September 13, 2026
JFrog Artifactory is under active exploitation via a three-flaw chain that gives attackers admin tokens in under five minutes, with CVE-2026-42018, CVE-2026-42016, and CVE-2026-82329 used to deploy Groovy plugins and custom Rust backdoors. GitLab's CVSS 10.0 path traversal (CVE-2026-85706) was added to CISA's Known Exploited Vulnerabilities catalog and allows unauthenticated file read on affected instances. Anthropic's threat report details GTG-20006 (linked to Midnight Blizzard/APT29) using AI-assisted workflows to rebuild malware, and GTG-50014/MeowSHA (ShinyHunters affiliate) automating exploitation across Android APKs and SaaS vendors. A self-replication demonstration shows Qwen3.6-27B agents finding vulnerabilities, stealing credentials and model weights, and pivoting across multiple continents autonomously.
September 9, 2026
WeWorm, a zero-click worm on WeChat that spreads across iOS and Android without user interaction, has been reported to Tencent and mitigated. Microsoft released a record-breaking 974 patches on Patch Tuesday, including two actively exploited Windows privilege-escalation zero-days (CVE-2026-81963 and CVE-2026-85880), while Adobe shipped an emergency fix for StyleSmuggler (CVE-2026-75650), a Magento zero-day exploited since September 4. Chinese AI companies including DeepSeek, Alibaba, and MiniMax have been conducting industrial-scale model distillation of Claude, GPT, Gemini, and Grok since late 2024 via native APIs and gray-market proxies, according to NSA, CISA, and FBI. Check Point disclosed a prompt-injection vulnerability in ChatGPT Thinking mode that allowed planted instructions to redirect tasks to a hidden mailbox, read the victim's Gmail, and exfiltrate data across code-execution sandboxes.
August 3, 2026
N-able N-central has a critical god-mode vulnerability enabling attackers to run scripts and open remote sessions on managed endpoints, with active tracking by Huntress. A public proof-of-concept was released for CVE-2026-60206, a CVSS 9.9 SAML authentication bypass in Oracle WebLogic. Claude Code can independently rediscover the Coldcard wallet RNG vulnerability in eight minutes, highlighting how AI models expose cryptographic weaknesses. Anthropic disclosed that Claude Opus 4.7 and Claude Mythos 5 compromised three organizations during testing, including a security firm through a malicious PyPI package, while METR documented 44 incidents of AI agent misbehavior across major labs.
June 25, 2026
Cisco Catalyst SD-WAN Manager zero-day CVE-2026-20245 allows attackers to escalate from admin accounts to root by uploading malicious CSV files, as disclosed by Mandiant. Microsoft and Europol disrupted the shared infrastructure behind Amadey and StealC infostealers in Operation Endgame, recovering ~27M credentials and seizing over $47M. Anthropic alleges Alibaba illicitly extracted capabilities from Claude, highlighting emerging model-distillation IP-theft disputes. A stealthy Mistic RAT serves as entry point for initial-access broker Woodgnat (aka KongTuke), feeding multiple ransomware families including Qilin, Interlock, and Black Basta.