This Week’s Verdict

This was the week the industry finished pretending that “AI security” was a future problem. It is not. It is a badly configured Git repository, a coding agent that reads a malicious PNG and hands over your secrets, and an infostealer that ships one binary each for Windows, macOS, and Linux because efficiency matters even to criminals. The tools got smarter. The mistakes stayed exactly the same.

The Breaches

Progress Software spent the week telling ShareFile customers to physically shut down their on-premises Storage Zone Controllers over a “credible external security threat.” When a vendor tells you to power off production servers rather than patch them, that is not caution. That is a vendor that does not yet understand what it is dealing with, which is worse than a CVE.

Elsewhere, AssuranceAmerica lost 6.9 million driver’s license numbers, and a DHS database was hacked, both of which barely registered against the week’s noise. Healthcare continued its slow-motion collapse, with Dark Reading noting that attacks on healthcare service providers more than doubled in the first half of 2026. Attackers have worked out that the soft underbelly is not the hospital, it is the billing company three vendors removed from it.

Two things worth a grim smile: a Ryuk affiliate pled guilty and faces fifteen years, and Angelo Martino, a former ransomware negotiator, got seventy months for quietly working the other side of the table on BlackCat attacks. Three US security professionals have now been sentenced for helping the gangs they were supposed to fight. Trust your incident responders, but read their tax returns.

Vulnerabilities Worth Your Attention

The one you cannot ignore is CVE-2026-50746, a perfect 10.0 access-control flaw in Ubiquiti UniFi Connect, part of a batch that also hit Talk, Access, Protect, and UniFi OS. Command execution and privilege escalation on gear that sits at the network edge in tens of thousands of small offices. Patch it.

BeyondTrust shipped fixes for two critical pre-auth bypasses (CVE-2026-40138, CVSS 9.2) in Remote Support and Privileged Remote Access. These are the tools that grant privileged access by design, so an unauthenticated takeover is exactly as bad as it sounds.

GhostLock (CVE-2026-43499) is a fifteen-year-old Linux kernel local privilege escalation that has shipped by default in essentially every mainstream distribution since 2011. No special permissions, no network needed. It will be quietly living in your fleet for a long time.

CISA added four exploited flaws to KEV, including a 10.0 Adobe ColdFusion path traversal (CVE-2026-48282) and a Langflow bug that is already doing real work (see below). And CitrixBleed is bleeding again: attackers jumped on the latest NetScaler memory-disclosure flaw within hours of the PoC dropping. If you own NetScaler, you already know the drill, or you should by now.

Also note the Zimbra Classic Web Client stored XSS (no CVE yet, patch anyway), six U-Boot bootloader flaws enabling boot-time code execution, a hidden admin backdoor in Tenda router firmware (CVE-2026-11405), and XRING, an unpatched crash bug in Alibaba’s XQUIC HTTP/3 library that needs 260 bytes of perfectly legal traffic to take a server down. There is no fix for that last one yet.

Threat Actors & Campaigns

The identity attackers had a busy week. Okta flagged vishing against Microsoft 365 users, including O-UNC-066 running fake Entra passkey enrollment, while a new extortion crew called Helix worked SharePoint environments with vishing, device-code phishing, and MFA abuse. The DEBULL tooling abused Microsoft’s device-code flow with collaboration-themed lures. The passkey era has not killed phishing. It has just moved the fight to the enrollment step, exactly where the humans still live.

On the state-sponsored side: China-linked Silver Fox deployed the Rust-based MODBEACON RAT, UAT-7810 expanded its LapDogs ORB network with new LONGLEASH malware, and suspected China-aligned actors hit Roundcube at North American universities. Iran-linked MOIS operators used a new C2 framework called Cavern against Israeli IT and government targets. And in the most 2026 story imaginable, China- and India-aligned groups were caught targeting the same Balochistan police force, which is either a coincidence or the world’s least private crime scene.

Supply chain remained the reliable disaster. The jscrambler npm package (8.14.0) shipped a Rust infostealer via a preinstall hook, flagged by Socket six minutes after publication. The Injective Labs SDK GitHub repo was compromised to push a wallet-key stealer. Meanwhile GitHub finally shipped npm 12 with install scripts off by default, roughly a decade after everyone agreed that was the obvious move.

The Bigger Picture

Two threads tie this week together, and both run through AI.

The first: AI is now a first-class part of the attack surface, and nobody built defenses for it. JadePuffer is being called the first complete LLM-driven ransomware attack, chaining a Langflow flaw to steal data and encrypt systems. A lone attacker breached an AWS environment in 72 hours using AI to chain cloud weaknesses. And the AI coding tools themselves are the problem: Ghostcommit hid a prompt injection in a PNG that CodeRabbit and Bugbot never opened, then talked a coding agent into cloning a clean-looking GitHub repo and running the payload during setup, invisible to the scanners, the AI reviewers, and the human who was theoretically supervising all three. Amazon patched a companion flaw in Q Developer (CVE-2026-12957) that let a malicious repo do much the same thing through a booby-trapped MCP config. The pattern does not change: the machine is trusted, the machine is fooled, and the machine is holding your credentials.

The second thread is quieter and worse. AI is not only the weapon now, it is also the target, and the defenses under it are structurally thin. The Gaslight macOS stealer shipped a prompt injection aimed squarely at malware analysts’ own AI tooling, trying to talk their assistants into refusing to analyze the sample. A paper making the rounds this week (Schneier flagged it) explains why that keeps working: the role tags we use to separate instructions from data were a formatting convention that quietly became the security boundary, and that boundary does not actually survive inside the model’s representations. Translated out of the academic register, prompt injection is not a bug waiting for a patch, it is a property of how these systems think. We wired AI into the analyst’s chair, the reviewer’s seat, and the developer’s terminal before anyone could reliably tell it which text to trust. It still cannot, and this week attackers made a comfortable living in that gap.

Patch. Now.

  • Ubiquiti UniFi Connect: patch CVE-2026-50746 (10.0) and the companion Talk, Access, Protect, and UniFi OS fixes today. This is edge gear with command execution, so treat it as already targeted.
  • BeyondTrust Remote Support and Privileged Remote Access: apply the pre-auth bypass fix (CVE-2026-40138). Anything that hands out privileged access by design earns an emergency window.
  • Adobe ColdFusion: CVE-2026-48282 is on CISA KEV and being exploited in the wild. Patch it or take it offline.
  • NetScaler: if you own it, assume CitrixBleed is in play, patch, and rotate sessions afterward. The PoC is public and attackers moved within hours.
  • Linux fleet: schedule the kernel update for GhostLock (CVE-2026-43499). A fifteen-year-old local privilege escalation in nearly every distribution is not a drill.
  • Developers: move to npm 12 and confirm install scripts are off. Treat any repository your coding agent touches as untrusted input, because this week it was.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

It was already when. You just had not read the logs yet.