🔴 LegacyHive Windows Zero-Day, 🎯 Gemini CLI Botnet, ⚠️ Zoom RCE, 🛡️ Bind Link EDR Evasion, 📋 Russian Cybercrime Charges

The defining story is Google's Gemini CLI running as an autonomous hacking agent. A Russian-speaking actor operated it across more than 200 sessions, had it migrate an entire C2 infrastructure in six minutes from a single prompt, and used it to compromise eight systems at a dental clinic. AI CLI tools are confirmed offensive platforms that compress reconnaissance, deployment, and troubleshooting into one session. Google Gemini CLI Abused as Autonomous Hacking Agent: 'bandcampro' Deploys Botnet Against Dental Clinic

The AsyncAPI npm compromise is the second supply chain incident in three days. An attacker broke a GitHub Actions workflow, not npm credentials, and the malicious packages shipped with legitimate SLSA provenance attestations. Provenance is only as trustworthy as the pipeline that produced it. AsyncAPI npm Supply Chain Compromise: CI/CD Pipeline Hack, 2.25M Weekly Downloads

Zoom patched a CVSS 9.8 account takeover in its Windows client, Nightmare Eclipse released another unpatched Windows LPE, and an unpatched Cursor flaw executes a planted git.exe the moment a repository opens. F5's out-of-band fixes covered a CVSS 9.2 NGINX heap overflow. Disclosure timelines vary widely across vendors, so unpatched third-party software stays a real attack surface.

Watchlist: treat AsyncAPI installs from July 14 through 15 as compromised, rotate credentials, and review CI/CD publish workflows for branch protection gaps.