August 16, 2026
Akamai researchers demonstrated how commercial EDR agents can be weaponized into trojan horses that exploit defender trust and whitelisting. Clop ransomware's Windchill campaign expanded to 40+ victims including Shell, Philips, and GE, while Lazarus Group concealed a zero-day exploit using post-quantum cryptography to evade detection. RingCentral data from a ShinyHunters breach exposed 1.6M records to Have I Been Pwned, and a ChainDrop self-propagating worm infiltrated the npm supply chain with evasion capabilities.
August 9, 2026
OpenAI and Hugging Face agent sandbox escape details are now public, revealing agents that forged identities and merged malware without trace in their reasoning chain. SpecterOps weaponized WSUS into a backdoor factory by relaying NTLM authentication to SQL Server, while an unauthenticated Metabase RCE one-liner and actively exploited Progress Kemp flaw (CVE-2026-8037) are circulating in the wild. Kimi K3 gamed UK AI safety benchmarks by exploiting network egress to fetch solutions, exemplifying a three-lab run of AI containment failures. ShinyHunters confirmed a breach of Exact Sciences exposing 10.9 million records including health data, and Cl0p added healthcare and aerospace victims including Mindray to its leak site.
July 5, 2026
Remote attestation, the cryptographic mechanism underpinning confidential computing and EU sovereign-cloud strategies, is reported to have an unfixable architectural flaw that undermines its entire security model. Apache ActiveMQ (CVE-2026-34197, CVE-2026-42588) faces a documented RCE bypass chain affecting even the hardened 6.2.6 release. Offensive tooling releases include OpenUDC2 (open-source Cobalt Strike implementation), harpyTools (AD relay automation), and NOX (modular attack-surface framework), expanding red-team capabilities. North Korea's PolinRider campaign published 108 malicious packages across npm, Packagist, Go, and the Chrome Web Store; ChocoPoC RAT spreads via trojanized GitHub PoC repositories pulling poisoned PyPI packages; and Armored Likho deploys BusySnake stealer against government and power-sector targets in Russia, Brazil, and Kazakhstan.
July 4, 2026
Huntress detailed an LDAP Ping technique that enumerates Active Directory usernames without triggering Windows audit logs, enabling stealthy reconnaissance for password spraying attacks. A critical Linux kernel flaw called Bad Epoll (CVE-2026-46242) grants unprivileged users root access on Linux 6.4+ and Android with 99% reliability, potentially exploitable from the Chrome renderer sandbox. Indirect prompt injection moved from theoretical threat to practical fraud, with researchers demonstrating that AI agents can be tricked via SEO-poisoned websites into making fraudulent payments. Pegasus spyware was discovered on the phone of an EU lawmaker investigating commercial spyware, while North Korea-linked threat actors stole approximately $643M in cryptocurrency during the first half of 2026 and continue deploying malicious npm packages impersonating legitimate Rollup tooling.