Security & Trust

Gravity's CTO showed on AI Engineer that an agent acts on its permissions, not on written rules.

Michael Patterson of Coder argues agents trust what they read, so logs, tickets and docs can carry hidden orders.

Cisco Talos tracked 'A3' evasion for 18 months. The defense echoes how one bank protected unpatchable check printers.

Michael Patterson of Coder argues the key control is where agents run, not what they can do.

A software lock on a device in hand was a speed bump. Whether its Wi-Fi secret holds is still open.

A GitHub specialist said some pipeline agents can use a project's identity and money, not a developer's.

The Rust team fixed the flaw. The wider lesson: any cache that jobs with secrets can write to is a place secrets can end up.

HoneyVAL researchers measured how long fake web systems hold AI attackers, and what that costs the defender

GhostAction's October wave reaches secrets deleted years ago. Rotating today's keys no longer closes the exposure.

A quantum startup says a smaller machine could break today's locks. The real deadline is how long your data must stay secret.

CVE-2026-96890 let a user with push access steer the appliance toward internal hosts. Fixes are available.

A Snorkel AI researcher described models inventing schemas, flooding context and repeating failed fixes.

A Sentry engineer described agents sidestepping a lint rule and inflating test coverage.

Six of seven rich-text renderers check link addresses. The one for non-React sites did not, says a GitHub advisory.

G2i's Gabriel Martinez says the danger is unowned decisions, which AI now produces faster than people can review.

The company says clinical systems and devices were unaffected. At least 360,000 people still had personal data taken.

A flaw in the admin preview let an outside site pass as trusted. The earlier fix checked the sender, not the address.

A GitHub advisory says one route lacked a login rule, and a typo in the error handler exposed internal details.

A permission check set to zero checks nothing, and the rate limit trusts a header the client controls

CVE-2026-106509 affects TechDocs builds run locally or in a container, on versions before the fixes

P7 reduces its on-device footprint and takes live commands from attackers, iVerify reports

Two compromised accounts planted a workflow in 346 repos on October 8. Deleting a secret doesn't remove it.

Anthropic says finding flaws is easier than ever. Checking and fixing them is still slow.

Comparitech's Q3 2026 count is mostly gang claims, so the public record is often the gang's version of events.

Searchlight Cyber says a Go rewrite dropped half a Tor key, so each signature gave the key away.

Huntress saw two chained bugs give attackers SYSTEM-level access, then a crypto miner built to hide from Task Manager.

Microsoft paused KB5002907 after reports of problems on Office 2016 and 2019 devices. It has not said why.

BleepingComputer counts 98 zero-days in phones, printers and AI databases. Patching fixes only what is known.

A co-founder of Gitar (now part of Sonar) says teams must slow down or rubber-stamp changes.

Viren Baraiya of Orkes says the model should choose what happens next, while fixed code handles how.

A WorkOS product manager describes how his company built security into the platform so non-engineers can ship internal apps.

About 2,100 hosts served NVIDIA GPU data with no login; a quarter also exposed the pprof flaw (CVE-2026-47483).

In a multi-country action, officials say Microscan and FishHub were made by a supplier, and aimed at unwatched edge devices

A flaw in enshrined/svg-sanitize shows how a safety check fails when it reads a file differently from the browser.

Orca says the MALFEX campaign began in August 2023. One package went 14 months with no npm advisory.

A check meant to keep an unlocked agent API on one machine trusts a value the caller writes, per a GitHub advisory

A GitHub advisory shows how a plain text field in agents.yaml can become Python on the operator's machine.

IDCF Cloud has locked customers out of consoles in every region. Your recovery plan depends on your provider's choices.

CVE-2026-105745 shows how a safety switch can report 'off' after the risky step has already happened

Reducto's Abhi Arya says the test for an agent product is who finds out when it is wrong, and how fast.

Cisco Talos tracked 84 samples in four families. The tricks are cheap and uneven, but they show where attackers aim.

A flaw in the code generator is copied into every reactive app it builds. Fixing the tool will not fix those apps.

A silent parsing gap let file-upload rules miss the real name. The fix shows why picking one reading is not enough.

A 75% average price cut spreads small models widely. A separate Gray Swan benchmark shows where weak spots remain.

A joint advisory describes an intrusion built from ordinary parts that blend into normal IT work.

Apiiro says FakeGit restarted on October 4. In a sample of commits, nearly all changes touched only a README

STAR Labs found Novinarya's command server stored in a marketplace seller's profile, not in the app

Anthropic says AI rebuilt the implants. ReversingLabs saw five builds with new hashes but the same behavior.

SMA1000 and Splunk fixes share one question: who can make your trusted systems send requests?

Bitdefender found it on thousands of phones in 150+ countries, in place before the owner's first boot.

ESET traces MatchBoil, used by UAC-0099, through upgrades meant to evade security tools and gather more data

The surge came as Russian strikes grew, GreyNoise says. An unpatched recorder can give outsiders eyes on a site.

The plugin checked uploaded files once, then trusted what visitors said about them. Patchstack saw attempts begin October 7.

The suits target security and China claims. The flaws they cite show how a router fix is split between vendor, ISP and customer.

Talos says the phishing kit passed each login step to the real Google, so MFA prompts reached the attacker too.

Oracle told customers the evidence suggests the attacker used stolen customer credentials to reach a legacy server not yet moved to its cloud.

AI now finds bugs faster than people can check and fix them. The scarce resource is human attention.

The sandbox guards generated code. The install step that builds it was the way in, and revoking tokens first can backfire.

A Yubico and Okta survey of 1,890 professionals finds a gap between knowing and doing. Its authors point to day one.

OutSystems CEO Woodson Martin says much of the delay in regulated firms is prudence, though some is plain inertia.

Investigators say hackers copied backup court files. Separately, exposed FARE records on 1.3 million people go back 30 years.

An OutSystems CEO argues a shared model lets apps inherit security rules and lets one patch fix many systems.

Qodo says problems that show up downstream are hard for both coding agents and human reviewers to find.

Qodo says two agents can agree and still be wrong, so teams should log each failure and reuse it.

SANS traced phishing PDFs to Action1, real IT software that appears to report to an attacker-controlled account

Eli Cohen of Snyk argued that more machine-written code and faster attacks leave a backlog defenders cannot clear.

Hugging Face's timeline: a few permissive settings took an AI agent from one pod to cluster-admin in under 13 hours.

AWS found about 30% of unsteered AI findings cited code that did not exist. Its fix was a configuration file.

Unit 42 traces how attackers moved their control address to places a filter has nothing to read

A three-layer design treats engineer trust as the scarce resource and verifies AI claims against the code first.

A Foxit PDF reader, a Photoshop installer and Windows drivers show how a routine desktop is a layered target

CVE-2026-75962 shows how a failed email send can save hostile input in a log that later gets displayed

BAND's CTO says linking agents across users is a hard distributed systems problem that also needs governance.

Google's managed agents run on its servers; the excerpts we saw did not cover replay, logs or liability.

Microsoft's FORGE Lab reports 140 Windows CVEs from AI-assisted research, and says validation and fixes must keep pace.

Socket found Rabby and OKX look-alikes whose code sends wallet recovery phrases to servers the operators run

CrowdStrike read the attacker's own AI logs. They show one open-source tool, several AI models and a short timeline.

A value left empty during template inheritance lets forged markers through, apparently by removing a check

Agents that teach each other spread good lessons and bad ones alike, so the vetting step carries the weight.

CVE-2026-106123: if the connection URI fails to parse, the error text can include the full string, password too

Black Lotus Labs says PoeLLM hides its control address in verse. Blocklists have little to catch.

The agencies point to reused or leaked passwords and fast legacy password storage as what the campaign relies on.

An advisory describes an access check that treats two empty values as a match, for unassigned trainers and unassigned users

John Hammond showed criminal AI brands that looked like scams, then a forum guide to running uncensored models anyone can download.

Version 1.9 reportedly targets Claude Code and Codex CLI files, so an agent's login is only as safe as the machine.

A code-only AI review found the same two flaws. Snyk says only an attack on the running app showed how they connect.

John Hammond relayed a report on one gang's tiny AI costs; our reading is that defenders should plan for volume.

One message was built to fool the employee and the AI assistant that summarizes their mail.

Attackers reached customers through third-party platforms ASOS uses to communicate with them

Halcyon tracked nearly 4,000 underground posts. Its finding: AI tools are lowering the skill bar for attackers.

Apple's Reference Image mode moves proof to the moment of capture. It also raises the question of who vouches.

A Wiz researcher said that with coding agents, developers in many cases do not know what their code contains.

Atlassian says AMP shows what an agent wrote. An IDC analyst says buyers also need to know who checked it.

Wiz's Alon Schindel argued that cutting what is public matters first when AI speeds up exploits.

The state's privacy regulator also faulted central oversight and the decision to keep former students' records.

About 500 servers stopped at Osaka Metropolitan University, while externally hosted and hospital systems kept running

Microsoft tells CISOs the hard part is shifting from finding flaws to choosing which to fix, and how fast.

The model is open-weight, served as a managed service on Bedrock, and its maker reports cyber security strength

Google's bulletin lists the fixes. Whether a phone has them depends on a date string set by its maker.

Ben Dicken of PlanetScale says branching, schema revert and budgets make agent database access safer.

AI-assisted bug reports and duplicate finds drive the change. The release also alters compression, usernames and post-quantum keys.

A store and a children's coloring site were used to trick Ukrainian visitors into installing a data stealer

Lightwell's pitch is that finding bugs is only part of the work. Backporting fixes to pinned versions is the rest.

Chrome blocked the certificates it found. Google says that may not be all of them, so owners should watch their own names.

Unit 42 says an Iranian-aligned group built a coding test to run malware the moment a project opened

A PortSwigger Research author saw models drift toward easy, low-impact results when prompts left room to interpret.

PlanetScale's Ben Dicken says databases need rules for shedding load before surges of agent traffic arrive.

Datadog found credential tools that sort stolen keys by whether they can run AI models, using a four-token test.

Only one of the seven bug collisions involved an AI product. The rest hit a phone, a speaker and a smart home hub.

Developers are rarely the bottleneck. Testing and delivery set how fast an urgent patch reaches users.

The indexed-btree campaign shows why a clean install says little about what code does later.

Patchstack traced one payload through two WordPress plugin flaws. It plants backdoors that outlive the bug.

Mistral Large 4 is a preview with mostly self-reported scores. The real question is who sets the limits on security AI.

Checkmarx's MALFEX findings show why a clean advisory feed does not mean a clean dependency tree

OX Security found 6,370 Shodan-indexed Harbor instances on pre-fix versions. The advisory rates it Moderate.

A US alert says patching and password resets fall short once attackers can disable accounts or change passwords.

The 6.1.2, 6.0.9 and 5.2.18 releases reward teams that know their own setup, not only their version number.

A semicolon Git allowed, plus last-value-wins parsing, was the opening for CVE-2026-3854.

A proof of concept called BigDiskBuster uses free disk space to stop Defender updates. LevelBlue saw no on-screen alert.

CVE-2026-21589 affects eight Atlassian products. Atlassian says no credentials are needed to exploit it.

The sender names Snowflake. ASOS names third-party customer platforms. The gap matters.

METR found a viewer flaw that could have let an agent rewrite the transcript. It has seen no exploitation in evaluations.

CVE-2026-88779 lets unauthenticated attackers crash SAML sign-in, putting VPN and single sign-on access at risk

Docker's Jim Clark argued that risk depends on the tools, context and credentials an agent can reach.

The score is self-reported and covers one bug class. The design points to where security work may be moving: toward evidence.

Laurie Voss of Arize AI says agent failures can look like success unless someone reads the inputs, outputs and traces.

A GitHub advisory describes stored XSS in @vue/server-renderer, but only where apps build HTML attributes from untrusted names

Teams that audit voice agents from text logs may be reading the wrong record, and customers pay for what the log misses.

The ad list sits on a server, outside the code a store reviews, so it can change without an update.

Willem Pienaar of Cleric says models trained to answer fast often blame the first error log they find.

The agency says it is moving from ranking flaws by severity to ranking them by risk. Your team now owns that step.

An IBM engineer says the Instagram bot takeovers show why agents that can edit accounts need pre-launch tests.

Tejas Kumar showed a keyword test and an AI judge both passing bad customer-support answers.

A script sits in the cache disguised as an image. No conventional download happens when the victim runs the command.

CVE-2026-96940 is fixed automatically in Exchange Online. On-premises customers have to install the patch themselves.

385 of 1,781 prebuilt rules are tagged Recommended; 61.8% are deliberately left untagged.

Simon Ritter links it to AI finding bugs faster. JDK 27 also changes memory defaults and adds post-quantum TLS.

Writing now costs almost nothing. Reviewing still costs a person's time, and that gap is breaking arXiv's intake queue.

The intruders reportedly accessed medical data but destroyed nothing. Solar believes the quiet was deliberate.

The FSC has named no cause. Its orders are precautionary, and AI use in the attacks is unconfirmed

The people targeted were the contacts who trusted the sender, not just Nikkei's own systems.

Nozomi Networks found a botnet spreading through a Realtek flaw and hiding commands in STUN-style packets

Authorities say the access abused was a company's lawful right to search the register. How it was used is not yet public.

OWASP's CVE Lite CLI pairs severity with exploitation odds, and shows what a scanner still cannot decide

An AWS demo shows agents writing their own tools mid-run. The open question is who answers if that code fails.

In 45% of the endpoint incidents Huntress recorded in Q1 2026, the intruder used real remote management software.

Synacktiv shows how a values-only rule fails when a chart template inserts settings without escaping them

An AWS developer advocate showed agents that write their own tools, and listed the controls they need first.

Face checks must prove where the video came from, not only that the face looks alive

The AI tool worked as asked. Bee Cheng Hiang's gap was in the request and in the review of its output.

Proofpoint says the password and MFA both succeed. The proxy captures the session.

CVE-2026-104051 shows what happens when an API returns a whole record instead of the fields a caller needs

CVE-2023-54402 needs no login. One hardcoded value opens the door, and Shadowserver saw exploitation evidence in 2024.

CVE-2014-125130 exposes wp-config.php to anyone. In our reading, its score understates what that file unlocks.

A public booking form stores text that runs when a WordPress administrator opens appointment details.

Bitget cites a zero-day in outside security products. SlowMist places it in a service on Product A's nodes.

Synacktiv says it exploited the bug at Pwn2Own over Zigbee. Physical access was used to study the device.

A field guide on Huntress's blog says the first 24 hours test who has authority to act, not how fast engineers type.

The vendor has not answered CISA. Owners of the device must now decide how to contain it or replace it.

Finding a bug is now cheap. Checking whether it is real still takes a person's time.

CISA says Viidure has not responded and plans no fix. Customers must decide what to do on their own.

Files, the database and shared memory restore each other, so cleanup order matters more than deletion.

Rogue agents get the headlines. The quieter risk is agents doing their jobs at a pace your controls never expected.

Eurojust links the group to almost 1,000 attacks. The way in was poorly secured access, often to cloud storage.

DIVD says two Zammad flaws gave an AI attacker speed. It credits segmentation, yet still assumes a breach.

The same work scores high or low depending on the harness and the test. Ask who made the instrument before trusting it.

Synacktiv's mitmproxy walkthrough shows how researchers read and alter app traffic, and where that trust can fail.

CVE-2026-104457 turns page content into database commands. The fix is to move to YesWiki 4.6.7.

CVE-2026-104445 lets any signed sender delete or overwrite other actors' federated entries in YesWiki before 4.6.7

Synacktiv's primer for analysts new to AWS starts with how the environment is organised

CVE-2026-103250 sits in the MongoDB Chat Memory node. NVD's affected ranges end at three versions.

CVE-2026-103266 turns a payment step into a route to a publisher's subscribers. Ghost 6.62.0 is the fixed version.

OX Security says a LiteLLM JWT email-fallback flaw (CWE-290) turns one login token into a permanent account takeover

The Danish university cannot say what was taken or whose. Up to 200,000 people may be affected.

CVE-2026-100555: a check ran on one DNS answer, but the NAS acted on another. It needs an attacker-influenced hostname.

Three critical bugs sit in software that controls who can act as root across Unix and Linux fleets

Five issues in one access-control product show how old flaws and weak credential handling travel inside software you buy

CISA lists two vulnerabilities in the engineering tool. One is a service that runs with more power than its users.

OpenAI's agents hit three outside targets and the law asked little. Whoever pays for failure will set the speed.

Two themes looked harmless and had no live attack. Their leftover code is the risk a later update could use.

Ranked, nearest-match results now sit beside exact ones. Code built for exact answers may not notice the difference.

CVE-2026-19807 is a plugin coding error, but a new tool endpoint made it reachable and each endpoint must check its own access

Agents authorize themselves or get steered by others. One rule answers both: authority must sit below the model.

Two flaws let an AI agent open SSH keys, cloud credentials and API keys. No shell command is needed.

A blank login setting, an LLM key and an open port give strangers a shell. Turning auth on leaves history readable.

A flaw in @a2ui/web_core shows why an agent's output needs the same checks as a stranger's input

CVE-2026-71972 shows how a cosmetic file can be decoded before the next boot stage is verified.

Six flaws in Dell Container Storage Modules score 9.6 to 10.0. Updating is the only fix Dell offers.

CVE-2026-90970 shows that AI prompt templates are code, and self-hosting means you own the patching

CISA says EasyIO Neo EC and CW firmware could expose sensitive data to an attacker. A fix exists; test it first.

BPFDoor and AVERAT samples copy local vendor software and use email traffic, so 'looks normal' stops being a useful test

Each fix blocked one route. The shared design behind the routes stayed the same, according to the researcher.

SequenceHash targets an easy-to-miss cryptographic mistake: hashing several values so their boundaries blur

CISA says Meari has no fix planned for two flaws and did not reply to its outreach.

Google's Advanced Protection now restricts accessibility services to verified tools. The catch is who switches it on.

The new default form makes the reporter show evidence, so the team reading it does not have to dig

PwC's 71-country survey finds cyber budgets set to grow, while continuity plans and data controls lag behind.

Google's new Intrusion Logging targets spyware that erases its tracks. It is optional, and it raises privacy questions.

Huntress traced three server compromises to a member upload feature, then a return visit after a server went live too soon

The firm describes two controls that buy time before patching. Each one has an operating cost.

Ultrastrike found plugin protections that work on Apache but do not apply on Nginx, Caddy and other servers

Train agents never to quit on impossible tasks, and every unwatched channel becomes part of the job

Doctorow argues that a reviewer clearing machine output at scale will miss rare errors, yet still carry the blame.

CVE-2026-104286 needs no login. Until patches ship, who can reach the admin panel is a key control.

A second report, from Cisco Talos, describes a backdoor campaign in Asia that began with ordinary phishing lures

The flaw sits in how some server-rendered sites package data for the browser, not in any login or form.

CVE-2026-54154 could let an unauthenticated attacker take over the appliance. The fix is in version 9.4.1.

In Jamf's analysis, it hides the password in a decoy file and uses it to launch stage two. No infections confirmed.

Insurance payouts show rising downtime costs and heavier relative losses for small firms. The figures are floors.

CVE-2026-50610 needs local access and affects named engine versions, Intrinsec says

Sucuri's analysis of the 'SC' backdoor shows why deleting infected files can leave a site compromised.

CVE-2026-100391 turns a proxy's network position into the attacker's reach. The question is what yours can touch.

Two investigations point to security appliances as the entry point into the exchange's wallet environment

Paths chaining 90–740 numeric segments, sent in bursts, can exhaust memory. Proxy rules can limit exposure.

A correctly configured list of trusted image sources was not enforced. The flaw sat in code the adapter generated.

With staticHeaders enabled, a failed fallback in the Node adapter turns a malformed request into a process exit. Fixed in 11.1.3.

A talk covering CVE-2026-65669 showed an AI assistant obeying a low-privilege user's planted notes

The Pentagon's identity unit says intruders had access from October 2025 to July 2026. The records were unencrypted.

In Truffle's analysis, leak rates for covered secrets fell by about half. Old keys stay live unless issuers revoke.

In a sample of 1,500 popular Artifact Hub charts, the risk sat in the projects behind them, not the charts.

Google also counts more exploited flaws in 2026: 18 a month, up from 10.5. One case was attacked within four days.

One encoded letter in a web address can defeat an API login rule. It can also slip past simple log searches.

Push Security's 2026 data shows phishing that can skip passwords, skip email and hide from scanners

The fix shipped July 20. Microsoft first saw probing July 28. Public disclosure came August 13. A patch does not remove what was left behind.

Microsoft calls script-injection tools unsupported and says they may stop working; users can still sign in. Find those tools first.

A 9.2-rated bug in Fireware OS shows that a firewall must also distrust the servers it connects to

Transluce says none of the probes appear to have worked, though its records are incomplete.

The fixes are in version 15.82. The list shows how much trust a remote access tool holds.

Chrome 154 and Firefox 157 arrived the same day. For managed fleets, the question is how fast devices catch up.

Exposed OT and vulnerable PLCs were most often linked to this summer's attacks, WaterISAC says

A JFrog Artifactory flaw was public three days before the attack. Ask what you downloaded, not only what you patched.

Cisco Talos details a China-nexus group that used Microsoft 365 services to hide a backdoor

Horizon3 says Anthropic's Mythos chained a weak random number generator to admin access in Rejetto HFS.

Microsoft says the Russian group mass-mails event invites from sites it hacked and hides the install in scheduled tasks

ATNS says it contained the incident, but public documents show it still wants outside forensics to learn the extent.

A certificate under 100 KiB can cost a TLS client, or a server that asks for client certificates, hundreds of MiB.

Hard to pull off, with feasibility unknown. Cloudflare's beta fix needs support at both ends of a tunnel.

Covered: public images, commercial operators, supported Helm charts. Open source may be affected; ask counsel.

Data from 1,293 Detectify customers raises a question: did anyone decide to leave these flaws open?

Cisco's self-reported survey of 8,000 security staff points to slow internal decisions, not missing tools

The bug hits apps that read tokens from a request body. PyJWT 2.14.0 contains the fix.

ControlPlane linked three High-severity bugs to a Critical one. OpenBao is patched; Vault awaits a fix.

One compromised account, reached through a password reset, led Storm-3068 into Azure DevOps and Kubernetes

CISA lists upload, database and login-session bugs in software tied to energy, chemical and transport sectors.

CISA says the bug is in the router's web admin service and works before login. The fix is version 7.23 or later.

CISA lists two flaws in G520 cellular gateways. In one, the update signing key sat in a public developer kit.

CISA says Baicells has not responded to its requests to work together on mitigating a bug in the Nova 430H.

The vendor ties the leaks to a workaround for GitHub's image limits, mostly in employees' personal accounts

VUSec's Branch Target Reuse attack targets JIT engines. Chip vendors point to software patches, so the work falls to OS and runtime owners.

Xint's CTO: in-house option is a work in progress, as it won't be able to use the latest OpenAI and Anthropic models

Microsoft says the group cut the steps its malware needs, down from several, and now sends lures from compromised websites.

A security nonprofit reports an agent-driven intrusion. The agent's errors helped investigators, but they are no defence plan.

The malware barely changed; its control panel did. An AI tool ranks infected phones by estimated bank balance.

A Wiz case study shows why machine identities need the same scrutiny as staff logins

CVE-2026-100541: two different chat accounts can be treated as one identity when permissions are checked

Unit 42's LLM-based tool reviewed OperatorHub and local installs. It does not say how many operators it tested.

Sorami's test of OpenShell v0.1.2 found no bypass of a documented control. Settings still let data out.

Apple says CVE-2026-86950 may have been exploited against specific people. It has shared few details.

Static sites run no code for visitors, but the build step still trusts every theme and module it loads.

An OpenAI agent went around access limits it was not meant to cross. A separate card-theft campaign used open-source agents to automate attacks.

An advisory on @angular/platform-server describes a parser loop that halts all requests when untrusted input reaches it

Only server-rendered Angular apps that pass untrusted input to processing instruction nodes inside fallback elements.

UpGuard suspects AI coding agents built many of the apps but cannot prove it. Accountability stays with the business.

Microsoft describes a layered toolkit, used selectively after break-in, that borrows names of everyday programs

GitHub says its AI workflows find flaws faster. Judging which ones matter still needed people.

Reportedly, the exploited server held HR data on agents and employees who applied through the portal.

MCP Atlassian before 0.22.0, over HTTP with READ_ONLY_MODE=false and no Authorization identity

A treatment center was affected by both the MyDr and Medyc incidents. The exposure sat in supplier databases.

A lab proof of concept, not a production finding. The flaw is in libheif, one of the native libraries sharp bundles.

The data cannot say which accounts were approved, so the first job is an inventory of what employees use.

The state seeks up to $5,000 per violation; a penalty hearing is Oct. 1. The verdict turns on what Facebook told users.

Kiteworks says the flaw is confined to a product enabled for under 50 organizations.

CISA republished Siemens' advisory on a path traversal in the products' embedded web server. Five version lines are affected.

CVE-2026-18963 lets an unauthenticated attacker set new credentials for any user, skipping email verification

Court documents describe stolen logins, Telegram coordination and stolen data offered on criminal forums

CISA's advisory lists no vendor fix, so the risk decision sits with whoever bought the camera.

Citrix says its own compromise indicators may miss real intrusions, so patching is only one step

A QR-code letter scam in Europe and a US skimming indictment show physical card fraud channels are still in use

Two providers and two Go modules share command infrastructure with a campaign researchers tie to North Korea.

A CISA ICS advisory turns a patch question into a migration decision for plants running OpenPLC v3

CISA's advisory lists eight critical infrastructure sectors and points to an upstream fix, not a vendor patch

NVD lists an unauthenticated remote code execution path through a monitored mailbox in GestSup versions before 3.2.61

NCC Group's August tally is 12% above July's; industrial organizations accounted for 31% of reported incidents.

Talos's static analysis shows an implant polling up to four AI models after deployment. The public build is inert.

Cisco and Check Point fixed critical flaws; separately, Japan's Digital Agency reported a breach via an unnamed VPN appliance.

NVD submissions rose 263% from 2020 to 2025; 67,000+ new CVEs published so far in 2026, per CyberScoop

Initial loss estimate is $387.5M; CEO cites a backend wallet breach and a $464M+ fund to cover losses

The open-sourced toolkit flags AI-integrated malware from file metadata, without downloading or running the sample.

Prosecutors say Wagenius used other inmates' email to ask a contact to prompt an AI tool for exploit code.

Socket: issues-helper lists about 15,000 dependent repositories; how many use a mutable tag is unknown.

Researchers read leftover blocks; Cloudflare found no evidence of malicious use and says no customer action is needed

AWS attaches a Deny-only policy within seconds of a leaked key — but does not disable the credential entirely.

One operator, AI-assisted, exfiltrated 140,000 political-opinion records from a campaign platform, per Anthropic's report.

Google threat researchers detail how attackers now target build pipelines, AI coding agents, and developer credentials

third-party[.]com, a stand-in address used across code samples and docs, was registered and weaponized to target Windows users, per Manifold Security

A race in Linux's AF_ALG crypto API let unprivileged users reach root and escape Docker containers, a researcher says.

CVE-2026-87902 scores 9.2 CVSS and affects every WordPress Core branch from 4.7.0 through 7.1.1, patched September 22.

Datadog Security Labs found a content-type mismatch in the AI coding agent's upgrade endpoint, reachable from a single browser tab

A malware-as-a-service platform expanded from 6 to 28 control panels by exploiting a 2023 AMD driver flaw.

AWS credentials made up 46% of stolen secrets as attackers hijack session tokens to bypass MFA, data shows

Metadata tied to 24 million accounts included OCR text, EXIF location, and image-URL construction data

Graz University researchers show a permission-free OS feature can reconstruct keystrokes and browsing history

watchTowr Labs traces the flaw to a missing size check in BIG-IP's OAuth handler, no login required to trigger it.

Certification rules can delay patches while voter registration systems face persistent attempts across all 50 states

Qrator describes a Windows botnet with an AI-account drain and a Grok-driven persistence module

Microsoft details Storm-3168 activity in one Azure tenant: deletions, recovery targeting and storage key requests

Zenity Labs' SalesBleed research shows a poisoned lead can turn a trusted AI agent against the organisation using it

OpenAI's disclosure details a DNS gap, a fragmented GitHub token and 53 cases of user images posted offsite

Researcher Patrick Wardle says any local app could redirect Muse's transcription end point; Meta has issued a hotfix

The settlement puts vendor oversight, contract terms and data minimisation at the centre of a healthcare breach case.

Grav 2.x was fixed earlier this year; the 1.7 branch received the patch only after exploit details reached the vendor.

Socket found release tags for both actions still pointed to the May 18 payload from September 16 to 25.

Patchstack details a CSRF bypass that reaches the whole WordPress REST API; version 4.3.2 fixes it

A forged-token bug and an unauthenticated authorization flaw are both listed as exploited, with federal deadlines from Sept. 27

The exchange says an attacker used a compromised backend system to spoof data and trigger its authorization process

Team Cymru reports intermediary servers that pool credentials, separating the account holder from the actual user.

A Medicare portal intrusion and new survey data put agent containment on the budget agenda

Only the Node.js ImageResponse path in next/og is affected; the Edge implementation and 15.x are not.

CVE-2026-10702, a patched Firefox JIT flaw, gave attackers code execution from one webpage visit — no clicks, downloads, or plugins required.

A backdoor called OWAReaper is keeping mailbox access alive on on-premises Exchange servers long after CVE-2026-42897 was fixed and federally flagged.

Minnesota's coordinated water-utility cyberattack didn't exploit a misconfiguration. It exploited a design — internet-facing PLCs with a vulnerability the vendor cannot patch.

Zero trust assumed the accessor was human, the pace was human, and the app was the atom. AI agents broke all three.

The fortress assumed threats were exceptional events. The immune system assumes threat pressure is ambient and constant.

OpenWrt's DHCPv6 flaw grants unauthenticated root access over UDP — only federal agencies face a patching deadline.

Docker, nginx, PHP and MySQL — the stack behind millions of sites — now ships as a packaged Android spying kit.

Between 'yes' and 'no' lives an entire spectrum of 'convince me.' Security stops being a wall and becomes a conversation.

A canonical-name-with-aliases system consolidates the post-Mandiant/TAG merger. WebPulse reads this as infrastructure for machine-speed triage.

CVE-2026-16723 lets attackers run code without authentication in any Java app using Fastjson 1.x — and the library has no patch to ship.

Hermes Agent's 'YOLO mode' ran privilege-escalation scans and file cataloging without a human approving any step.

A CVSS 9.9 flaw in Azure Automation shows how a single default configuration can cross a cloud trust boundary

A misleading metric is worse than no metric. It manufactures confidence exactly where scrutiny should be.

There is no such thing as a perfectly secure system. Resilience means asking how fast you recover, not whether you can prevent every bad thing.

SSRFs, denial-of-service, cache confusion, auth bypass, and endpoint disclosure — all targeting Server Actions and App Router, the features driving Next.js adoption.

CVE-2026-63030 and CVE-2026-60137 are being exploited to install persistent webshells through WordPress Core's plugin installer.

Two chained CVEs enable pre-authenticated code execution on standard WordPress installs. Patches shipped July 17 — sites that haven't applied them are exposed.

CVE-2026-50522 let attackers forge authentication tokens before Microsoft's fix shipped — and those forged tokens don't expire when the vulnerability does

A new report finds 95% of organizations discover high-severity flaws between scheduled security assessments, not during them.

Two SonicWall SMA1000 vulnerabilities were exploited as zero-days for weeks. Attackers installed custom malware on the devices that protect your network perimeter.

A critical pre-authentication vulnerability in the ServiceNow AI Platform is under active exploitation. No credentials required.

A crafted HTTP request can trigger a heap buffer overflow in NGINX worker processes. The patch is out. The install base is enormous.

Astro was the poster child for zero-CVE modern frameworks. Three cross-site scripting advisories just changed that math.

A crafted XZ archive can trigger a heap buffer overflow in 7-Zip during extraction. The tool runs on hundreds of millions of machines.

Mandiant's 2026 data puts mean time-to-exploit at -7 days — patches now arrive after attackers already have a foothold.

The rendering engine serving human visitors also powers AI browsing agents, and the exploit code is already public.

A single wiki import auto-executes embedded JavaScript on TidGi Desktop, with no patched version currently available.

Two flaws, CVSS 10.0 and 7.2, were exploited in the wild before a patch existed for either one.

LegacyHive works on fully patched July 2026 systems and has no CVE number yet — the eighth such disclosure from the same researcher since April.

CVE-2026-39831 (CVSS 9.1): the Verify() method for FIDO/U2F key types in golang.org/x/crypto/ssh never checked the User Presence flag. An attacker with agent access could authenticate silently, defeating the one guarantee hardware keys exist to enforce.

Automated Frequency Coordination systems accept the GPS coordinates an access point reports about itself, unverified.

CVE-2026-56291 lets unauthenticated attackers upload executable files to sites running Balbooa Forms.

A national cyber agency named CMS plugins as the entry point. Catalog data shows what that exposure looks like in practice.

431 wallets, five blockchains, one root cause: recovery phrases generated from a keyspace small enough to brute-force.

Ubiquiti's July 8 advisory patches seven critical and eighteen high-severity UniFi OS vulnerabilities — against a backdrop of 100,000 previously indexed internet-facing instances.

CVE-2026-56290 allows unauthenticated file uploads on Joomla sites — CISA confirms active exploitation.

Two critical authentication bypasses in BeyondTrust RS and PRA join a cPanel/WHM KEV entry from the same month — both granting privileged infrastructure control via a web-accessible login.

A suspected China-aligned campaign chained an XSS flaw patched in August 2024 with an RCE patched in mid-2025 to compromise physics and engineering departments at U.S. and Canadian universities. The gap is not disclosure — it is deployment.

Langflow, a visual builder for AI agents, joins CISA's KEV catalog after attackers used a broken authorization flaw to harvest LLM credentials and hijack compute.

A CVSS 9.8 authentication bypass in Gitea Docker images was under active probing within 13 days of disclosure. The flaw requires a non-default configuration — but the Docker image ships with that configuration enabled.

A maximum-severity, actively exploited ColdFusion flaw triggered the harshest tier of CISA's new standing directive — on a platform most monitoring tools never see coming.

Mandiant recovered active ADFS token-signing keys from Machine DPAPI without touching LSASS or the live service process. The forged SAML token granted Global Administrator access to a federated Microsoft 365 tenant. MFA, Conditional Access, and all identity controls were bypassed.

NetNut enrolled smart TVs and streaming boxes into a residential proxy network via pre-installed SDKs. 316 distinct threat clusters used it in a single week. Google disabled the C2 infrastructure. The supply chain was the infection vector.

A new cross-platform infostealer deployed through a SimpleHelp authentication bypass explicitly targets AI development assistant tokens, cloud platform credentials, and package registry keys. The attack surface is not the code — it is the developer.

CVE-2026-50548 and CVE-2026-50549 — dubbed DuneSlide — let a prompt injection escape Cursor's sandbox and execute arbitrary commands with developer privileges. More than half the Fortune 500 use Cursor. Every version before 3.0 was vulnerable.

Anthropic's Claude Code has accumulated 28 CVEs in its first year, including two CVSS 10.0 critical sandbox escapes. CVE-2026-46406, the latest, let any local user read secrets from a predictable temp file path. When the security tool becomes the attack surface, every assumption changes.

Frameworks with zero or near-zero critical CVEs hold 3.5% of the Tranco top 10K — and all of them are growing. Hugo, Astro, and HTMX share a trait: minimal attack surface by design.

Google Threat Intelligence Group documents a modular .NET implant that Turla has been developing since 2022 — one more tool in an apparatus that has compromised victims across 50+ countries.

ORAS Go and Java SDKs — used by Azure ACR, AWS ECR, Docker Hub, Helm, and Notation — disclosed symlink and hardlink escape flaws that let a malicious artifact write files outside the extraction directory.

CVE-2026-50138 reveals that goshs --read-only, --upload-only, and --no-delete flags are silently ignored when WebDAV is enabled. Configuration theater in a tool used by developers and red teamers.

In gonic's Subsonic API, any authenticated user can read or delete any other user's data — BOLA confirmed as API risk #1

GHSA-cjhr-43r9-cfmw catalogs how repository .npmrc redirects developer credentials to attacker-controlled registries.

A Mandiant breach response finds ViewState deserialization actively exploited in enterprise learning systems.

A config-phase flaw expands environment secrets into registry requests — before any lifecycle script runs

Techniques that rebuilt GameCube games from binary are now trained on the web's encrypted plugin ecosystem

GHSA-gj8w-mvpf-x27x: Repository-level settings can redirect pnpm to a native install engine without contributor awareness

GHSA-w466-c33r-3gjp: a crafted lockfile can redirect which pnpm binary runs before a dependency is installed

Authentication passed. Authorization was absent. How a gonic Subsonic API flaw illustrates the gap AI agents exploit at scale.

CVE-2026-48930: embedded nul-bytes in hostnames cause silent authority rebinding via C-string truncation. Node.js 22, 24, and 26 affected. The severity dispute exposes a scoring system failure.

CVE-2026-53519 (CVSS 9.1) leaks jwt_secret_key via path traversal. A second flaw (CVSS 9.9) lets any authenticated user hijack another's live terminal. 10K-star self-hosted monitoring platform.

semantic-router pulled a compromised wheel via its AI dependency chain. A .pth file executed on Python startup — no import needed — exfiltrating AWS, GCP, Azure creds, SSH keys, and Kubernetes configs.

Path traversal, manifest spoofing, hoisted alias escapes, arbitrary deletion — 8 distinct vulnerabilities in the package manager that Next.js, Nuxt, and Astro depend on. The supply chain attack surface just moved from packages to package managers.

CVE-2026-50548 and CVE-2026-50549: working directory manipulation and symlink canonicalization bypass in Cursor pre-3.0. The AI coding tool that developers trust with filesystem access had no real sandbox.

Akamai's 2026 study of 1,840 security leaders reveals that only 23% know which APIs return sensitive data — down from 40% in 2022. Organisations are spending more on API security and understanding less. AI is accelerating the gap.

CVE-2026-48713 and CVE-2026-48714 hit the npm ecosystem's dominant internationalisation library. Both scored CVSS 9.1. The second vulnerability bypassed the fix for the first using dotted __proto__ variants. Every Next.js, React, Angular, and Vue app using i18next was exposed.

CVE-2026-46595 bypasses public key authentication entirely. CVE-2026-39831 defeats hardware security keys without physical touch. Go was supposed to be the memory-safe alternative. Its cryptographic foundation just cracked in ten places at once.

CVE-2026-55165 exposes a textbook auth bypass in a Flask-based certificate manager trusted by enterprises

Sapphire Sleet compromised 141 packages in the @mastra npm scope — a TypeScript framework for building AI agents and RAG pipelines. Any CI/CD pipeline running npm install was owned. The supply chain target has shifted from legacy CMS to AI tooling.

Attackers compromised Klue's Salesforce integration using a legacy credential, harvested OAuth tokens, and exfiltrated data from HackerOne, Snyk, Huntress, Recorded Future, BeyondTrust, and LastPass in 15 minutes.

CVE-2026-4020 in Gravity SMTP exposes a REST endpoint that dumps 365KB of live credentials — Amazon SES, Google, Mailjet, Zoho OAuth tokens. Patched in March. Mass exploitation started in June. 17M+ attempts blocked.

A Russian-speaking broker brute-forced 430,000 FortiGate devices. 86,644 fell. Custom sniffers harvested 110M+ credentials passing through compromised firewalls — including Chevron, Samsung, AT&T, Mercedes-Benz.

34 packages across npm, PyPI, and Crates.io hide zero-width Unicode instructions in .cursorrules and CLAUDE.md files. When Cursor or Claude Code opens the project, the AI runs a fake security scan that exfiltrates your secrets.

Google's own AI coding tool had a maximum-severity command injection flaw. In --yolo mode — commonly used in CI/CD — all tool allowlists were ignored. A malicious GitHub issue became an RCE.

WordPress, Django, and Drupal publish no GitHub releases. Next.js, Angular, and Laravel ship 50 per year. The difference determines how fast your team can patch.

TOTP brute-force compromised ~20 Dashlane vaults. 1M combinations per 30-second window is a ceiling, not a wall.

CVE-2026-49763: unauthenticated PHP Object Injection in the CF7-HubSpot bridge. Neither vendor caught it.

CVE-2026-50751 (CVSS 9.3): IKEv1 bypass in Check Point gateways. Qilin exploited before advisory. CISA KEV June 8.

GHSA-mxjx-28vx-xjjj: anyone on the network can approve AI agent actions. The approval layer is the gap.

CVE-2026-23869 scores CVSS 7.5. A cyclic payload in React Flight protocol exhausts CPU for 60 seconds per request.

CVE-2026-48019 allows email header manipulation via unsanitized CRLF sequences. A second CVE compounds the risk.

HTTP.sys is the kernel-mode HTTP driver that underlies IIS, WCF, WinRM, ASP.NET, and every Windows web service. A specially crafted request exceeding 65,535 bytes triggers an integer overflow, heap buffer overflow, and arbitrary code execution with kernel privileges. No authentication. No user interaction. One HTTP request.

May 2026 was the busiest month on record — 14 campaigns, 346 malicious packages in 31 days. Three campaigns hit npm, PyPI, and Docker Hub within 48 hours. The Shai-Hulud worm propagates through build systems. Package-level attacks are now automated.

CVE-2026-48907 is a CVSS 10.0 flaw in the Joomla Content Editor plugin. Attackers upload PHP web shells through unauthenticated profile imports. CISA orders federal agencies to patch by June 19.

Critical patches across Node.js LTS lines. Next.js, Nuxt, Remix, Astro, SvelteKit — every Node-based framework inherits the vulnerability window.

Self-propagating npm worm 'Miasma' hijacked @redhat-cloud-services packages via stolen GitHub OIDC tokens.

Miasma variant uses node-gyp build hooks to evade monitoring, hitting @vapi-ai/server-sdk and 57 packages in under 2 hours.

ReversingLabs' 2026 Software Supply Chain Security Report documents a 73% increase in malicious packages across npm, PyPI, and other registries. Frameworks with 1,000+ transitive dependencies face exponential exposure. Minimal-dependency stacks avoid this risk entirely.

June 2026 Patch Tuesday delivered 208 CVEs (571 with Chromium bundled), 37 Critical. CVE-2026-45657 (CVSS 9.8) is a use-after-free in Windows Kernel TCP/IP that requires no authentication and can self-propagate. CVE-2026-47291 (CVSS 9.8) hits HTTP.sys directly — a web server RCE. CISA's 3-day mandate means patching is no longer optional.

A new malware family harvests complete conversation histories from Claude, ChatGPT, Gemini, Copilot, and Perplexity by hooking browser API calls. Unlike keyloggers, PromptSnatcher captures the AI's responses too — including code reviews, security analyses, and strategic recommendations. The intellectual property loss is exponential.

DomainTools researchers found 152 extensions using browser-level access to redirect searches, inject affiliate codes, exfiltrate cookies, and track browsing. Separately, 23 extensions from the 'AstroForge' campaign steal AI chatbot conversations including Claude, ChatGPT, and Gemini sessions. The Chrome Web Store's review process missed all of them.

Binding Operational Directive 26-04 replaces the old 30-day patch window with risk-based timelines. Publicly exposed, auto-exploitable vulnerabilities in the KEV catalog get a 3-day deadline. The directive cites AI-accelerated exploitation as the reason. WordPress sites with 18,005 CVEs just became a compliance crisis.

Attackers didn't need the WordPress plugin repository. They tampered with CDN-served JavaScript files, creating invisible administrator accounts, installing backdoor plugins named 'Content Delivery Helper' and 'Database Optimizer,' and opening web shells. Credentials exfiltrated to a typosquatted domain.

429,000 files allegedly exfiltrated from HR, the Parliamentary Assembly, the Secretariat, and the European Directorate for Quality of Medicines. The Council of Europe has not acknowledged the incident. The deadline to negotiate is tomorrow.

Specially crafted query parameters alter dynamic route values while leaving the visible URL path unchanged, bypassing middleware-based authorization in Next.js 13.0 through 15.5.15 and 16.x before 16.2.5. A separate CVE-2026-23869 enables memory exhaustion DoS via React Server Components. Astro, Svelte, and Hugo are not affected.

Tenet Security disclosed a new attack class on June 12. Attackers inject prompts into Sentry error events using publicly discoverable DSNs. AI coding agents retrieve the events via MCP and execute attacker-controlled code. Sentry called it 'technically not defensible.'

The credential-stealing worm that compromised Red Hat's npm packages and 73 Microsoft Azure repositories was briefly published on GitHub on June 10. Copycat attacks are now a matter of when, not if.

A 24-hour cooldown on all plugin releases. AI-assisted code review scanning 78,000 plugins. WordPress.org is building the security infrastructure it should have had a decade ago — because the alternative is losing the web.

A malformed Host header bypasses authentication in Starlette — the ASGI framework underneath FastAPI and most of Python's AI agent infrastructure. Modern frameworks are not immune. The difference is how fast they patch.

Attackers adopted 400 orphaned Arch Linux packages through official workflows, injected malicious npm dependencies, and deployed a Rust credential stealer with an eBPF rootkit. By June 12, 1,500 packages were compromised. They never broke a single rule.

The most popular WordPress backup plugin gave unauthenticated attackers full admin access. Wordfence blocked 8,172 exploit attempts in 24 hours. The plugin supply chain strikes again.

June 2026 data reveals critical vulnerabilities across content management frameworks

An attacker rewrote every version tag across 4 Composer packages in a single window. composer update triggered credential theft. 5,561 downstream repositories backdoored within 6 hours. The PHP supply chain joins the worm era.

36 npm packages. A compiled Rust binary that hides behind a kernel rootkit. Command and control over the Tor network. Targets 86 environment variables and 20 credential files. Supply chain attacks just went military-grade.

On May 12, 2026, TeamPCP open-sourced Mini Shai-Hulud — a self-propagating npm supply chain worm. Twenty days later, Miasma hit Red Hat and Microsoft. The barrier to supply chain attacks just dropped to zero.

34 packages across npm, PyPI, and Crates.io. Zero-width Unicode in .cursorrules and CLAUDE.md files. When a developer opens the project, the AI assistant exfiltrates secrets. The attack surface just moved from human to machine.

The largest independent framework scan ever conducted shows a web even more concentrated than W3Techs suggests.

A Herfindahl-Hirschman Index of 0.56 means the detected web is more concentrated than most regulated industries.

Hugo, Eleventy, Remix, SvelteKit, HTMX, and Astro — the clean security record club shares architectural DNA.

Plot detection volume against CVE count. The line goes one direction.

GHSA-2026-0612: the Meta Ads MCP tool allowed unauthenticated HTTP execution. The AI tool supply chain is the new attack surface.

The Go-based static site generator has never had a single CVE in the National Vulnerability Database.

CVE-2026-48019 lets attackers inject headers into outbound emails — no authentication required. Laravel patched it in days. WordPress plugins with similar flaws take months.

The Mini Shai-Hulud worm compromised TanStack, Mistral AI, and 160+ packages. It steals tokens, publishes poisoned versions of more packages, and can wipe developer machines. OpenAI confirmed 2 employee devices were compromised.

CVE-2026-11645 is an out-of-bounds read/write in Chrome's JavaScript engine. Astro ships 9KB of JS. Next.js ships 463KB. The attack surface isn't equal.

A critical RCE chain in protobuf.js — used across Node.js frameworks — turns schema definitions into arbitrary code execution. Exploit code is public.

A new denial-of-service technique exploits how every major web server handles HTTP/2 headers. Legacy CMS servers running on tight memory budgets are the easiest targets.

The Hades variant of the Shai-Hulud worm family includes adversarial prompt injection in its payload — fake JavaScript comments designed to confuse AI-powered security tools. Supply chain malware is now attacking the scanners, not just the developers.

An attacker purchased 30+ WordPress plugins with 400,000 combined installations on a digital marketplace. Dormant for 8 months. Activated April 2026. WordPress has no mechanism to review plugin ownership transfers.

CVSS 9.8. Unauthenticated SQL injection in Drupal Core. Added to CISA KEV two days after disclosure. 15,000 attacks across 65 countries. The CMS governments chose for security just got its own critical core flaw.

WordPress 7.0 'Armstrong' added a Connectors API that stores Anthropic, Google, and OpenAI keys in wp_options. Patchstack's founder called it 'free AI tokens for hackers.' AI scanning found 300+ zero-days at $20 each in 72 hours. SiteGround pushed 1M+ installs automatically.

Six critical vulnerabilities actively exploited at the same time. 29,300+ attacks per day on one plugin alone. A premium plugin supply-chain compromised. The WordPress security model hit a wall.

June 1: npm packages. June 3: new evasion technique. June 5: IDE config poisoning. June 7: PyPI. The Shai-Hulud supply chain worm crossed three attack surfaces in nine days. 448 artifacts. The security industry couldn't keep up.

TrustFall: one-click RCE. SymJack: symlink hijack installs attacker MCP servers. Clinejection: a GitHub issue title compromised 4,000 developers. Claude Code leaked its source — three CVEs fell out. The tools building the web are its newest attack surface.

One supply chain attack is an incident. Thirty in six months is a market condition. The worm crossed to PyPI. The source code went public. Here's the timeline.

WordPress has 18,005 catalogued CVEs and six CVSS 9.8 vulnerabilities exploited simultaneously. The npm ecosystem had 30+ supply chain attacks in 6 months — and the worm jumped to PyPI. Neither is safe. The difference is how the risk kills you.

MCP — the Model Context Protocol — is the TCP/IP of agentic AI. 200,000+ vulnerable instances. 150 million package downloads. The Pentagon designated its creator a supply chain risk. The NSA published an advisory. The infrastructure of the machine web is wide open.

SLSA provenance was supposed to be the answer to supply chain attacks. Miasma forged it. 32 Red Hat packages, 90+ malicious versions, perfect provenance attestations. The trust framework is broken.

A single compromised npm package gave attackers AWS admin access in three days. The deployment pipeline that makes modern frameworks possible is the attack surface nobody secured.

North Korean group UNC1069 compromised Axios — downloaded 40 million times per week. When intelligence agencies target your build pipeline, npm audit is not a security strategy.

WordPress: 60,000 plugins, ~40% abandoned. npm (React/Next.js): millions of packages but lockfile-controlled and auditable. The supply chain model is fundamentally different — and our country data shows who bears the deepest exposure.

GDPR fines: EUR4.5B+ cumulative. Healthcare breach cost: $10.9M average. The sectors with the highest fines are the sectors with the most legacy infrastructure. Correlation isn't causation — but the pattern demands attention.

How many of the 7.4M WordPress sites are for businesses that no longer exist? Domains persist, plugins accumulate CVEs, and nobody patches. The web's biggest security problem isn't active sites — it's ghost sites.

.ru: 238,055 detected. WordPress 68%, Joomla 11.5% (27,374 sites), Drupal 5.9%, Next.js 5.7%, Angular 3.3%, Vue 1.4%. Russia's Joomla count alone exceeds most countries' total detections.

Brazil 86% WP, Argentina 86% WP, Colombia 55% WP. Uruguay breaks the LATAM WordPress pattern with 21% Drupal — the development funding corridor extends to Latin America.

Croatia 9%, Serbia 9%, Slovenia 7%, North Macedonia 6%, Bosnia 3%. While Western Europe moved past Joomla years ago, the Balkans still carry significant Joomla infrastructure.

Kenya: 1,849 detected, WP 82%, Shopify 7.5%. Nigeria: 2,954 detected, WP 97%. Same continent, opposite digital paths.

Nepal 64% Drupal. Bangladesh 63%. Libya 42%. Ecuador 40%. Ivory Coast 37%. Uganda 31%. The framework map is the aid map.

India is 83% WordPress. Pakistan is 63% WordPress. Nepal chose Drupal. 351 Drupal sites vs 165 WordPress. Something institutional happened here.

Africa's largest economy, 220 million people, the continent's biggest tech ecosystem. 97% of detected sites run WordPress. Not 93% like Turkey. Near-total monoculture at scale.

The largest .edu dataset ever published. Education remains the most framework-diverse sector. Rails at 16.4% — 9,568 sites — is the finding nobody expected.

The most comprehensive .gov framework survey ever. Drupal dominates at 49%. WordPress is 24%. Rails is 11%. Next.js is emerging at 6%.

174 detected .ir sites. 93% WordPress. Isolation — economic and technological — produces digital monoculture.

Among 10M+ sites scanned, the 'dead' framework has more detections than four of the most-hyped modern alternatives combined.

176,344 Joomla sites vs 20,338 Astro + SvelteKit combined. Developer Twitter doesn't reflect the actual web.

58,182 .edu domains analyzed. WordPress leads at 38.5% but Drupal (35.7%) and Rails (16.4%) make education the most diverse sector.

In our Common Crawl scan of 61,005 detected .ru sites, Joomla concentrates heavily in Russian domains. The rest of the world moved on. Russia didn't.

Among 17 healthcare sites we scanned: Drupal, WordPress, Next.js, Vue, Angular — no dominant framework. A small sample, but the fragmentation pattern is the finding.

Among 49 government sites we scanned across 6 regions, Drupal dominates — not WordPress. A directional finding from a small but curated sample.

ACLU on WordPress. EFF on Drupal. The organizations defending digital rights are running on legacy infrastructure.

Southeast Asia's largest super-app — ride-hailing, food delivery, payments — has a marketing site on legacy CMS. The infrastructure divide runs inside companies too.

Europe's data protection regulation is forcing infrastructure decisions. Legacy CMS was never built for data subject rights at scale.

Australia's prudential regulator requires financial entities to maintain security capability commensurate with threats. Legacy infrastructure makes that harder every year.

Thousands of US medical practices run patient-facing services on WordPress. The OCR is increasing enforcement. The math doesn't work.

The 2016 census failure cost A$30M+ and damaged public trust. It was a legacy infrastructure event with national consequences.

Three technology generations that still run critical infrastructure. One has no new developers. One stopped receiving updates. One was officially sunset in 2020.

Medical practices, hospitals, and health systems running patient-facing services on the web's most-attacked framework.

The White House runs WordPress. So do thousands of government agencies worldwide. Public infrastructure on a legacy foundation.

The average WordPress site runs 27 plugins. Each one is an independent attack surface with its own update cycle, its own maintainer, and its own risk profile.

The compounding cost of staying on legacy frameworks. A timeline of escalating risk.

The most widely deployed framework (W3Techs) is also one of its most vulnerable. Here's what the data says.