Microsoft expects more Windows security updates ahead, not because the code got worse, but because it is using AI to find flaws it would otherwise have missed. More patches can mean a safer product, if you can keep up with them.

Microsoft has taken apart a destructive Windows backdoor called GigaWiper that stitches disk wiping, fake ransomware, and spyware into operator-selectable commands. It is a reminder that destruction, not a payout, is sometimes the actual goal.

npm version 12 disables install scripts by default, closing one of the most abused paths in software supply chain attacks, and deprecates access tokens that sidestepped two-factor authentication. It is overdue, and it will break a few workflows.

Researchers showed that attackers can weaponize the fake package and command names AI assistants hallucinate, registering them in advance so that following the assistant's confident but wrong suggestion installs malware. They chained it all the way to remote code execution.

A backdoor in multiple Tenda router firmware versions, CVE-2026-11405, lets unauthenticated attackers reach the admin interface. There is no fix yet, and home and small-office routers are exactly what botnets hunt.

AssuranceAmerica, a US auto insurer, has disclosed a breach affecting close to 6.9 million drivers after attackers reached its systems earlier this year. Insurance records are a quiet goldmine for fraud and identity theft.

Microsoft has shipped a patch for a zero-day in Microsoft Defender, dubbed RoguePlanet, disclosed shortly after June's Patch Tuesday. A flaw in the endpoint tool millions rely on is a reminder that defenses are attack surface too.

Researchers found that six widely used AI coding assistants can be tricked by a booby-trapped repository into running an attacker's code on the developer's machine, using a decades-old symlink trick against the tool's own permission prompt.

Researchers showed that a normal-looking issue on a public repository can trick GitHub's agentic workflows into leaking the contents of an organization's private repos. As AI agents move into the build pipeline, their inputs become a new place to attack.

GhostLock, CVE-2026-43499, is a 15-year-old Linux kernel flaw that lets any authenticated user seize full root and break out of containers on most distributions. A bug this old and this broad rewards patience from defenders and attackers alike.

A critical Gitea flaw, CVE-2026-20896, lets attackers bypass authentication with a single crafted header and reach private repositories and their secrets. It is already under active exploitation, and source code plus secrets is exactly what an attacker wants.

Ubiquiti shipped fixes for seven critical UniFi OS flaws, including a maximum-severity command-injection bug. On hardware that sits at the edge of countless small business and home networks, a foothold there is a foothold into everything behind it.

A use-after-free flaw hidden in Linux's KVM hypervisor for 16 years, named Januscape (CVE-2026-53359), lets a guest VM corrupt the host kernel and escape to the machine underneath. In multi-tenant cloud, that breaks the core isolation promise.

Researchers at HKUST showed that malicious add-on 'skills' for AI coding agents can slip past static scanners with a simple packing trick while staying fully functional. The plugin economy for AI agents has the same trust-by-default problem as npm and browser extensions.

BeyondTrust patched two critical auth-bypass flaws in its Remote Support and Privileged Remote Access products that let unauthenticated attackers take over installations. When the tool that controls access can itself be bypassed, it becomes a skeleton key.

Researchers found two campaigns hiding prompt injections in malicious websites to hijack autonomous AI agents into making crypto payments the user never authorized. Agentic AI's core feature, acting on what it reads, is exactly what the attackers abuse.

A new Linux kernel vulnerability called Bad Epoll (CVE-2026-46242) lets an unprivileged local user take full root control. It affects Linux desktops, servers, and Android. A fix is available.

North Korea-linked actors flooded npm, Packagist, Go, and Chrome with 108 malicious packages (PolinRider), impersonating real tools to steal developer secrets and crypto. The delivery is the real story: fake job interviews, blockchain dead-drops, and IDE task files that run the moment you open a repo in VS Code or Cursor.

runZero disclosed seven vulnerabilities in FatFs, the FAT/exFAT filesystem library baked into firmware across cameras, drones, industrial controllers, and security appliances. Several remain unpatched, because the code sits deep in devices that rarely get updated.

Synacktiv found an unauthenticated code-execution flaw in Argo CD's repo-server that can lead to full Kubernetes cluster takeover. There is no patch and no CVE assigned yet, so mitigation is on you until Argo ships a fix.

New ConsentFix and ClickFix attacks steal Microsoft 365 session tokens in seconds using fake prompts and malicious OAuth consent flows, bypassing MFA entirely because they steal the token issued after login.

Adobe shipped fixes for seven CVSS 10.0 vulnerabilities in ColdFusion and Campaign Classic, enabling arbitrary code execution, privilege escalation, and file reads. ColdFusion has a long history of rapid post-patch exploitation, so the clock starts now.

Medical device maker Medtronic is notifying 3.8 million people that ShinyHunters accessed its corporate IT in April and stole personal and medical data. A reminder that healthcare breaches are a compliance and risk event, not just an IT one.

Cisco confirmed attackers are exploiting a vulnerability in Unified Communications Manager. A public PoC has existed since disclosure, and the first exploitation attempts appeared within a week, another disclosure-to-attack gap measured in days.

Sysdig documented JADEPUFFER, an attack it calls the first run end-to-end by an AI agent, entering through a year-old Langflow flaw. The capability is real. But two odd details, an untraceable ransom email and an encryption key that was never saved, suggest the story is messier than the headline, and we have seen premature 'first AI ransomware' claims before.

Two flaws in the Cursor AI code editor, named DuneSlide (CVE-2026-50548 and a paired CVE), let an ordinary-looking prompt escape the editor's sandbox and run arbitrary OS commands with zero clicks. It is a clean example of the AI toolchain becoming the attack surface.

Researchers link the FortiBleed credential-theft campaign to active ransomware operations: credentials harvested from hundreds of thousands of FortiGate firewalls are being used by the INC and Lynx ransomware groups for initial access.

A new CitrixBleed vulnerability in NetScaler appliances was exploited immediately after public disclosure using public PoC code, and Anubis ransomware affiliates are exploiting Citrix Bleed 2 (CVE-2025-5777) for initial access. If you run NetScaler, assume you are being scanned right now.

CISA added CVE-2026-45659, a remote code execution flaw in Microsoft SharePoint Server (CVSS 8.8), to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. If you run on-prem SharePoint, this is now a patch-today situation.