A quiet morning, and another that rewards reading the dates. Nothing was newly disclosed on the AI runtimes, the LLM frameworks, the MCP servers, or the .NET, NuGet, and Angular side over the July 9–10 window. What sits at the top of GitHub's feed are two June advisories that only just entered the reviewed set — an audio-processing MCP tool and a Bittensor mining MCP — and one of them has had its fix out for over a month.

Newly reviewed, not newly disclosed

phantom-audio — reviewed July 9, fixed June 1. GHSA-52vm-mxx8-f227 (7.7) covers an audio-processing MCP tool whose file-writing path wasn't confined to a safe directory, so a caller could write or overwrite files outside it, plus a decode-bomb DoS via compressed input. The fix shipped in 1.3.1 on June 1; GitHub pulled the advisory into its reviewed feed yesterday. If you run it, 1.3.1 is the floor — but this is a version check, not news.

gittensory-mcp — narrow reach, no fix. GHSA-382c-vx95-w3p5 (6.5) is a Bittensor mining MCP that lets one authenticated miner read another's revenue figures and hotkey through unguarded REST endpoints. No fixed release, but the exposure is specific to that setup — restrict access to the affected endpoints and watch the advisory for a patch.

Quiet on the .NET, NuGet, Azure, and Angular side — nothing cleared the bar, and July's Patch Tuesday doesn't land until the 14th.