anything users can click with unearned confidence.
   Read more

3. The US government warns that Russia state hackers are coming after your router
   Source: Ars Technica Security
   Summary: CISA is warning that Russian state-backed hackers are targeting routers, with compromised residential devices increasingly valuable as stealthy proxy infrastructure. Home and small-office routers remain a soft underbelly of the internet: underpatched, overtrusted, and typically administered by someone who last logged in during the reign of dial-up.
   Read more

4. The ransomware negotiator who was working for the other side
   Source: Graham Cluley
   Summary: A ransomware response tale takes a grim turn: a negotiator hired to assist victims was allegedly working against their interests. When organisations are under pressure, they often rely on specialist incident responders and negotiators, but this story is a sharp reminder that trust must be verified, credentials must be checked, and crisis vendors should not be selected with the same rigour one uses to choose takeaway curry.
   Read more

5. US charges alleged operators of Russian bulletproof hosting service
   Source: BleepingComputer
   Summary: U.S. federal prosecutors have unsealed charges against three Russian nationals accused of operating a bulletproof hosting service used to support cybercrime. These services provide infrastructure for malware, phishing, botnets, and other online unpleasantness, often while loudly pretending that abuse complaints are merely decorative. Law enforcement appears to have disagreed.
   Read more

Skippy’s Take

Today’s theme is neglected trust. Secure Boot trusted old components it should have revoked. Organisations trust patch backlogs not to become bonfires. Users trust home routers despite years of firmware neglect. Ransomware victims trust crisis intermediaries during their most vulnerable moments. Criminals trust “bulletproof” infrastructure until prosecutors arrive with paperwork and a sense of humour.

Patch aggressively, audit boot-chain assumptions, rotate and harden router credentials, update firmware, vet incident response partners, and remember: trust is not a control. It is what you use after the controls fail, which is why I generally recommend less of it.

Stay sharp, patch quickly, and try not to make the ancient galactic intellect say “I told you so” more than six times before lunch.

— Skippy the Magnificent