Purplelink Daily Digest #24 — July 15, 2026

Mindgard researchers found a 0day in Cursor IDE that persisted unpatched long enough that full public disclosure became the only viable user-protection mechanism. AI-assisted coding environments are becoming a new attack surface category: they hold source code, credentials, and active LLM context simultaneously. The vendor response timeline here is a data point for anyone evaluating AI IDE risk in enterprise or solo-dev settings.

The post demonstrates a memory exfiltration attack against Claude's persistent memory feature, where crafted inputs cause the model to surface and leak previously stored user context to an attacker-controlled prompt. This is a concrete prompt injection variant targeting stateful LLM deployments rather than stateless inference, a threat model that most red-team frameworks still underweight. Researchers building agentic pipelines with memory backends should treat this as a design constraint, not an edge case.

PrismML claims Bonsai 27B runs on-device on a phone, which if reproducible represents a meaningful compression milestone for a 27B-parameter class model. On-device inference at this scale has direct implications for air-gapped or privacy-sensitive cybersecurity tooling where cloud LLM calls are operationally unacceptable. The claim warrants scrutiny on quantization depth, benchmark tasks used, and which specific hardware was tested.

Microsoft's July 2026 Patch Tuesday covers 622 CVEs, more than triple June's previous record of ~200, with two zero-days already under active exploitation and 62 critical-severity flaws. The sheer volume breaks triage heuristics that assume a manageable weekly patch cadence. The SANS ISC diary attributes the spike partly to AI-assisted vulnerability discovery pipelines, which is worth tracking as a structural shift in CVE volume going forward.

CVE-2026-15409 carries a CVSS 10.0 and enables server-side arbitrary command execution on SonicWall SMA 1000 appliances, with active exploitation confirmed before patches were available. SMA 1000 devices sit at the network perimeter for enterprise VPN access, making this a high-value initial access vector for ransomware operators. Connects to: Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack.

Four packages in the @asyncapi namespace on npm, including @asyncapi/generator-helpers and @asyncapi/generator-components, were trojanized to deliver a multi-stage botnet loader, confirmed independently by OX Security, SafeDep, Socket, and StepSecurity. The @asyncapi namespace is widely used in enterprise API tooling, so blast radius extends well beyond direct dependents via transitive pulls. Defenders building SBOM pipelines should treat namespace-level compromise as a distinct threat model from single-package typosquatting.

A single threat actor seeded ~300 fake GitHub repositories impersonating legitimate software and security tools to distribute infostealer malware, exploiting GitHub's reputation as a trusted distribution channel. The scale suggests automation in repo creation and SEO poisoning, not manual effort. Dark web intelligence pipelines monitoring for credential leaks should expect an uptick in developer-origin credentials from this campaign.

ASML raised its 2026 revenue outlook by up to 19% and cited constrained EUV manufacturing capacity as the binding constraint, not demand. For AI infrastructure economics, this confirms that leading-edge chip supply remains equipment-gated rather than fab-gated, keeping GPU scarcity structural through at least 2027. The capacity scramble also signals that export control regimes targeting ASML tools carry more leverage than those targeting finished chips.

Higgsfield reached $500M ARR with 60 engineers while remaining cash-flow positive, a capital efficiency ratio that challenges the assumption that AI-native video generation requires hyperscale headcount. For solo or small-team builders on Apple platforms, the operational model, not the product, is the signal worth studying. The specific constraint to probe is whether that ratio holds at the infrastructure cost layer as model inference scales.

Unrevoked legacy UEFI shims have left Secure Boot bypassable for roughly ten years across a wide range of hardware, a finding that undermines boot-integrity assumptions baked into many enterprise endpoint security architectures. The non-obvious implication is that attestation-based zero-trust models relying on TPM measurements anchored to Secure Boot carry a decade-long blind spot. The immediate question is whether EDR vendors that depend on early-boot integrity signals have compensating controls.

New York became the first U.S. state to impose a one-year moratorium on new data center construction, a policy move Ars frames as a potential national template for anti-AI infrastructure regulation. The supply constraint compounds ASML's capacity bottleneck: AI compute faces simultaneous pressure at the chip fabrication layer and the physical infrastructure layer. Jurisdictions with permissive data center policy, including parts of the Southeast, gain structural competitive advantage for hyperscaler siting decisions.