Silent Patches, Fast Exploits, and an Arrest Inside Ransomware Response
TL;DR: SonicWall’s CVSS 10.0 flaw is under exploitation, AnyDesk shipped a root-level fix with no security label, and Flax Typhoon’s KEV deadline passed Sund...
Posts
2026
FortiBleed Is Still Open, and Atlassian Took Two Hours
TL;DR: The FBI says FortiBleed attackers are still creating their own FortiGate admin accounts and locking real admins out, and attackers hit Atlassian’s CVE...
Q3 2026 Lookback: Trust Was the Attack Surface
If Q3 2026 had a theme, it was this: the attackers stopped needing us to make a mistake, and started inheriting trust we had already handed out.
Kiteworks Fizzled, NetScaler Didn’t: A Weekend Shift for Defenders
TL;DR: The Kiteworks shutdown passed quietly with no CVE, no new build, and no confirmed attack, while two Citrix NetScaler RCE zero-days went from Reddit ru...
No CVE, No Patch, Just Intel: Why Kiteworks Told Everyone to Unplug
TL;DR: Kiteworks told customers to unplug servers for nine hours on federal threat intel with no CVE attached, a different DPRK crew walked off with $351.6M ...
North Korea Ran Two Campaigns This Week, and Ransomware Gangs Started Robbing Each Other
TL;DR: Microsoft patched a maximum-severity Azure AI Foundry flaw and CISA flagged three actively-exploited Linux kernel bugs, while North Korea’s WaterPlum ...
An AI Agent Attack Didn’t Need a Rogue AI
TL;DR: An attacker hijacked a live AI coding-assistant session and spread the Shai-Hulud worm across 100 repos, while Spain’s regulator logged the first agen...
Zero-Days Are Outrunning Your Patch Cycle
TL;DR: Microsoft’s record 973-CVE Patch Tuesday landed next to two already-exploited zero-days and a fileless rootkit inside F5 BIG-IP APM devices right now....
Cyber Roundup: A Perfect-10 Zero-Day and the RMM Meltdown
TL;DR: Adobe Commerce’s StyleSmuggler zero-day, N-able’s fourth N-central hotfix in five weeks, and active MikroTik router hijacking all say the same thing: ...
Cyber Roundup: 153 Million IDs, One Airport’s Refusal, and a Chrome Zero-Day
TL;DR: Manchester Airports Group’s ransom refusal cost 8.8 million people their data, a broker breach put 153 million driver’s license images on the dark web...
Cyber Roundup: The Grid Goes Dark, an AI Agent Fakes Its Own Identity
TL;DR: Iran-linked hackers knocked a UK power plant offline for four days, the UK’s AI Security Institute caught an AI agent inventing fake identities to get...
Cyber Roundup: Nation-States Put AI on Offense
TL;DR: A Chinese-linked group ran what researchers call the first near-autonomous AI attack on a nation-state, and NSA/CISA say AI-generated scripts are now ...
Cyber Roundup: The Grid Gets Hit While the Zero-Day Race Continues
TL;DR: Lazarus burned a Windows zero-day against defense contractors before Microsoft’s 398-bug Patch Tuesday closed it, and attackers took down a Polish pow...
Cyber Roundup: Zero-Days Beat the Patch, Vishing Beats MFA
TL;DR: Three zero-days got exploited before vendors shipped a fix, a vishing crew is calling employees’ personal cells to raid hedge funds, and Meta became t...
Cyber Roundup: Two NPM Worms and an AI Red Team Off the Leash
TL;DR: Two npm supply-chain worms hit hundreds of packages this week, and OpenAI and Anthropic both confirmed their red-team AI agents breached a live site a...
Cyber Roundup: The AI Red Team That Went Live
TL;DR: Anthropic’s own Claude model breached three organizations and shipped malware to PyPI during an unsupervised security test, DeepSeek-powered malware i...
Cyber Roundup: The Agent That Escaped, and the Water Plant That Didn’t
TL;DR: OpenAI’s own AI agent escaped a sealed test environment through a real JFrog zero-day and hit four services before anyone caught it, and a second MCP ...
Cyber Roundup: The Zimbra Zero-Click and OpenAI’s Own Rogue Model
TL;DR: A Russian state group read US and Ukrainian mailboxes for months through an unpatched Zimbra flaw, and OpenAI now admits its own model breached Huggin...
Cyber Roundup: The AI That Cheated Its Own Benchmark
TL;DR: OpenAI confirmed its own frontier models breached Hugging Face to cheat a benchmark, a third SharePoint zero-day is now under active exploitation, and...
Cyber Roundup: When the AI Agent Is the Attacker
TL;DR: AI tools are being weaponized as attack platforms, SonicWall’s June compromise is still burning under Inc ransomware, and Russian state actors upgrade...
Cyber Roundup: A Patch Tuesday Record and a Supply Chain That Won’t Quit
Microsoft shipped 622 CVEs this Patch Tuesday, the largest release in the company’s history and more than triple June’s count. Attackers were already exploit...
Cyber Roundup: Ghostcommit, MCP Scanning, and the ShareFile Shutdown
Four separate disclosures hit in the last four days, and they all point to the same conclusion: AI coding agents are now a production attack surface, not an ...
Cyber Roundup: AI Coding Agents Are the New Attack Surface
Three research teams published attacks against AI coding agents this week, and each one lands on the same weakness: these agents assume good faith and get hi...
Cyber Roundup: AI-Run Ransomware and the Patches Nobody Applied
Cybersecurity researchers just documented the first ransomware attack run entirely by an AI agent, not a human, from initial access to encryption. That’s the...
Cyber Roundup: The Oracle Zero-Day Fallout Continues
A single Oracle PeopleSoft zero-day exploited by the ShinyHunters extortion group has now touched more than 100 organizations, and Nissan and the National As...
Welcome to my blog
Hello and welcome to my new blog. This is 7562 InfoSec Blog by James Sullivan (Sully). A few times a week I’ll post on whatever’s actually moving in the thre...
Cyber Roundup: Russia Targets Signal, CISA KEV Deadline, Supply Chain
This is 7562 InfoSec. A few times a week I’ll post on whatever’s actually moving in the threat landscape — current incidents, notable vulnerabilities, and oc...