COGNOSCERE Daily Tech Review — Issue T179 · Thursday, July 16, 2026

Or visit Intelligence Overview for deeper analysis.

ACTSonicWall Warns of SMA1000 Flaws Exploited in Zero-Day Attacks

SonicWall disclosed two actively exploited vulnerabilities in its SMA1000 appliances: a critical CVSS 10 SSRF flaw (CVE-2026-15409) in the Appliance Work Place interface allowing unauthenticated remote code execution, and a high-severity code injection vulnerability (CVE-2026-15410) in the Appliance Management Console. Organizations running SMA1000 should apply patches immediately and audit remote-access appliances for signs of compromise.

Infosecurity Magazine · Cybersecurity · Relevance: 0.9 · Source →

zero-day, remote-access, SSRF, RCE, network-security, VPN, enterprise-security

ACTMicrosoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity

Microsoft's threat intelligence published a report detailing how ShinyHunters conducted a year-long campaign against Salesforce environments using three OAuth-based attack pathways — including compromised integrations like Salesloft, Gainsight, and Klue — to exfiltrate CRM data while blending with legitimate API traffic. Microsoft and Salesforce have expanded telemetry, published hunting queries, and added risk-scored visibility into connected OAuth apps to help defenders detect over-privileged or unusually active integrations.

The Hacker News · Cybersecurity & Threat Intelligence · Relevance: 0.9 · Source →

OAuth-abuse, CRM-security, threat-intelligence, supply-chain-attack, SaaS-security, enterprise-security, data-exfiltration

PREPAREMicrosoft Entra ID Security Updates: Passkeys Are the Default Authentication Method in Entra ID

Starting September 1, 2026, Microsoft will auto-enroll Entra ID users currently on SMS or voice MFA into passkeys, and will retire Microsoft-provided SMS/voice authentication entirely on February 1, 2027. Organizations that require legacy telephony methods for compliance will need to contract third-party telecom providers through the Microsoft Security Store by October 30, 2026.

Microsoft Security Blog · Identity & Access Management · Relevance: 0.9 · Source →

passkeys, MFA, identity-management, phishing-resistance, enterprise-IT, authentication, zero-trust

PREPARENew York Becomes First State to Impose Statewide Moratorium on Hyperscale Data Centers

Governor Kathy Hochul signed an executive order creating the nation's first statewide moratorium on new hyperscale data centers (≥50 MW), pausing state environmental permits for up to one year while regulators develop standards covering energy demand, water use, grid impact, and community investment requirements. Projects already approved are exempt, but the order also initiates repeal of sales tax exemptions for large data centers and creates a Community Investment Framework within 60 days.

Office of Governor Kathy Hochul · Data Infrastructure & Policy · Relevance: 0.9 · Source →

data-center, AI-infrastructure, state-regulation, energy-policy, moratorium, cloud-computing, environmental

PREPAREApple Former Employee Exploited 'Rare' Bug to Download Confidential Files After Leaving for OpenAI

Apple alleges a former employee exploited an authentication flaw to access its internal network and download confidential hardware files weeks after joining OpenAI, raising serious concerns about offboarding processes, retained device access, and lingering authentication tokens. Apple has since patched the vulnerability, and the incident underlies the broader Apple vs. OpenAI trade secrets litigation.

TechCrunch · Cybersecurity & Insider Threats · Relevance: 0.9 · Source →

insider-threat, data-exfiltration, offboarding, trade-secrets, authentication, enterprise-security, litigation

PREPAREDemis Hassabis Calls for U.S.-Led AI Safety Watchdog to Screen Frontier Models Before Release

Google DeepMind CEO Demis Hassabis publicly proposed a FINRA-style, US-led independent oversight body that would safety-test frontier AI models for deception, bioweapons, and hacking capabilities 30 days before public release, with the goal of having it operational by year-end. Hassabis told Axios that open-source capabilities could enter dangerous territory within 18 months, and said the body should have authority to coordinate a slowdown among frontier labs if deemed necessary.

Financial Times · AI Regulation & Governance · Relevance: 0.9 · Source →

AI-governance, AI-regulation, frontier-AI, AI-safety, US-policy, watchdog, open-source-AI

PREPAREFinance Agents

Anthropic released ten ready-to-run agent templates for financial services workflows — including pitch building, KYC screening, month-end close, and valuation review — deployable as plugins in Claude Cowork, Claude Code, or as autonomous Claude Managed Agents. The agents connect in real-time to major financial data platforms (FactSet, S&P Capital IQ, PitchBook, Morningstar, LSEG) and run on enterprise-grade controls including audit logs and ISO/IEC 42001:2023 certification.

Anthropic · Enterprise AI Adoption · Relevance: 0.9 · Source →

agentic-AI, financial-services, enterprise-AI, KYC, workflow-automation, Claude, Wall-Street

PREPAREEU Action Plan on Cybersecurity and AI Sets Coordinated Framework Ahead of August 2026 Full AI Act Applicability

The European Commission released a July 2026 action plan coordinating cybersecurity and AI resilience across member states, launching a call to increase EU evaluation capacity for AI models before market placement — expected operational by 2027 — and creating a blueprint with ENISA to secure access to advanced AI systems. The plan arrives as the EU AI Act moves toward full applicability on August 2, 2026, with high-risk system obligations for embedded products extended to December 2027 under the recently adopted AI Omnibus regulation.

European Commission · AI Regulation & Governance · Relevance: 0.9 · Source →

EU-AI-Act, AI-regulation, cybersecurity-policy, GPAI, compliance, enterprise-AI, regulatory

WATCHGPT-Red: Unlocking Self-Improvement for Robustness

OpenAI unveiled GPT-Red, an internal automated red-teaming model trained via self-play reinforcement learning to discover prompt injection vulnerabilities at scale, achieving an 84% attack success rate versus 13% for human red-teamers on the same scenarios. GPT-Red was used to adversarially train GPT-5.6, reducing failures on OpenAI's hardest prompt injection benchmarks by approximately 6x and discovering a novel 'fake chain-of-thought' attack class not previously identified by human researchers.

OpenAI · AI Safety & Alignment · Relevance: 0.9 · Source →

AI-safety, red-teaming, prompt-injection, agentic-AI, model-robustness, self-play, enterprise-AI

WATCHDeepSeek in Talks to Raise $1.5B at $71B Valuation Ahead of Planned IPO

Chinese AI startup DeepSeek is exploring a second funding round of approximately $1.5B targeting a $71B pre-money valuation — up 42% from its $52B first-round valuation just one month prior — backed by Tencent, CATL, and Beijing's national AI fund, with an IPO filing possible as early as late 2026 on China's STAR Market. The rapid capital-raising reflects plans to build gigawatt-scale data centers, develop in-house AI inference chips, and expand agentic AI products, as the company already accounts for nearly 23% of enterprise AI gateway token volume on Vercel.

TechCrunch · AI Industry & Funding · Relevance: 0.9 · Source →

AI-funding, IPO, China-AI, open-source-AI, enterprise-AI, compute, geopolitics

PREPARE1Password Moves Into AI Cost Management, Betting That Token Spend Is the Next Enterprise Budget Crisis

1Password is launching 'AI Spend,' a governance module that discovers shadow AI tools, tracks token usage across teams, attributes spending to cost centers, and flags budget overruns — framing AI token consumption as the next category of uncontrolled cloud-like spend that IT and finance teams urgently need to govern. The move signals a broader market shift as agentic workflows and autonomous AI systems make token burn rates a strategic financial concern comparable to cloud infrastructure costs.

VentureBeat · Decision Frameworks & Risk Technology · Relevance: 0.8 · Source →

AI-governance, cost-management, shadow-AI, enterprise-AI, FinOps, agentic-AI, IT-budgeting