This Week’s Verdict

The machines finally learned to do the whole job. An LLM agent ran a ransomware attack from breach to database wipe without a human touching the keyboard, and yet the biggest real-world losses this week still came from the same unpatched appliances we’ve been nagging you about for a year. The future arrived. It’s using the past to get in.

The Breaches

Medtronic is notifying 3.8 million people that ShinyHunters walked out of its corporate IT with personal and medical data back in April. The lag between “April intrusion” and “July notification” is, as usual, the part that should bother you most. Medical data doesn’t expire, and neither does the patience of whoever’s now holding it.

Elsewhere, a U.S. government entity quietly paid roughly $1 million to a group calling itself Kairos, according to a Ransom-ISAC case study built from a leaked negotiation chat and the blockchain trail the payment left behind. The wrinkle: Kairos never appears to have encrypted anything. Pure data-theft extortion. The ransomware brand is now optional. The shakedown is the product.

On the enforcement side of the ledger, the FBI and Google (with Lumen and others) seized hundreds of domains tied to NetNut, the residential proxy service run by publicly traded Israeli firm Alarum Technologies, cutting off access to roughly two million compromised devices, the Popa botnet, made up of Android boxes, smart TVs, and streaming sticks conscripted without their owners’ consent. And a 19-year-old dual U.S.-Estonian citizen, Peter Stokes, was extradited from Finland to Chicago to answer for alleged Scattered Spider membership. Both good news. Neither changes the economics.

Vulnerabilities Worth Your Attention

This was a maximum-severity kind of week. Start here:

  • Oracle E-Business Suite, CVE-2026-46817 (CVSS 9.8) — actively exploited. Auth-and-privilege flaw in Oracle Payments that hands over the instance. If you run EBS, this is your fire.
  • SimpleHelp, CVE-2026-48558 (CVSS 10.0) — an OIDC authentication bypass being exploited to drop the new TaskWeaver and Djinn Stealer malware. Djinn goes straight for cloud and AI credentials.
  • SharePoint, CVE-2026-45659 (CVSS 8.8) — patched in May, now in CISA’s KEV catalog after active exploitation. You had two months.
  • Progress Kemp LoadMaster, CVE-2026-8037 (CVSS 9.6/9.8) — pre-auth root command injection, patch available, exploitation attempts already observed. If the API is enabled, update.
  • Adobe ColdFusion and Campaign Classic — seven CVSS 10.0 flaws patched. ColdFusion remains a magnet.
  • A fresh CitrixBleed on NetScaler was exploited immediately on public PoC release, while Anubis affiliates keep milking the original Citrix Bleed 2 (CVE-2025-5777). Citrix also patched six more NetScaler bugs.

Two that lack patches and deserve nervous attention: an unauthenticated RCE in Argo CD’s repo-server (no fix, no CVE, full Kubernetes cluster takeover if the port is reachable) and seven flaws in FatFs, the tiny filesystem library baked into millions of cameras, drones, controllers, and hardware wallets. And Cursor’s DuneSlide flaws (CVE-2026-50548 / -50549) let a single crafted prompt escape the sandbox and run OS-level code with no click required, a preview of a whole new patch category.

Threat Actors & Campaigns

FortiBleed matured from theft to monetization: credentials harvested from hundreds of thousands of FortiGate firewalls are now feeding INC and Lynx ransomware operations, with one operator caught working negotiation panels for both. That’s the supply chain of extortion in one sentence.

North Korea stayed busy with the PolinRider campaign, 108 malicious packages and extensions across npm, Packagist, Go, and Chrome, plus a separate set of npm packages impersonating Rollup polyfill tooling to lift developer secrets. ToddyCat deployed Umbrij, abusing OAuth to read corporate Gmail via the Google API. Kaspersky surfaced Armored Likho hitting government and power-sector targets across Russia, Brazil, and Kazakhstan. A China-linked group is probing Southeast Asian critical systems, and separately Iran, Russia, and China are all reportedly poking at water utilities through the usual sins: weak passwords, exposed PLCs, no segmentation. And ChocoPoC is a nice touch, a RAT hidden in fake proof-of-concept exploit repos, aimed squarely at the researchers who click these things for a living.

Then there’s ClickFix, now formally the dominant malware delivery method. Fake “prove you’re human” pages hand out per-visitor payloads from API-driven back ends. Opera shipped a Paste Protect feature to counter it, which tells you how mainstream the con has become.

The Bigger Picture

The AI story stopped being theoretical. JADEPUFFER (per Sysdig) is the first ransomware attack researchers believe was run end-to-end by an LLM agent, from breach through credential theft, lateral movement, and database wipe, using a Langflow RCE as the front door. Around it: BioShocking tricks AI browsers into leaking credentials by convincing them they’re playing a game; GuardFall

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.