[inc]

October 22, 2026

• Exposed operator environments also tie AI to ransomware affiliates and lower-skill cybercrime. SOCRadar says seven servers linked to INC and The Gentlemen contained 8,257 messages across 133 OpenCode sessions, covering 62 targeted organizations and more than $23,920 in AI-service spending; targets are not confirmed breaches. Separately, Unit 42 says BUGSTER ran Hermes Agent with DeepSeek V4 safety controls disabled and confirmed exfiltration of more than 5,200 student PII records from a second Indian university. Both describe AI-assisted operations, not hands-off autonomy. · Cloud, Identity & Threat Activity

in PHP2Shell Is Already in the Wild

June 20, 2026

FortiBleed Burns 86,000 FortiGate Devices as Novo Nordisk Loses 1.3TB — Including AI Models — to a Leaked GitHub Token

FortiBleed has compromised ~86,644 internet-facing FortiGate devices in a credential-harvesting campaign, while a leaked GitHub token gave FulcrumSec access to Novo Nordisk, exfiltrating 1.3TB including unreleased drug formulas and internal AI models. Mastra npm packages were trojanized by Sapphire Sleet (North Korea–nexus), and multiple AI infrastructure flaws emerged: SearchLeak (CVE-2026-42824) in Microsoft 365 Copilot, Pickle in the Middle in Google Vertex AI, and vulnerabilities in LiteLLM. Ransomware gangs including Qilin, Gentlemen, and DragonForce continue dominating the threat landscape with EDR-killing tradecraft and cloud-based C2 abuse.