SecurityRole-Playing the Kill Chain
An Aurora ransomware affiliate used Cursor's AI coding assistant to conduct live network intrusion across 20 organizations, and the safety bypass required no technical exploit, just a different conversational frame.
Ransomware
Lazarus FudModule, VMware Mass Exploitation, and the AI Supply Chain's Second Week
August Patch Tuesday delivered a materially different story than Monday's preview suggested: Lazarus Group deployed the FudModule kernel rootkit via an actively exploited WinSock zero-day, while VMware vCenter reached 361 victims in 47 countries within five days of disclosure.
Threat Economics: Week of July 21-27, 2026
Two AI agent containment failures in one week hand the agentic security vendor class its clearest market validation yet, while rising insurance loss ratios and a September CIRCIA deadline signal the next phase of compliance-driven procurement.
Disruption Is the Point: Romania's Land Registry, Fairlife, and the Attacks That Skip the Ransom Note
Two high-disruption attacks this week, one purely destructive and one ransomware-driven, expose a defender blind spot: triage frameworks built around extortion mechanics will miss a growing share of the highest-impact incidents.
Trusted Vendor, Compromised Namespace: Miasma Escalates Supply Chain Risk While AI Cements Its Role in Ransomware Development
The Mini Shai-Hulud worm now operates inside Red Hat's official npm namespace, proving that vendor-maintained packages are viable supply chain targets; simultaneously, the first confirmed AI-assisted ransomware toolchain documents a qualitative shift in what moderately skilled operators can build.
LiteLLM's 36-Hour Exploitation Window Confirms the AI Attack Surface Has Moved Up the Stack
The rapid exploitation of CVE-2026-42208 in LiteLLM marks the first confirmed weaponization of the AI API proxy layer, while TeamPCP's new ransomware partnership turns out to be a wiper with no recovery path.