CMMC Phase II suspended, tracking troops in Iran, defenders turn to context bombing - Cybersecurity Headlines

Summary5 min read

Cybersecurity Headlines – July 15, 2026
Host: Rich Stroffelino | CISO Series

Episode Overview

Today’s episode delivers rapid-fire updates on pressing cybersecurity news, including the Pentagon’s sudden suspension of CMMC Phase II requirements, novel attacks and defenses in mobile tracking and AI security, and pivotal product vulnerabilities affecting global organizations. The episode explores not just the threats but evolving defense tactics, regulatory responses, and ongoing challenges for security practitioners.

Key Stories and Insights

1. Pentagon Suspends CMMC Phase 2 Requirements

[00:09]

The Department of Defense (DoD) halted the rollout of the Cybersecurity Maturity Model Certification (CMMC) Phase II, originally set for implementation in November 2026.
Phase II would have mandated third-party compliance checks for ~80,000 companies handling sensitive DoD information, moving beyond the self-reporting allowed by Phase I.
Suspension cited “prohibitive compliance costs and bureaucratic burdens.”
DoD has formed a CMMC reform task force to reassess and potentially reshape the program ahead of the planned 2028 full rollout.
Notable Quote:

“The DoD suspended the rollout, saying it created prohibitive compliance costs and bureaucratic burdens and will instead establish a CMMC reform task force.” – Host [00:38]

2. Targeted Attacks on U.S. Troop Location Data in Iran

[01:05]

Data from the Mobile Surveillance Monitoring Research Project reveals attempts—via SS7 ping requests—to trace the phones and locations of U.S. personnel in the region.
Regional telecoms in the Middle East repelled these tracking attempts, which leveraged roaming agreement loopholes.
Parallel campaigns utilized adtech databases to monitor phones in Iraqi Kurdistan, likely by Iran-linked actors.
This highlights ongoing high sophistication and persistence in state-level espionage and tracking operations.

3. ‘Context Bombing’ – New Defensive Prompt Injection Tactic for LLMs

[02:03]

Researchers at Tracebit unveiled “context bombing,” a defensive technique embedding disruptive prompts within data sets (e.g., cloud buckets) to trip up malicious AI agents (LLMs).
Example: inserting references to “the 1989 Tiananmen Square massacre” among password stores, triggering most LLM agents to deactivate.
In testing across five AI models, this dropped the success of admin access attempts from 57% to just 5%.
Notable Quote:

“They found that by including prompts within cloud buckets, they could effectively disarm adversarial agents trying to access that data.” – Host [02:11]
Memorable aside:

“I wonder who that agent belonged to.” – Host, lightly alluding to government ties [02:23]

4. Old Eufy Apps Exploit Secure Boot Vulnerability

[02:45]

ESET researchers reveal 11 legacy Microsoft-signed UEFI shims able to bypass Secure Boot if systems trust a 2011 certificate authority.
The shims act as trusted chain-of-trust bootloaders; attackers with the right binary can load bootkits even with security checks enabled.
Microsoft revoked the certificates in June 2026 after responsible disclosure.
No new exploits required—just an old, trusted binary and technical knowledge.
Notable Quote:

“No novel exploit is required here, just possession of an old but still trusted shim binary and a basic understanding of how UEFI shims work.” – Host [03:36]

5. US Treasury Sanctions VPN Linked to Ransomware

[04:09]

OFAC sanctioned First VPN Services and its Ukrainian administrator for “selling services to ransomware operators” over the past decade.
First VPN distinguished itself by advertising refusal to cooperate with law enforcement on cybercrime forums.
Victims include U.S. businesses, financial institutions, hospitals, and municipal governments.
Admin allegedly arrested by Europol in May; individual’s name withheld.

6. OAuth Client ID Spoofing Targets Microsoft Entra ID

[04:46]

Proofpoint describes a new technique: attackers use OAuth client ID spoofing to verify stolen credentials at scale—without triggering sign-in security alarms.
Microsoft Entra ID error responses differ with valid/invalid client IDs, letting attackers confirm usernames and passwords surreptitiously.
Campaigns using AWS and Cloudflare infrastructure targeted millions of user accounts, starting in late 2025 and continuing into 2026.
Traditional detection tools that rely on app-specific logging miss these attacks.
Notable Quote:

“Detections built around specific application activity can miss it entirely.” – Host [05:31]

7. LastPass and Bitwarden Users Phished with Fake Security Alerts

[05:44]

Ongoing phishing campaign mimics official LastPass and Bitwarden emails about policy changes.
Victims lured to a fake DocuSign site—as soon as a checkbox is clicked, a malicious file downloads.
LastPass confirms its systems are uncompromised; attacks are external, via email only.
Bitwarden users hit with almost identical tactics.
Bleeping Computer referenced as a major reporting source.

8. Zero-Day in ShareFile Storage Zone Controllers Causes Shutdowns

[06:20]

Progress Software previously urged customers to shut down affected Windows ShareFile servers.
Now confirmed: a high-severity path traversal vulnerability impacts versions 5 and 6.
Patches are available and servers can be safely restarted after patching.
No signs of active exploitation at this stage; a CVE will be published within two weeks.

Memorable Moments and Quotes

On CMMC Reform:

"The DoD suspended the rollout, saying it created prohibitive compliance costs and bureaucratic burdens..." – Host [00:38]
On 'Context Bombing':

"Including prompts within cloud buckets, they could effectively disarm adversarial agents trying to access that data." – Host [02:11] “I wonder who that agent belonged to.” – Host’s aside [02:23]
On Eufy Boot Exploit:

"No novel exploit is required here, just possession of an old but still trusted shim binary..." – Host [03:36]
On OAuth Spoofing:

"Detections built around specific application activity can miss it entirely." – Host [05:31]

Timestamps for Important Segments

CMMC Suspension: 00:09–01:04
Iran/US Troop Tracking: 01:05–02:02
Context Bombing Defense: 02:03–02:45
UEFI Secure Boot Bypass: 02:45–04:08
VPN Ransomware Sanctions: 04:09–04:45
OAuth Client ID Spoofing: 04:46–05:43
Password Manager Phishing Campaign: 05:44–06:19
ShareFile Zero-Day: 06:20–07:08

Useful Takeaways for Security Leaders

Regulatory Rollbacks: Even major compliance regimes like CMMC can be paused under stakeholder pressure—monitor for evolving requirements.
State-Level Threats: Mobile and adtech ecosystem vulnerabilities still facilitate targeted surveillance by adversaries.
AI Security: Defensive prompt injections are an emerging frontier in LLM protection, demonstrating creative disruption potential.
Legacy Risks: Old certificates and binaries remain a weak spot—regularly audit and patch trusted components.
Supply Chain Dangers: Sanctions against upstream services (VPNs) underscore the need for vetting third-party security providers.
Detection Evasion: Attackers’ use of legitimate protocols and error-based techniques (OAuth spoofing) defeat traditional monitoring.

Listeners are encouraged to read more at CISOseries.com for deeper dives on these stories and to register for upcoming cybersecurity events.

Loading summary

Transcript3 lines

[00:00]
A
From the CISO series, it's Cybersecurity Headlines
[00:07]
B
these are the cybersecurity headlines for Wednesday, July 15, 2026. I'm Rich Strofalino. Pentagon Suspends CMMC Phase 2 Requirements the second phase of the Cybersecurity Maturity Model certification, or CMMC, was due to go into effect on November 10, 2026. Phase one of CMMC allowed companies, specifically contractors, to self report their cybersecurity compliance levels. The second phase would require contractors who handle sensitive information for DoD applications to have their compliance checked by an outside company. DoD estimated this would have impacted roughly 80,000 of the at least 220,000 companies participating in the US defense industrial base. CMMC rollout would eventually lead to a phase four rollout in 2028 that would require all contractors and subcontractors to maintain compliance. The DoD suspended the rollout, saying it created prohibitive compliance costs and bureaucratic burdens and will instead establish a CMMC reform task force to conduct a review of the program. U.S. troop location data under Attack in Iran According to data from the Mobile Surveillance Monitoring Research Project seen by the Financial Times, several regional telecom networks in the Middle east fended off a wave of SS7 ping requests that were seeking to track down the location of specific phones roaming outside of home networks. These were reportedly attempts to exploit provisions in roaming agreements with local phone providers to locate U.S. personnel. Based on the point of origin and nature of the SS7 pings, these appear to be highly targeted. This doesn't appear to be an isolated attempt to track movements either, a second source said they believe threat actors linked to Iran abused adtech databases to track phones in Iraqi Kurdistan. Context Bombing Flips the Script on prompt Injections Researchers at tracebit released details about a new defensive use of prompt injections called context bombing. They found that by including prompts within cloud buckets, they could effectively disarm adversarial agents trying to access that data. This is done by including prompts that ask the LLM to perform actions that go against agent guardrails. When this happens, the general response for agents is to just shut down. One example was including References to the 1989 Tiananmen Square massacre hidden among legitimate passwords and crypto keys. I wonder who that agent belonged to. Testing across five leading AI models, the researchers found that including context bombs like these reduced the rate at which agents gained full account admin access from 57% to just 5%. Old eufy apps can bypass secure boot Researchers at ESET released a report detailing 11 old Microsoft signed unified extensible Firmware interface shims that are able to bypass secure boot on systems that trust the Microsoft Corporation EUFY CA 2011 Third Party EUFY Certificate Authority certificate Regardless of the OS installed, these shims serve as a lightweight bootloader that sits between firmware and the os, with each link in the chain validating the next before the boot completes. These shims can then be used to execute arbitrary boot kits, even with secure boot protections enabled. Microsoft revoked the affected shims in its June 2026 Patch Tuesday update for following Responsible Disclosure back in February. ESET stresses that no novel exploit is required here, just possession of an old but still trusted shim binary and a basic understanding of how UEFY shims work. And now, thanks to Today's episode sponsor ThreatLocker, every security leader is being asked the same question right now. How do we enable innovation without creating unnecessary risk? That's the challenge behind cloud adoption, behind AI, behind automation, and behind every major technology decision. ThreatLocker helps organizations take a zero trust approach to that challenge, giving them greater control over what can execute, what can access their environment, and what users and applications are allowed to do. That's why ThreatLocker is proud to support cybersecurity headlines, because security works best when innovation and control move together. VPN Service sanction for Working with Ransomware the US Treasury's Office of Foreign Asset Control sanctioned First VPN Services and its Ukrainian administrator for allegedly selling services to ransomware operators. While many VPNs offer anonymity services, First VPN advertised itself on online cybercrime forums for over a decade and actively touted its refusal to cooperate with law enforcement. The treasury said that victims of ransomware attacks utilizing First VPN services included US Businesses, financial services companies, hospitals, and municipal governments. Back in May, Europol authorities said they arrested the admin of First VPN but did not name the individual. OAuth client ID spoofing lets attackers validate stolen Entra credentials Researchers at Proofpoint identified a technique called OAuth client ID spoofing that allows attackers to check stolen Microsoft Entra ID credentials at scale without triggering a sign in event that would alert defenders. Because Entra returns different error responses depending on whether a supplied OAuth client ID is valid, attackers can infer valid usernames and correct passwords without ever registering an application. Proofpoint tracked two campaigns using this method. One used over 700,000 spoofed client IDs with AWS infrastructure to target more than a million accounts between January and March 2026, while a second used Cloudflare infrastructure and 3.7 million randomized spoofed IDs to hit over 2 million users beginning in December 2025. Because spoofed client IDs do not include an application name in the sign in log, detections built around specific application activity can miss it entirely. LastPass and Bit Warden users hit with fake security alerts LastPass began warning users about a phishing campaign that sends emails resembling legitimate corporate communications about policy changes. Clicking on a checkbox to review access terms referenced in the email takes the users to an impersonated DocuSign, which attempts to download a malicious file on both Windows and macOS. LastPass confirmed that its systems have not been compromised and that the emails do not originate internally from themselves. Bleeping Computer reports that it saw a similar campaign being spread to Bitwarden users with an almost identical lure Zero Day behind Storage Zones Shutdown earlier this week we covered progress software urging customers to shut down Windows Servers using ShareFile Storage zone controllers to due to a credible external security threat. The company updated customers this week, saying it identified a high severity path traversal vulnerability impacting versions 5 and 6 of the ShareFile storage zone controller. Progress software released, patch versions and servers can be brought back online. Once patched, a CVE for the vulnerability will be published within two weeks. Right now, there's no evidence of any unauthorized access or any active exploitation of this vulnerability. Remember to register for this week's Super Cyber Friday event. Hacking the Shift in Security Work in the last five years, it's not just AI that's changed the game. Where and how we work has fundamentally changed and we're breaking down what that means for the work of security. Register for Super Cyber Friday on our events page@cisoseries.com and if you have some thoughts about the news from today or about the show in general, be sure to reach out to us feedbacksoseries.com we'd love to hear from you. Reporting for the CISO series, I'm Rich Stroffelino, reminding you to have a super sparkly day.
[07:43]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.