This Week in Cybersecurity #60

AI Crossed the Threshold: When 89% of an Attack Is Automated and the Gap Between Patch and Exploit Disappears

Good Morning, Security Gang!

Double espresso. This week was historically significant and not in a way that makes defenders comfortable.

James opened the week with ShareFile and closed it with a Russian threat actor using Google Gemini CLI to rebuild live command-and-control infrastructure in real time, with the AI completing 89% of the work autonomously. In between: Microsoft released the largest Patch Tuesday in company history 570 vulnerabilities, three zero-days, two under active exploitation before patches arrived. SonicWall confirmed active exploitation of a CVSS 10.0 SMA vulnerability with no workaround available. SharePoint received an emergency CISA directive to patch or disconnect by end of day. Zoom disclosed a CVSS 9.8 unauthenticated account takeover vulnerability. And a researcher demonstrated that Windows’ own Bind Links feature can hide malware from endpoint detection platforms entirely including executing Mimikatz without triggering commercial EDR tools during testing.

On the supply chain side: a JScrambler npm publishing credential compromise distributed a Rust-based infostealer specifically engineered to steal AI coding assistant configuration files including Claude Desktop, Cursor, Windsurf, and VS Code credentials. Researchers demonstrated GhostCommit showing that a PNG image embedded in a pull request can manipulate AI coding agents into leaking secrets into production code while automated review tools never inspect image contents at all. And Okta documented a live passkey enrollment hijacking campaign where attackers call victims impersonating IT support, guide them through registering the attacker’s own passkey against the victim’s Microsoft account, and receive authentic Microsoft notifications that victims mistake for success confirmations.

Progress Software’s ShareFile emergency finally received technical clarification a path traversal vulnerability allowing authenticated admin read/write access after organizations had already spent a week making production shutdown decisions with minimal technical context. That communication gap itself became a story about what vendors owe defenders during security emergencies.

Russia, meanwhile, is still successfully compromising routers using Cisco Smart Install from 2018 and SNMP default community strings with nine allied governments issuing a joint advisory because organizations keep not fixing things they’ve known about for years.

James’s defining quote across the week: “The attacker’s development cycle is now becoming shorter than the defender’s detection cycle.”

Let’s get into it.

🤖 AI as Offensive Infrastructure

“AI isn’t just making defenders faster, it’s making attackers operationally scalable.”

Russian Threat Actor Uses Google Gemini CLI to Automate 89% of C2 Operations

Trend Micro analyzed more than 200 Gemini AI interaction logs spanning approximately one month from a Russian-speaking threat actor using Google Gemini CLI to operate live command-and-control infrastructure. When the original Cloudflare-based C2 became ineffective, the operator instructed Gemini in plain Russian to migrate the entire environment. Within minutes, Gemini generated new server code, deployed infrastructure onto a fresh VPS, configured networking, diagnosed load balancing conflicts, migrated infected systems, and restored operations. The human operator contributed only 11% of the work. Gemini completed 89% autonomously. Researchers also observed the operator jailbreaking Gemini by presenting operations as authorized penetration testing and repeatedly requesting regeneration of indicators of compromise whenever previous artifacts became exposed. This represents a category shift. Cybercrime-as-a-Service lowered technical barriers. AI-assisted operations may eliminate them entirely. Begin incorporating AI-assisted infrastructure regeneration into threat models and monitor for AI-assisted automation patterns in attacker tradecraft.

First Real-World AI-Driven Ransomware Attack Documented

Sysdig documented the first real-world ransomware operation driven almost entirely by an autonomous AI agent, exploiting Langflow’s authentication bypass (CVE-2025-3248) as the entry point. The AI independently performed reconnaissance, harvested credentials, pivoted through internal systems, modified its own attack strategy when obstacles appeared, and generated a ransom note adapting tactics in natural language when earlier approaches failed. AI orchestration platforms must be treated as privileged administrative infrastructure. Patch Langflow, eliminate internet exposure, and build incident response playbooks specifically for AI-assisted intrusion scenarios.

GhostCommit: A PNG Image Manipulates AI Coding Agents Into Leaking Production Secrets

Researchers demonstrated GhostCommit a technique using a standard PNG image in a pull request to manipulate AI coding assistants. An Agents.md file references the image as build documentation; hidden inside the image are machine-readable instructions directing the AI to locate credential files, encode sensitive information as numeric constants, and embed them into production source code. Most automated code review platforms never inspect image contents. Researchers successfully demonstrated Cursor paired with Claude Sonnet leaking complete environment files during ordinary development tasks while developers remained unaware. AI convention files, prompts, images, and documentation must now receive the same security scrutiny as executable code.

CISA Deploys Anthropic Mythos for Federal Code Scanning

CISA’s Attack Surface Evaluation Team is using Anthropic’s Mythos AI model to automatically scan federal software repositories for vulnerabilities. Early testing uncovered numerous previously unidentified flaws. AI-assisted vulnerability discovery is becoming a strategic defensive capability and attackers are gaining access to the same research at nearly the same pace.

Fifteen-Year-Old Uses AI-Generated Exploit Code to Attack Streaming Service

Tokyo police arrested a 15-year-old accused of using AI-generated exploit code to disrupt more than 46,000 Bandai Channel subscriptions. Generative AI continues lowering technical barriers for inexperienced attackers this is no longer an advanced adversary capability.

🌐 Critical Infrastructure & Active Exploitation

“The attacker’s development cycle is now becoming shorter than the defender’s detection cycle.”

CISA SharePoint Emergency Directive: Patch or Disconnect by End of Day

CISA issued an emergency advisory confirming active exploitation of three Microsoft SharePoint Server vulnerabilities against internet-facing on-premises deployments giving federal agencies until end of day to patch or remove systems from service. Vulnerabilities enable authentication bypass, remote code execution, IIS machine key theft, and persistent malware deployment. Shadowserver tracks nearly 10,000 internet-facing SharePoint servers with hundreds confirmed vulnerable. Critically: attackers are stealing cryptographic machine keys and using them to maintain privileged access even after systems are patched. Deploy Microsoft’s latest updates, enable AMSI integration for SharePoint web applications, hunt for compromise before rotating IIS machine keys, and remove unnecessary internet exposure.

SonicWall SMA 1000 CVE-2026-45410 CVSS 10.0: Active Exploitation, No Workaround

SonicWall confirmed active exploitation of two SMA 1000 vulnerabilities added to CISA’s KEV — CVE-2026-45410 (CVSS 10.0, unauthenticated SSRF) and CVE-2026-45409 (authenticated OS command injection). SonicWall’s PSIRT has already investigated multiple confirmed compromises and published indicators including suspicious authentication endpoint requests, abnormal proxy activity, path traversal attempts, and unexpected login behavior. There is no workaround. Deploy vendor hotfixes immediately, review published IOCs, reimage compromised physical appliances, redeploy affected virtual appliances, rotate all administrator credentials, and reissue MFA tokens.

Microsoft Record Patch Tuesday: 570 Vulnerabilities, Three Zero-Days, Two Under Active Exploitation

Microsoft released the largest Patch Tuesday in company history 570 vulnerabilities, 59 critical, and three zero-days. Two were already under active exploitation before patches arrived. The ADFS zero-day allows privilege escalation inside enterprise identity environments from existing privilege. The SharePoint zero-day allows unauthenticated privilege escalation over the network. Microsoft also disclosed a BitLocker security feature bypass that became public knowledge, increasing near-term exploitation likelihood. Microsoft acknowledged AI-assisted vulnerability discovery is contributing to the growing CVE count a trend that will continue on both sides. The gap between patch released and patch applied is exactly where every one of today’s attacks lives.

CISA Four KEVs Added in One Day: ColdFusion, Langflow x2, Joomla Extensions

CISA added four maximum-severity vulnerabilities across Adobe ColdFusion, Langflow, and two Joomla extensions simultaneously with federal agencies receiving accelerated remediation deadlines. ColdFusion (CVE-2026-2244 and CVE-2026-48282) was confirmed exploited within 48 hours of patch release. Langflow is being attacked through a two-CVE chain enabling AI workflow execution. Joomla extensions IC Agenda and Balbooa Forms enable malicious PHP upload through legitimate application functionality. Exploitation was observed in one Joomla case hours before patches were released. Patch all four immediately.

Zoom CVE-2026-53412 CVSS 9.8: Unauthenticated Account Takeover on Windows

Zoom disclosed a critical vulnerability allowing an unauthenticated attacker with network access to compromise user accounts on Windows without credentials or user interaction. No active exploitation confirmed yet but CVSS 9.8 vulnerabilities attract rapid reverse engineering after disclosure. Deploy Zoom Workplace, VDI, and Meeting SDK updates immediately across all Windows endpoints.

Progress ShareFile Emergency Shutdown — Technical Details Finally Released

Progress Software’s emergency instruction to physically power down ShareFile StorageZone Controllers issued last week before technical details were disclosed was finally explained: a path traversal vulnerability allowing authenticated administrators to read arbitrary files, write attacker-controlled content into unauthorized directories, and enumerate server file systems. Progress states no evidence of unauthorized data access was found during investigation. The incident raises a legitimate governance question: organizations spent a week making production shutdown decisions with minimal technical context. Transparency during security emergencies is itself a security control. Patch and reconnect StorageZone Controllers per Progress guidance, audit for unauthorized file access, and establish vendor communication expectations contractually.

Ubiquiti Seven Critical Vulnerabilities: 100,000+ Internet-Exposed Devices

Ubiquiti released updates for seven critical vulnerabilities across the UniFi ecosystem including a maximum-severity command injection. Six require no user interaction. More than 100,000 UniFi OS systems remain publicly accessible. Update UniFi Connect to 3.4.20 or later, deploy current UniFi OS updates, and remove management interfaces from internet exposure.

Cisco Unified Communications Manager: Active Exploitation Finally Officially Confirmed

Cisco officially acknowledged active exploitation of the UCM Web Dialer SSRF vulnerability weeks after threat intelligence firms documented attacks. Approximately 200 internet-facing systems remain exposed. Disable Web Dialer until patching is completed. Voice infrastructure connects to identity services and collaboration platforms compromise rarely ends with the phone system.

🧬 Supply Chain & Developer Ecosystem

JScrambler npm Credential Compromise: Rust-Based Infostealer Targets AI Dev Credentials

Attackers compromised JScrambler’s npm publishing credentials and deployed five malicious package versions available for approximately three hours. The Rust-based payload executed automatically during package installation, harvesting AWS, Azure, and Google Cloud credentials, GitHub and npm tokens, browser sessions, Bitwarden vault data, cryptocurrency wallets, and configuration files for Claude Desktop, Cursor, Windsurf, VS Code, and Zed. On Linux systems, an eBPF program was loaded directly into the kernel. Developer workstations are privileged gateways into cloud infrastructure, AI platforms, production repositories, and deployment pipelines. Review dependency lock files, identify whether affected versions entered build pipelines, rotate every potentially exposed credential, revoke developer sessions, and rebuild compromised hosts rather than attempting malware removal.

North Korean Contagious Interview: 108 Packages Across npm, Go, VS Code, Chrome

North Korea’s developer supply chain campaign expanded to 108 malicious packages across four ecosystems with attackers rewriting Git commit histories to make malicious changes appear historically legitimate. Audit all recently installed development packages and rotate credentials from potentially affected workstations.

CISA Adds Joomla Extension Vulnerabilities with One-Day Federal Remediation Deadline

Two actively exploited Joomla extension vulnerabilities (CVE-2026-48939 for IC Agenda, CVE-2026-56291 for Balbooa Forms) received one-day federal remediation deadlines. Both enable malicious PHP file upload through legitimate application functionality. Verify extensions are installed and patched, review upload directories for suspicious PHP files, and inspect web server logs for unauthorized activity.

SAP: CVSS 9.9 NetWeaver Vulnerability + OAuth Default Credential Risk

SAP’s patch day included a CVSS 9.9 NetWeaver ABAP vulnerability enabling business data modification and operational disruption, an AppRouter HTTP request smuggling vulnerability, and most operationally significant evidence that production environments continue using sample OAuth credentials intended only for demonstration purposes. Organizations that never replaced defaults after deployment have unknowingly exposed privileged ERP access. Audit all SAP OAuth client configurations for inherited default credentials and remove all demonstration artifacts from production systems.

RabbitMQ Critical: Unauthenticated OAuth Secret Retrieval

A critical RabbitMQ vulnerability allows unauthenticated retrieval of OAuth client secrets from the management interface under certain deployments potentially enabling impersonation of the messaging platform itself against Azure AD, Auth0, Keycloak, or Cloud Foundry UAA identity providers. Upgrade RabbitMQ, restrict management interfaces, rotate OAuth client credentials, and verify management access is limited to trusted administrative networks.

Gitea Docker CVE-2026-20896: Active Reconnaissance, Exploitation Expected

Active reconnaissance began against Gitea’s default trusted proxy misconfiguration within two weeks of disclosure allowing header forgery to authenticate as any user. Upgrade to Gitea 1.26.3 or later and verify proxy configurations.

Polymarket $3M JavaScript Supply Chain Theft

Third-party JavaScript dependency compromise at Polymarket enabled $3 million in cryptocurrency theft. The blockchain was not compromised the attack was entirely through a trusted frontend component. Review all third-party JavaScript dependencies.

LibSSH2 CVE-2026-55200 CVSS 9.2: Public PoC, Embedded Throughout Enterprise Applications

Public exploit code available for LibSSH2 embedded in curl, wget, PHP, backup platforms, and embedded appliances. Inventory LibSSH2 dependencies through software composition analysis and upgrade affected applications.

Trend Micro MCP Server Audit: 4,982 Vulnerabilities Across 2,259 of 9,695 Audited Servers

More than 2,000 MCP servers had no authentication. Hundreds were vulnerable to command injection, SQL injection, SSRF, prompt injection, and direct code execution. Highly rated, verified, and widely adopted servers contained nearly the same number of vulnerabilities as unverified projects. Popularity is not security. Treat every third-party MCP server as untrusted until reviewed.

🔐 Authentication, Identity & Credentials

Okta Documents Live Passkey Enrollment Hijacking via Phone-Based Social Engineering

Attackers impersonating IT support call Microsoft 365 users, direct them to realistic phishing pages mirroring Microsoft’s Entra ID passkey registration process, and guide them through registering the attacker’s own passkey against the victim’s account while adapting in real time to each account’s MFA configuration. Users receive authentic Microsoft notifications they mistake for success confirmations. The fabricated recovery phrase process distracts victims while account takeover completes. Educate users that Microsoft and IT teams will never call requesting live passkey enrollment. Monitor Entra ID for unexpected passkey registration events and strengthen help desk identity verification procedures.

Microsoft ADFS and SharePoint Zero-Days Under Active Exploitation Before Patches

The ADFS zero-day allows privilege escalation from existing enterprise access inside identity infrastructure. The SharePoint zero-day allows unauthenticated privilege escalation over the network. Both were under active exploitation before Microsoft’s patches arrived. Prioritize identity infrastructure and SharePoint remediation above all other July Patch Tuesday items.

BlueHammer CVE-2026-33825: Microsoft Defender Privilege Escalation in Active Ransomware Campaigns

CISA confirmed BlueHammer is now deployed in active ransomware operations after a KEV catalog update (without a new advisory monitor existing entries, not just new additions). Verify April 2026 Defender patches across all endpoints.

FortiBleed Confirmed as Lynx and INC Ransomware Infrastructure

SOC Radar confirmed FortiBleed 73,000+ credentials, 430,000 FortiGate firewalls targeted, 19,000 devices with packet sniffers, persistent backdoors on hundreds of operational systems was the front-end access operation for Lynx and INC ransomware. Rotate every Fortinet credential not already replaced. Hunt for unauthorized administrator accounts.

Nine Allied Governments Warn of Russian Router Campaign via Default SNMP and Cisco Smart Install

CISA, NSA, FBI, and cybersecurity agencies from Australia, Canada, UK, New Zealand, Estonia, Finland, France, and Italy jointly attributed an active router compromise campaign to Russia’s FSB Center 16 exploiting default SNMP community strings and CVE-2018-0171 (Cisco Smart Install). These techniques have worked for years because organizations keep not fixing them. Audit SNMP configurations, disable Smart Install, eliminate default credentials, restrict management protocols at network boundaries, and retire unsupported hardware.

Microsoft Teams Voice Call Malware with Ethereum Smart Contract C2

Attackers impersonating IT support over Teams voice calls convince victims to install remote administration tools before deploying malware communicating through Ethereum smart contracts. Review Teams policies for external calls and monitor Ethereum RPC traffic as a C2 indicator.

🔓 Data Breaches & Exposures

Lidl: Third-Party Vendor Breach Exposing Customer Names, Contacts, Birth Dates

Lidl confirmed customer data was compromised through a third-party vendor supporting customer operations. Names, phone numbers, email addresses, birth dates, and customer IDs are known exposed. Organizations secure their own infrastructure while overlooking vendors processing identical customer data. Review third-party notification requirements, encryption standards, and incident response obligations across the vendor ecosystem.

AssuranceAmerica: 6.99 Million Driver’s License Records

Insurance provider confirmed breach through compromised employee credentials exposing 6.99 million individuals. Phishing-resistant authentication is required for all employee accounts handling sensitive customer data.

Medtronic: 3.83 Million in ShinyHunters Healthcare Breach

Medtronic confirmed 3.83 million individuals affected names, SSNs, health information from the April ShinyHunters breach. ShinyHunters removed Medtronic from its leak site, historically suggesting some form of resolution.

Union County Ohio: $1 Million Paid to Kairos Without Ransomware Deployment

$1 million extortion payment made to Kairos with no ransomware deployed. Data theft alone is sufficient for seven-figure extortion. Data protection is no longer secondary to operational resilience.

Apple Sues OpenAI Over Trade Secret Offboarding Failures

Apple sued OpenAI alleging former employees retained access to internal systems after departure and downloaded thousands of engineering documents. Immediate identity revocation and privileged access offboarding are critical controls highlighted when their absence reaches federal litigation.

🌐 Geopolitical & Nation-State Threats

Chinese Espionage Targets U.S. and Canadian University Researchers via Roundcube

Proofpoint documented targeted Chinese espionage against researchers in physics, engineering, astrophysics, and national security programs through Roundcube Webmail vulnerabilities deploying IceCube, SquareShell, and VShell malware. Attackers identify vulnerable Roundcube instances before launching phishing campaigns. Patch Roundcube immediately. Treat webmail with the same rigor as VPN gateways.

Cisco Talos: China’s LongLeash Proxy Network Expands on Ruckus and ASUS Routers

LongLeash malware transforms compromised Ruckus and ASUS routers into covert proxy infrastructure — supporting HTTP, DNS, ICMP, SOCKS, TCP, UDP, and SMTP tunneling with self-removal features frustrating forensic analysis. Update firmware, remove end-of-life hardware.

Iranian APT Uses SS7 Protocol to Track U.S. Military Personnel

Investigative reporting alleges Iranian intelligence abused decades-old SS7 signaling weaknesses to identify U.S. military personnel locations before missile attacks. Telecommunications infrastructure weaknesses from the 1970s carry present-day operational consequences.

UK and EU Jointly Sanction Russian Intelligence Personnel

UK and EU jointly sanctioned Turla-linked Russian intelligence personnel connected to attacks against Poland’s energy infrastructure and European espionage campaigns.

Pakistan Police Networks Under Sustained Chinese and Indian Espionage

SentinelOne documented multiple espionage campaigns maintaining long-term access inside Pakistani police networks through PlugX, ShadowPad, Cobalt Strike, and Remcos — accessing biometric systems, criminal investigations, and personnel records through fake software update prompts.

Canada’s CSE Disclosed Three Offensive Cyber Operations

Canada’s Communications Security Establishment announced three offensive operations including one that disrupted ransomware infrastructure and deleted stolen victim data following attacks on Canadian healthcare and transportation.

Spanish Arrest: Pro-Russian Hacktivist Linked to U.S. Water Utility Attacks

Spanish authorities arrested an individual affiliated with Cyber Army of Russia Reborn and Z-Pentest as part of FBI Operation Red Circus targeting groups that attacked U.S. water utilities.

🛡️ Windows EDR Evasion

Bitdefender: Windows Bind Links Feature Hides Malware from EDR Platforms

Bitdefender researchers demonstrated that Windows’ Bind Links feature (bindflt.sys) supporting Windows Containers, Sandbox, and Store can be repurposed by attackers with administrator access to redirect legitimate executable paths toward malicious payloads without changing file locations security products inspect. Researchers replaced AMSI.dll with attacker-controlled versions, disguised malicious executables as trusted Windows binaries, and created isolated Windows silos where EDR tools observe clean files while malicious code executes elsewhere. Mimikatz executed without triggering commercial EDR tools during testing. Microsoft classified as low severity due to administrator access requirement but administrator access is a routine ransomware objective. Monitor for unusual Bind Filter activity, unexpected DLL redirection, and verify whether EDR vendors currently detect Bind Link manipulation.

⚖️ Law Enforcement, Policy & Industry

Adobe 88 Vulnerabilities: Eight Critical ColdFusion RCE, SQL Injection, Auth Bypass

ColdFusion received eight critical vulnerabilities given its recent active exploitation history. Prioritize immediately.

VMware Avi Load Balancer: Critical Authentication Bypass

Broadcom patched seven VMware Avi Load Balancer vulnerabilities including a critical authentication bypass. VMware products historically attract rapid attacker attention. Deploy updates.

Fortinet Seven Security Advisories: Path Traversal, VNC Exposure

Fortinet addressed FortiOS, FortiProxy, FortiPAM, and FortiSandbox vulnerabilities including path traversal issues and exposed VNC management interfaces. Patch and verify management interface access restrictions.

White House Gold Eagle AI Initiative: Accelerated Vulnerability Remediation

The White House announced Gold Eagle an AI-driven coordination initiative combining government agencies, critical infrastructure operators, and open-source maintainers to accelerate vulnerability discovery and remediation. The structure mirrors how CISA’s Mythos deployment is operating.

23andMe $9 Million Settlement: Enhanced Genetic Data Deletion Rights

23andMe settled with multiple state AGs requiring enhanced board-level cybersecurity oversight and strengthened customer rights around genetic information deletion. Genetic data protection is entering regulatory enforcement.

DOJ Indicts Three Russians for Bulletproof Hosting Supporting LockBit, BlackSuit, Play

U.S. DOJ unsealed indictments against three Russian nationals accused of operating bulletproof hosting infrastructure supporting multiple major ransomware groups.

CMMC Phase Two Delayed Pending Program Review

DoD temporarily paused CMMC Phase Two implementation while conducting a broader review. Existing self-assessment requirements remain unchanged.

Anthropic Chrome Extension Still Has Unresolved Vulnerabilities

Two previously disclosed Anthropic Chrome extension vulnerabilities remain unpatched, potentially allowing unauthorized access to Gmail, Google Docs, and Calendar content when autonomous mode is enabled. Disable autonomous mode until resolved.

Mozilla and Chrome Critical Browser Updates

Mozilla patched two critical Firefox vulnerabilities; Google patched 15 Chrome vulnerabilities including multiple critical memory corruption issues. Deploy alongside OS patches.

Pentagon Iran SS7 Attribution

The SS7 telecommunications signaling protocol designed in the 1970s continues enabling real-world geolocation of military personnel. Legacy infrastructure weaknesses have current-day operational consequences that extend far beyond the enterprise.

✅ This Week’s Priority Action List

Immediate (Do This Now)

• Deploy Microsoft SharePoint emergency patches, enable AMSI integration, hunt for compromise before rotating IIS machine keys — CISA emergency directive, active exploitation, key theft enables persistence post-patch

• Patch SonicWall SMA 1000 appliances immediately, review all published IOCs, reimage compromised systems, rotate all admin credentials and MFA tokens — CVSS 10.0, no workaround, active confirmed compromises

• Patch Microsoft ADFS zero-day (active exploitation before patch) and SharePoint Server zero-day (unauthenticated network privilege escalation) — highest priority items from record Patch Tuesday

• Patch Zoom Workplace, VDI, and Meeting SDK on Windows (CVE-2026-53412, CVSS 9.8, unauthenticated account takeover)

• Patch Adobe ColdFusion — eight critical vulnerabilities, active exploitation history, CISA KEV

• Patch all four CISA KEV additions (ColdFusion, Langflow x2, Joomla extensions IC Agenda and Balbooa Forms)

• Deploy all current Ubiquiti UniFi OS updates and restrict management interfaces from internet exposure

• Patch Langflow, eliminate internet exposure, isolate backend databases — AI-driven ransomware attack confirmed Langflow as entry point

• Patch and reconnect ShareFile StorageZone Controllers per Progress guidance, audit for unauthorized file access

Short-Term (This Month)

• Rotate all developer credentials potentially exposed through JScrambler npm compromise (AWS, Azure, GCP, GitHub, npm, AI coding assistant configs)

• Rebuild developer hosts where malicious packages were installed — removal is insufficient

• Review dependency lock files for JScrambler package versions and audit CI/CD pipeline exposure

• Audit all Joomla upload directories for suspicious PHP files and review web server logs

• Deploy July Patch Tuesday updates across all Windows environments — 570 vulnerabilities, prioritize identity and collaboration infrastructure

• Patch VMware Avi Load Balancer, Fortinet (seven advisories), and RabbitMQ

• Audit SAP OAuth client configurations for inherited sample credentials and remove demonstration artifacts from production

• Educate users that Microsoft and IT will never call requesting passkey enrollment — monitor Entra ID for unexpected passkey registration events

• Audit SNMP configurations, disable Cisco Smart Install, eliminate default router credentials — Russia’s FSB is actively exploiting these configurations in critical infrastructure

• Patch Roundcube Webmail and treat as tier-one security infrastructure

• Monitor for unusual Windows Bind Link / Bind Filter activity — EDR bypass demonstrated against commercial products

• Disable Anthropic Chrome extension autonomous mode until vulnerabilities are resolved

Strategic (This Quarter)

• Build incident response playbooks for AI-assisted intrusion scenarios — the Sysdig/Gemini documentation shows what autonomous operations look like operationally

• Implement AI tool description and context change management — treat Agents.md files, convention files, and AI context as production code requiring formal review

• Treat AI coding assistants and MCP servers as privileged infrastructure with least privilege, logging, and continuous monitoring

• Inventory LibSSH2 and other embedded library dependencies through software composition analysis

• Compress vulnerability management timelines for internet-facing systems — record Patch Tuesday volumes and 48-hour exploitation windows make quarterly cycles operationally indefensible

• Develop third-party vendor communication requirements for security emergencies — ShareFile demonstrated what happens when organizations make production decisions without technical context

• Monitor White House Gold Eagle AI initiative guidance for integration into vulnerability remediation programs

🎙️ James Azar’s CISO’s Take

When I look across this week’s four episodes, the Gemini CLI story is the one that will define this period of cybersecurity history. Not because a Russian actor used AI we expected that. But because the AI completed 89% of an active C2 rebuild autonomously, in real time, with the human contributing only operational direction. That’s not AI assisting an attacker. That’s AI operating as an engineering team. The economic implications are enormous: this dramatically compresses attacker development cycles while eliminating most of the technical expertise requirement. An attacker who couldn’t configure a load balancer yesterday can operate one today by asking Gemini in plain language. Our detection strategies, our response playbooks, and our threat models all need to account for this because the version of cybercrime that required technical sophistication is rapidly becoming the version that requires only intent.

The second takeaway is that the fundamentals matter more than ever precisely because the attacker’s tooling has become more powerful. SonicWall exploited through a CVSS 10.0 vulnerability organizations didn’t patch. Russia compromising routers through Cisco Smart Install from 2018. SharePoint being exploited because 10,000 servers remain internet-exposed. Joomla extensions being weaponized before patches were even released. AI accelerates every one of these attacks but the entry points remain the same unpatched infrastructure, exposed management interfaces, and default credentials that have always been there. The organizations that execute the fundamentals exceptionally well will be the ones best positioned to absorb the AI-accelerated wave coming at all of us. The others will keep providing the case studies.

📋 Week in Summary

This was the week AI crossed from an enabler into an operational force multiplier for attackers in a documented, measurable way. A Russian threat actor used Google Gemini CLI to rebuild live C2 infrastructure diagnosing errors, migrating systems, regenerating artifacts with 89% of the work done autonomously. The first AI-driven ransomware attack was formally documented. And a PNG image was shown capable of manipulating AI coding agents into leaking production secrets while review tools remained completely blind. These are not theoretical scenarios. They are documented operations from this week.

Against that backdrop, Microsoft released the largest Patch Tuesday in company history. SonicWall confirmed CVSS 10.0 active exploitation with no workaround. CISA issued a same-day SharePoint emergency directive. Nine allied governments jointly warned that Russia is still successfully compromising routers through default SNMP configurations and a 2018 Cisco vulnerability. And organizations are still deploying SAP production environments with demonstration OAuth credentials intact. The attack surface continues to expand into every trusted relationship AI tools, developer dependencies, remote access platforms, messaging systems, and ERP credentials while the window between vulnerability disclosure and active exploitation continues compressing toward zero. The organizations that match attacker tempo in patching, detection, and response will navigate what comes next. The ones operating on yesterday’s timelines will keep learning from the week’s case studies instead of preventing them.

Stay informed. Stay prepared. Stay Cyber Safe. 🔐

© CyberHub Podcast | Subscribe on Substack | Watch on YouTube | Follow on LinkedIn