The week's biggest theme is the weaponization of AI: attackers ran a botnet through Google's Gemini CLI, hid malicious commands in images to fool AI code reviewers, and planted false memories in AI assistants — a signal that AI agents now need their own security controls. Alongside
AI-driven attacks dominated this week: the first fully agentic ransomware (JadePuffer), a 72-hour AI-assisted AWS breach, an AI-powered phishing platform (Forg365), and prompt injection tricking AI agents into crypto payments. Identity-based social engineering continued with the new Helix vishing group and a reclassification of Scattered
This week's landscape was shaped by four pressures: active exploitation of known flaws, AI weaponization, large-scale credential attacks, and major breach fallout. CISA flagged actively exploited vulnerabilities in Windows ("BlueHammer"), Cisco CUCM, and SharePoint, while the FortiBleed campaign — spanning 430,000+ FortiGate devices — was directly
Welcome to this week's Threat Intelligence Digest. From AI-assisted vulnerability discovery reshaping the security landscape to supply chain attacks hitting the firms that defend others, the week of June 22–28 was a reminder that no sector — and no security team — is immune. Klue Supply Chain Attack
This week's roundup is dominated by one theme: the AI security arms race is no longer hypothetical. The US government's abrupt order forcing Anthropic to pull Claude Fable 5 and Mythos 5 offline worldwide kicked off a week of fallout, while Chainguard's new Athena
This week's roundup is dominated by one overarching story: AI has become both the weapon and the target. Anthropic's restricted "Mythos" cyber-models are now turning newly disclosed bugs into working exploits in hours, are quietly embedded inside the NSA's offensive operations,
Mini Shai-Hulud is a highly active, self-propagating software supply chain attack campaign attributed to a financially motivated threat actor known as TeamPCP. Named after the colossal sandworms of Frank Herbert’s Dune universe, the campaign reflects both the actor’s thematic branding and the malware’s worm-like,
The first week of June makes one thing clear: attackers are targeting trust itself — in AI platforms, CI/CD pipelines, package provenance, MFA, and legacy patch status. AI is being weaponized faster than it's being defended. Sophos uncovered an AI-assisted ransomware lab using Cursor and Claude Opus
The final week of May 2026 delivered a dense wave of threat activity spanning every major category — from sophisticated nation-state campaigns to commodity fraud targeting World Cup fans. The dominant narrative across this reporting period is the accelerating weaponization of trust: trusted platforms (HuggingFace, GitHub, LinkedIn, Microsoft 365), trusted
If this edition of the newsletter has a single recurring theme, it's that the systems and institutions we trust to keep us secure are themselves becoming the attack surface. The agency responsible for securing federal infrastructure leaked its own cloud keys. A major open-source ecosystem had its
This edition covers 21 of the most significant cybersecurity stories from May 11 to May 17 2026 — spanning zero-day disclosures, ransomware attacks on education and pharma, AI-powered exploits, supply chain compromises, and shifting regulatory landscapes. Each entry includes a three-sentence summary and clear, actionable takeaways. Shai-Hulud
This week’s threat intel underscores accelerating risk across perimeter infrastructure, software supply chains, and identity. Attackers—including suspected state-linked actors and organized cybercriminals—are exploiting high-value entry points such as firewall services, long-standing OS flaws, phishing-driven credential theft, and trusted developer tooling to gain access,