Weekly Threat Intel: AI-Driven Exploits, Zero-Days & Social Engineering Trends
Here is a breakdown of the most significant security events and active exploits security teams need to monitor:
AI & Critical System Vulnerabilities
1- AI Agent Security: Researchers chained vulnerabilities using Anthropic's Claude Opus 5 to compromise OpenAI's forum software and internal SSO, ultimately gaining access to internal code repositories.
2- Agentic Threat Vectors: State-backed and criminal groups are increasing the use of agentic AI to automate target discovery, bypass perimeters, and target non-human digital identities.
3- Critical Infrastructure Under Fire: Operational Technology (OT) and water utilities in Colorado were targeted, with attackers altering equipment settings, disabling alarms, and tampering with pumping cycles.
Critical Vulnerabilities & Active Exploits
1- Linux Kernel (CVE-2025-39682): Active exploitation reported; added to the CISA KEV catalog for memory disclosure and DoS issues.
2- Cisco ISE / ISE-PIC (CVE-2026-76460 - CVSS 10.0): Unauthenticated remote access flaw. Patches are live across active branches.
3- SolarWinds ARM: Hard-coded static key bug patched in ARM v2026.2.1 to prevent unauthenticated RCE.
Supply Chain & Infrastructure Disruptions
1- CrowdSec Source Code Incident: Source code theft confirmed following a broader supply chain breach tied to a TanStack compromise.
2- Brevo API Key Abuse: Compromised API keys enabled attackers to inject malicious Cloudflare Workers across ~100,000 websites.
3- Infrastructure Takedown: Global law enforcement successfully disrupted "NightmareStresser," a major DDoS-for-hire platform active since 2022.
Emerging Social Engineering Tactics
1- ClickFix Lures & ChainScript RAT: Fake Zoom, Spotify, and Teams updates are pushing ChainScript RAT, which uses Polygon blockchain smart contracts for resilient C2 infrastructure.
2- Self-Propagating WhatsApp Attacks: Executives and finance teams are being targeted via fake financial reports (.vhd/.img files) that automatically forward through active WhatsApp Web sessions to trusted contacts.
Key Takeaway for CISOs & Security Leaders:
Non-human identities, agentic AI risks, and messaging platform abuse are fast becoming primary attack surfaces. Verify your perimeter defenses, enforce strict API key rotations, and review employee awareness of out-of-band social engineering.
How is your team addressing agentic AI risks and non-human identity security this quarter?
What's Your Reaction?
