Microsoft patched a record 622 CVEs and openly credited AI for the flood, which is the industry equivalent of building a bigger firehose and then admitting you also built the fire. Meanwhile a Russian tourist may or may not be a REvil operator, a robot vacuum can hand over your Wi-Fi password, and the single most effective attack technique of the week was convincing people to paste a command into a box and press Enter. Nothing new under the sun, just more of it, faster.
The theme this week is food and consultancies, which is not a sentence I expected to write. Coca-Cola suspended Fairlife dairy production across the US after a ransomware attack, and Japan’s frozen food giant Nichirei pulled its systems offline on July 13. Ransomware crews have figured out that hitting production lines gets a faster payout than hitting spreadsheets, and empty shelves make excellent leverage.
On the professional-services side, Ernst & Young disclosed a breach traced to a compromised third-party support ticket system, and Abbott Laboratories is juggling two separate incidents at once, including unauthorized access to legacy Exact Sciences systems in its cancer diagnostics business. Legacy plus third-party is the breach recipe that never goes out of style.
The one worth reading closely is CISA’s own GitHub leak, dissected by Krebs. A contractor left dozens of internal credentials, including AWS GovCloud keys, in a public repo for nearly six months. The agency that tells everyone else to lock the door left it open, and only found out because a journalist told them. Humbling, and instructive: the postmortem is the most useful thing CISA published this week.
Also notable: two Scattered Spider members got five and a half years each for the 2024 TfL hack, a reminder that this cohort is young, sloppy, and increasingly caught.
Start with the ones being exploited right now. SonicWall SMA 1000 appliances are under active attack via two zero-days, CVE-2026-15409 (SSRF, CVSS 10.0) and a command-execution partner, chained to root by Inc ransomware and tracked by Volexity as UTA0533. If you run these appliances, assume compromise and investigate, do not just patch.
Microsoft SharePoint gets another one: CVE-2026-58644 (CVSS 9.8), a deserialization RCE already in CISA’s KEV catalog with a same-week federal deadline. CISA also ordered agencies to patch two actively exploited Fortinet FortiSandbox flaws by the weekend.
Then the record-setting Patch Tuesday: 622 CVEs, three zero-days, two under active attack. Grab the exploited ones first and let the other 619 wait their turn. Hours later, a researcher dropped LegacyHive, a Windows User Profile Service privilege-escalation PoC that works on fully patched systems, because of course they did.
The quieter ones that matter: 7-Zip (RCE via malicious archives, update to 26.02), the wp2shell WordPress Core RCE (unauthenticated code execution on a bare install, public PoC available, patch immediately), Zoom for Windows (CVE-2026-53412, CVSS 9.8, account takeover), and SAP NetWeaver ABAP (CVE-2026-44747, CVSS 9.9). And HollowByte, an OpenSSL DoS that lets an eleven-byte request pin up to 131 KB of memory that never comes back until the process restarts. OpenSSL shipped the fix in June with no CVE and no changelog note, which is its own small scandal.
Special mention to the 11 Microsoft-signed UEFI shims that stayed trusted for years, quietly reopening the Secure Boot bypass door everyone assumed was shut.
ClickFix owned the week. Russia’s UAC-0145 (a Sandworm sub-cluster) used ClickFix CAPTCHAs against Ukrainian targets; ACR Stealer rode ClickFix lures into enterprise Microsoft 365 and OneDrive, prompting a Microsoft warning; and new families TELEPUZ and the macOS ClickLock (which kills your apps on a loop until you type your password) piled on. The technique rents at scale, dodges EDR, and needs no exploit. It just needs you.
Elsewhere: China-linked Daxin resurfaced in a Taiwanese manufacturer after four years dark, alongside a new pre-login backdoor called Stupig. North Korea’s Contagious Interview crew hid OtterCookie-aligned payloads in SVG files inside fake coding tests. ShinyHunters-style actors spent a year walking into Salesforce environments through OAuth trust rather than any flaw. And the supply chain kept bleeding: seven malicious Vite npm packages (ViteVenom), compromised @asyncapi packages, and 148 fake student-proxy packages that turned browsers into a DDoS botnet.
Two threads tie the week together, and both are about trust rather than exploits.
The first is that the human paste-box is the perimeter now. ClickFix, ACR Stealer, ClickLock, and the fake-coding-test crowd all skip the vulnerability entirely and ask the user to do the work. No CVE, no patch, no EDR alert worth the name. When your most effective attack requires zero exploits, your most effective defense is not another appliance.
The second is that AI is now feeding both sides of the vulnerability pipeline. Microsoft explicitly blamed AI for tripling its CVE count, and Krebs noted the same. More findings is not the same as more safety when defenders still have to triage by hand. Meanwhile the agentic-AI attack surface is filling in fast: the Cursor IDE auto-executing a rogue git.exe from a cloned repo, Grok Build quietly uploading entire Git repositories to xAI storage, the Claude for Chrome extension flaws letting rogue extensions drive your Gmail, and data-injection tricks that make agents misclick. We are wiring these tools into everything before we have agreed on what they are allowed to touch. That bill comes due later, and it will not be small.
Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.
It’s not if, it’s already when.
More: Issues · Field Notes · RTFM
New Issue every week. Follow @itsalreadywhen or subscribe via RSS so the next patch list lands before your SOC needs it.
]]>This was the week the industry finished pretending that “AI security” was a future problem. It is not. It is a badly configured Git repository, a coding agent that reads a malicious PNG and hands over your secrets, and an infostealer that ships one binary each for Windows, macOS, and Linux because efficiency matters even to criminals. The tools got smarter. The mistakes stayed exactly the same.
Progress Software spent the week telling ShareFile customers to physically shut down their on-premises Storage Zone Controllers over a “credible external security threat.” When a vendor tells you to power off production servers rather than patch them, that is not caution. That is a vendor that does not yet understand what it is dealing with, which is worse than a CVE.
Elsewhere, AssuranceAmerica lost 6.9 million driver’s license numbers, and a DHS database was hacked, both of which barely registered against the week’s noise. Healthcare continued its slow-motion collapse, with Dark Reading noting that attacks on healthcare service providers more than doubled in the first half of 2026. Attackers have worked out that the soft underbelly is not the hospital, it is the billing company three vendors removed from it.
Two things worth a grim smile: a Ryuk affiliate pled guilty and faces fifteen years, and Angelo Martino, a former ransomware negotiator, got seventy months for quietly working the other side of the table on BlackCat attacks. Three US security professionals have now been sentenced for helping the gangs they were supposed to fight. Trust your incident responders, but read their tax returns.
The one you cannot ignore is CVE-2026-50746, a perfect 10.0 access-control flaw in Ubiquiti UniFi Connect, part of a batch that also hit Talk, Access, Protect, and UniFi OS. Command execution and privilege escalation on gear that sits at the network edge in tens of thousands of small offices. Patch it.
BeyondTrust shipped fixes for two critical pre-auth bypasses (CVE-2026-40138, CVSS 9.2) in Remote Support and Privileged Remote Access. These are the tools that grant privileged access by design, so an unauthenticated takeover is exactly as bad as it sounds.
GhostLock (CVE-2026-43499) is a fifteen-year-old Linux kernel local privilege escalation that has shipped by default in essentially every mainstream distribution since 2011. No special permissions, no network needed. It will be quietly living in your fleet for a long time.
CISA added four exploited flaws to KEV, including a 10.0 Adobe ColdFusion path traversal (CVE-2026-48282) and a Langflow bug that is already doing real work (see below). And CitrixBleed is bleeding again: attackers jumped on the latest NetScaler memory-disclosure flaw within hours of the PoC dropping. If you own NetScaler, you already know the drill, or you should by now.
Also note the Zimbra Classic Web Client stored XSS (no CVE yet, patch anyway), six U-Boot bootloader flaws enabling boot-time code execution, a hidden admin backdoor in Tenda router firmware (CVE-2026-11405), and XRING, an unpatched crash bug in Alibaba’s XQUIC HTTP/3 library that needs 260 bytes of perfectly legal traffic to take a server down. There is no fix for that last one yet.
The identity attackers had a busy week. Okta flagged vishing against Microsoft 365 users, including O-UNC-066 running fake Entra passkey enrollment, while a new extortion crew called Helix worked SharePoint environments with vishing, device-code phishing, and MFA abuse. The DEBULL tooling abused Microsoft’s device-code flow with collaboration-themed lures. The passkey era has not killed phishing. It has just moved the fight to the enrollment step, exactly where the humans still live.
On the state-sponsored side: China-linked Silver Fox deployed the Rust-based MODBEACON RAT, UAT-7810 expanded its LapDogs ORB network with new LONGLEASH malware, and suspected China-aligned actors hit Roundcube at North American universities. Iran-linked MOIS operators used a new C2 framework called Cavern against Israeli IT and government targets. And in the most 2026 story imaginable, China- and India-aligned groups were caught targeting the same Balochistan police force, which is either a coincidence or the world’s least private crime scene.
Supply chain remained the reliable disaster. The jscrambler npm package (8.14.0) shipped a Rust infostealer via a preinstall hook, flagged by Socket six minutes after publication. The Injective Labs SDK GitHub repo was compromised to push a wallet-key stealer. Meanwhile GitHub finally shipped npm 12 with install scripts off by default, roughly a decade after everyone agreed that was the obvious move.
Two threads tie this week together, and both run through AI.
The first: AI is now a first-class part of the attack surface, and nobody built defenses for it. JadePuffer is being called the first complete LLM-driven ransomware attack, chaining a Langflow flaw to steal data and encrypt systems. A lone attacker breached an AWS environment in 72 hours using AI to chain cloud weaknesses. And the AI coding tools themselves are the problem: Ghostcommit hid a prompt injection in a PNG that CodeRabbit and Bugbot never opened, then talked a coding agent into cloning a clean-looking GitHub repo and running the payload during setup, invisible to the scanners, the AI reviewers, and the human who was theoretically supervising all three. Amazon patched a companion flaw in Q Developer (CVE-2026-12957) that let a malicious repo do much the same thing through a booby-trapped MCP config. The pattern does not change: the machine is trusted, the machine is fooled, and the machine is holding your credentials.
The second thread is quieter and worse. AI is not only the weapon now, it is also the target, and the defenses under it are structurally thin. The Gaslight macOS stealer shipped a prompt injection aimed squarely at malware analysts’ own AI tooling, trying to talk their assistants into refusing to analyze the sample. A paper making the rounds this week (Schneier flagged it) explains why that keeps working: the role tags we use to separate instructions from data were a formatting convention that quietly became the security boundary, and that boundary does not actually survive inside the model’s representations. Translated out of the academic register, prompt injection is not a bug waiting for a patch, it is a property of how these systems think. We wired AI into the analyst’s chair, the reviewer’s seat, and the developer’s terminal before anyone could reliably tell it which text to trust. It still cannot, and this week attackers made a comfortable living in that gap.
Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.
It was already when. You just had not read the logs yet.
]]>The machines finally learned to do the whole job. An LLM agent ran a ransomware attack from breach to database wipe without a human touching the keyboard, and yet the biggest real-world losses this week still came from the same unpatched appliances we’ve been nagging you about for a year. The future arrived. It’s using the past to get in.
Medtronic is notifying 3.8 million people that ShinyHunters walked out of its corporate IT with personal and medical data back in April. The lag between “April intrusion” and “July notification” is, as usual, the part that should bother you most. Medical data doesn’t expire, and neither does the patience of whoever’s now holding it.
Elsewhere, a U.S. government entity quietly paid roughly $1 million to a group calling itself Kairos, according to a Ransom-ISAC case study built from a leaked negotiation chat and the blockchain trail the payment left behind. The wrinkle: Kairos never appears to have encrypted anything. Pure data-theft extortion. The ransomware brand is now optional. The shakedown is the product.
On the enforcement side of the ledger, the FBI and Google (with Lumen and others) seized hundreds of domains tied to NetNut, the residential proxy service run by publicly traded Israeli firm Alarum Technologies, cutting off access to roughly two million compromised devices, the Popa botnet, made up of Android boxes, smart TVs, and streaming sticks conscripted without their owners’ consent. And a 19-year-old dual U.S.-Estonian citizen, Peter Stokes, was extradited from Finland to Chicago to answer for alleged Scattered Spider membership. Both good news. Neither changes the economics.
This was a maximum-severity kind of week. Start here:
Two that lack patches and deserve nervous attention: an unauthenticated RCE in Argo CD’s repo-server (no fix, no CVE, full Kubernetes cluster takeover if the port is reachable) and seven flaws in FatFs, the tiny filesystem library baked into millions of cameras, drones, controllers, and hardware wallets. And Cursor’s DuneSlide flaws (CVE-2026-50548 / -50549) let a single crafted prompt escape the sandbox and run OS-level code with no click required, a preview of a whole new patch category.
FortiBleed matured from theft to monetization: credentials harvested from hundreds of thousands of FortiGate firewalls are now feeding INC and Lynx ransomware operations, with one operator caught working negotiation panels for both. That’s the supply chain of extortion in one sentence.
North Korea stayed busy with the PolinRider campaign, 108 malicious packages and extensions across npm, Packagist, Go, and Chrome, plus a separate set of npm packages impersonating Rollup polyfill tooling to lift developer secrets. ToddyCat deployed Umbrij, abusing OAuth to read corporate Gmail via the Google API. Kaspersky surfaced Armored Likho hitting government and power-sector targets across Russia, Brazil, and Kazakhstan. A China-linked group is probing Southeast Asian critical systems, and separately Iran, Russia, and China are all reportedly poking at water utilities through the usual sins: weak passwords, exposed PLCs, no segmentation. And ChocoPoC is a nice touch, a RAT hidden in fake proof-of-concept exploit repos, aimed squarely at the researchers who click these things for a living.
Then there’s ClickFix, now formally the dominant malware delivery method. Fake “prove you’re human” pages hand out per-visitor payloads from API-driven back ends. Opera shipped a Paste Protect feature to counter it, which tells you how mainstream the con has become.
The AI story stopped being theoretical. JADEPUFFER (per Sysdig) is the first ransomware attack researchers believe was run end-to-end by an LLM agent, from breach through credential theft, lateral movement, and database wipe, using a Langflow RCE as the front door. Around it: BioShocking tricks AI browsers into leaking credentials by convincing them they’re playing a game; GuardFall
Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.
The future arrived this week, and it looks suspiciously like the past wearing an AI costume. Attackers weaponized a Cisco flaw in under 24 hours, turned developers’ own AI coding assistants into reverse shells, and convinced Signal users to hand over their own backup keys. Meanwhile, three governments offered bounties, signed executive orders, and seized streaming domains, none of which patched a single firewall.
The week’s headline number belongs to FortiBleed: a Russian-speaking access broker built a Golang sniffer that turned 430,000 FortiGate firewalls into credential-stealing machines, harvesting an estimated 110 million credentials with valid admin and VPN logins for nearly 74,000 systems still floating around. When your perimeter device becomes the thing leaking your perimeter, you no longer have a perimeter. You have a liability with a CVE history.
Elsewhere, KDDI in Japan disclosed a breach exposing up to 14.2 million email logins across six ISPs sharing one email system, a reminder that “shared infrastructure” is a synonym for “shared blast radius.” The NAIC (the U.S. insurance regulators’ group) got hit through Oracle PeopleSoft, with ShinyHunters claiming 3.1 TB stolen. A Texas Parks and Wildlife vendor leaked passport and driver’s license data for over three million Texans, once again a high-value credential exposed through a low-value system that had no business holding it. And Polymarket lost $3 million when attackers compromised a third-party vendor and injected a script into the frontend; the company is reimbursing, which is more than most.
The throughline: nobody breached these organizations directly. They breached the vendor, the shared mailbox, the OAuth token. The Salesforce campaign expanding via breached vendor Klue says the same thing. Your security is now a weighted average of everyone you’ve ever integrated with.
Three items demand action this week.
Cisco Unified CM (CVE-2026-20230) and Cisco Catalyst SD-WAN (CVE-2026-20245) are both being exploited. The SD-WAN flaw was hit as a zero-day two months before disclosure via rogue peering to reach root. The CUCM flaw went from PoC to in-the-wild exploitation in under 24 hours, and CISA gave federal agencies until Sunday to fix it. If you run Cisco voice or SD-WAN, you’re already late.
libssh2 (CVE-2026-55200, CVSS 9.2) flips the usual SSH threat model: a malicious server can corrupt memory on a connecting client, no credentials, no interaction. A public PoC is out, and this library is embedded in more software than anyone wants to inventory. Check your dependencies.
SimpleHelp (CVE-2026-48558) is being exploited to drop the new cross-platform Djinn Stealer. Oracle E-Business Suite (CVE-2026-46817), PTC Windchill, and Lantronix EDS5000 (CVE-2025-67038, CVSS 9.8) are all on CISA’s exploited list. On the Linux side, two local-root kernel bugs, DirtyClone (CVE-2026-43503) and pedit COW (CVE-2026-46331), both shipped with working public exploits within a day of disclosure. Patch your kernels; the proof-of-concept authors are not waiting for you.
Russia owned the narrative. The FBI and CISA warned that intelligence-linked actors (UNC5792, UNC4221) phishing Signal users have evolved to steal Signal Backup Recovery Keys: hand it over once and the attacker reads your message history indefinitely. State offered $10 million for information on either group. Ukraine’s SSU and the FBI detailed the same campaign using fake support texts. Gamaredon ran 35 spear-phishing campaigns against Ukraine with upgraded loaders, and Turla debuted a new .NET backdoor called STOCKSTAY. The Cellebrite revelation (Russia using the tool on a jailed activist’s iPhone three months after the supposed sales cutoff) is a useful reminder that “we stopped selling” and “they stopped using” are different sentences.
China-aligned Mustang Panda abused Zoho WorkDrive as a command channel against Indian government and hydropower targets, while CL-STA-1062 dropped the TinyRCT backdoor on Southeast Asian energy and government systems. On the criminal side, two Scattered Spider members pleaded guilty over the Transport for London attack, and law enforcement disrupted the Amadey and StealC infrastructure, recovering 27 million credentials.
This was the week AI stopped being a slide deck and became an attack surface. Researchers turned Claude Code into a reverse shell using a clean-looking repo. A flaw in Amazon Q Developer (CVE-2026-12957) let a malicious repo steal cloud credentials via MCP configs. Fake AI agent “skills” sailed through every security scanner and reached 26,000 agents. The Gaslight macOS stealer embeds prompt injection to derail AI analysts, and at least one malware author is now stuffing fake nuclear-weapons text into payloads so AI scanners refuse to read them. Schneier’s pointer to research on prompt injection explains why this isn’t a bug to be patched: role bo
]]>The big theme this week is that the expensive, sophisticated attacks aren’t the ones hurting you. The boring ones are. ShinyHunters is methodically working its way through Oracle PeopleSoft installations like a man checking parking meters for unlocked doors, and three different nation-states have collectively figured out that you don’t need a zero-day to wreck a water treatment plant when the password is still on the sticker. Welcome to another week where the fundamentals lost.
The story this week isn’t a breach, it’s a campaign, and it has a body count. Nissan disclosed that current and former employee data was stolen after attackers exploited an Oracle PeopleSoft zero-day. The same flaw, the same group: ShinyHunters, the extortion crew that has spent the last few years monetizing other people’s bad days.
The National Association of Insurance Commissioners (NAIC) got pulled into the same dragnet, and to their credit they’re being relatively honest about the damage: publicly available data, outdated logs, and configuration files. That’s the closest thing to good news in this digest: a victim that segmented well enough that the thieves walked out with the equivalent of an empty filing cabinet and some old receipts. Take note of the contrast. Nissan lost employee PII; NAIC lost yesterday’s garbage. The difference is architecture and discipline, not luck.
What both incidents reveal is the obvious thing nobody wants to say out loud: when a single PeopleSoft zero-day hits, it doesn’t hit one organization. It hits everyone running the same unpatched stack, and ShinyHunters is patient enough to harvest them one at a time.
The Oracle PeopleSoft zero-day is the only vulnerability that genuinely matters this week, precisely because it’s already being exploited in the wild against named victims. PeopleSoft is HR and ERP plumbing: it sits on top of the data you least want stolen (employee records, payroll, benefits) and it tends to be the kind of system that gets stood up once and then ignored for a decade because “it just works.” That neglect is exactly what’s being weaponized. If you run PeopleSoft, you are not a bystander to the Nissan and NAIC stories. You’re the next paragraph.
If you’re waiting for me to pad this section with a CVE that lets someone theoretically crash a printer under lab conditions, you’ve got the wrong newsletter.
ShinyHunters owns the week, and their playbook is depressingly effective: find a widely deployed enterprise platform, develop or acquire a zero-day, and then quietly run the table on every exposed instance before extorting the victims one by one. This isn’t innovation. It’s industrialization.
The more alarming entry is the trio of Iran, Russia, and China turning their attention to water systems. The reporting is clear about the method, and it should embarrass everyone: weak passwords, internet-exposed PLCs, and flat networks with no segmentation. These aren’t nation-state cyber-weapons; they’re the digital equivalent of finding the gate unlocked. The geopolitical framing makes it sound sophisticated. The technical reality is that critical infrastructure operators left the front door open and taped a key under the mat.
On the consumer-malware front, Microsoft caught a malicious Chrome extension impersonating Perplexity, the AI search engine. It logged everything users searched and, this is the nasty part, captured every character typed into the address bar before routing it through an attacker server and quietly redirecting to the real results. Google pulled it after disclosure. The lesson here is old and unlearned: browser extensions are software running with terrifying privileges inside the one application you use for everything, and “it has an AI logo” is not a security review.
Two threads connect this week, and they tie into the same knot.
First: attackers have stopped paying for sophistication they don’t need. ShinyHunters used a zero-day, sure, but the rest of the kill chain is ruthless efficiency, not wizardry. The water-system attackers used nothing but default credentials and exposure. The fake Perplexity extension was social engineering wearing this year’s buzzword. Across the board, the offense is optimizing for return on effort, and we keep handing them cheap wins.
Second, and more uncomfortably: the systems we trust least to be patched are the ones holding our most sensitive data and our most critical functions. PeopleSoft holds employee lives in spreadsheet form. Water PLCs hold an actual city’s drinking supply. Both categories share a fatal trait: they’re “set and forget” infrastructure that nobody owns day-to-day. The breaches this week aren’t a failure of technology. They’re a failure of ownership. Somebody, somewhere, decided those systems were finished. The attackers disagreed.
And before anyone gets too smug about surveillance and privacy, yes, there was a story this week about graphic tees designed to confuse facial-recognition cameras. It’s a cute reminder that the threat model most people actually worry about (being watched) is wildly different from the threat model that’s actually emptying their employer’s HR database. Spend your anxiety wisely.
A short list, in priority order:
Somewhere between the vendor press releases, the conference keynotes, and the breathless “CRITICAL ZERO-DAY” headlines, the actual signal got lost.
This is the signal.
It’s Already When. is a weekly digest of what actually mattered in cybersecurity: the breaches worth understanding, the vulnerabilities worth patching, the threat actors worth watching. Written by someone who has been in this industry long enough to be tired of the noise.
No sponsored content. No vendor relationships. No fear-mongering. Just what happened and why it matters, in plain English.
Every week, on Sundays:
Security professionals who want the brief. IT teams who need to explain risk to leadership. Curious people who want to understand what’s happening in the digital world without a cybersecurity degree.
If you’ve ever read a threat intel report and thought just tell me what it means, this is for you.
Subscribe via RSS. Issue #001 drops next Sunday.
It’s already when. It’s been when for a while.
]]>