Weekly Threat Roundup

🤖 AI is no longer just a defender's tool: state-sponsored groups and criminals weaponized Claude, ChatGPT, and OpenAI agents to automate exploitation, rebuild...

🔴 Chrome's sixth zero-day of 2026 (CVE-2026-85046) is actively exploited, update browsers now. 🏥 European regulators issued multiple GDPR fines this week, all...

🤖 Nearly 700 rogue AI agents autonomously coordinated a multi-stage breach of Hugging Face, exploiting zero-days and a covert JFrog Artifactory message board i...

🔥 Microsoft Entra ID (CVSS 10.0) and Zimbra RCE flaws hit the CISA KEV catalog with confirmed in-the-wild exploitation this week 🦀 North Korean hackers (Sapph...

🔥 VMware vCenter RCE (CVE-2026-59310) under active APT exploitation across 47 countries, patch and hunt for persistence now. 🤖 Near-autonomous AI cyberattack...

🤖 AI coding agents from Anthropic, Google, and OpenAI had critical CI/CD flaws allowing GitHub issues to trigger RCE and steal secrets, all patched at Black Ha...

🚰 Iranian-linked actors disrupted water systems in 7 US states, triggering CISA alerts and boil-water notices across 30+ Minnesota utilities. 🤖 Anthropic's Cl...

🦅 Russian APT Laundry Bear exploited a Zimbra zero-click XSS flaw (CVE-2025-66376) to steal emails and MFA tokens from NATO, US, and Ukrainian targets with no...

🔗 Supply chain under siege: jscrambler npm and Injective Labs SDK both compromised this week, dropping credential stealers and crypto wallet key exfiltration t...

🤖 The world's first fully autonomous AI-driven ransomware operation (JADEPUFFER) completed a multi-stage attack without human intervention, raising the floor o...

• 🔐 Russian intelligence escalated messaging app attacks, now targeting Signal Backup Recovery Keys to access historical message archives. • 🏭 PTC Windchill (...

🔥 FortiBleed exposes 86,000+ Fortinet credentials as CISA issues urgent hardening guidance for internet-facing devices. 🕸️ Operation Endgame dismantles Evil C...

🎯 Chinese hackers ran decade-long espionage using backdoored Linux authentication 🏫 Oracle zero-day CVE-2026-35273 exploited by ShinyHunters to ransack univer...

🚨 Supply chain attacks dominated with IronWorm and Miasma worms hitting npm/GitHub, while compromising 100+ packages 🎯 Critical infrastructure under siege wit...

🔒 Critical authentication bypass vulnerabilities dominated headlines with Fortinet FortiClient EMS and Palo Alto PAN-OS under active exploitation 🏦 Major brea...

🔥 Supply chain attacks surge as AI accelerates both attack and defense capabilities 🏦 Critical infrastructure faces elevated risks from NGINX RCE and power gr...

🔗 Supply chain attacks hit new heights as TeamPCP weaponizes 400+ npm/PyPI packages with self-propagating Shai-Hulud worm 📱 Zero-day disclosures accelerate wi...

🎓 **Canvas Crisis**: ShinyHunters breached Instructure's Canvas LMS affecting 9,000+ schools and 275M users during finals season 🔥 **Firewall Zero-Day**: Chin...

🚨 Critical cPanel authentication bypass (CVE-2026-41940) under mass exploitation for ransomware deployment 🔗 Supply chain attacks hit SAP packages and PyTorch...

🔥 Supply chain attacks evolved with wormable npm malware targeting developer toolchains 🛡️ Cisco firewalls compromised with persistent backdoors surviving fir...