OpenAI’s Codex AI agent independently discovered and chained together multiple decade-old HTTP/2 denial-of-service techniques to bring down web servers within seconds, creating what researchers are calling an HTTP/2 bomb. This demonstrates that AI coding agents can autonomously rediscover and combine legacy attack methods into novel, highly effective exploits without human guidance. The incident raises significant concerns about the offensive security capabilities of large language model-based agents operating with minimal oversight.

Architect’s Take: Review your HTTP/2 implementation and ensure rate limiting, connection throttling, and request flood protections are in place at your load balancer or WAF layer — AWS WAF, Azure Front Door, and GCP Cloud Armor all offer relevant rule sets that should be validated against HTTP/2-specific DoS vectors. Consider whether any AI coding agents in your environment have unrestricted outbound network access, and apply least-privilege controls accordingly.

Original advisory: OpenAI’s agent chained decade-old DoS attacks to crash web servers in seconds

Cisco has patched a server-side request forgery (SSRF) vulnerability in Unified Communications Manager (Unified CM) that allows an unauthenticated network attacker to write arbitrary files to the system and escalate privileges to root. The flaw is tracked as CVE-2026-20230 and public proof-of-concept exploit code is already available, significantly lowering the barrier to exploitation. Cisco’s PSIRT has not confirmed active exploitation in the wild, but the availability of working PoC code makes patching urgent.

Architect’s Take: Apply Cisco’s patch immediately and treat any internet- or untrusted-network-exposed Unified CM instances as highest priority. As an interim control, restrict network access to Unified CM admin interfaces to trusted management VLANs only, and review ingress firewall rules to limit the blast radius while patching is under way.

Original advisory: Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public

A flaw in Anthropic’s Claude Code GitHub Action allowed an attacker to hijack public repositories simply by opening a malicious GitHub issue, requiring no authentication or special access. Because Anthropic’s own repository used the same vulnerable workflow, a successful attack could have injected malicious code into the action itself, poisoning every downstream project that consumes it. Researcher RyotaK of GMO discovered and reported the issue.

Architect’s Take: Audit any GitHub Actions workflows that trigger on untrusted events such as ‘issues’ or ‘pull_request_target’ and ensure they do not have write permissions or access to secrets without explicit trust gates. If you use Claude Code GitHub Action, verify you are pinned to a patched version and review your workflow permissions using the principle of least privilege.

Original advisory: Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories

Agentic AI systems are increasingly being deployed in defence and security networks, but this introduces new attack surfaces — illustrated by reports that an unauthorised group claimed access to Anthropic’s Claude Mythos model within hours of a limited technical preview. The incident highlights that AI capabilities in high-stakes environments are only as secure as the infrastructure underpinning them. Without robust access controls, segmentation, and identity governance, agentic AI deployments can become a significant liability rather than a force multiplier.

Architect’s Take: Before onboarding any agentic AI model into sensitive or defence-adjacent environments, conduct a thorough access control review: enforce least-privilege API access, implement strict identity verification for model endpoints, and ensure AI workloads are isolated within dedicated network segments with full audit logging enabled.

Original advisory: Agentic AI Is Transforming Defense, But Only Secure IT Infrastructure Will Maximize It

This is a weekly threat bulletin covering a broad range of active security issues, including AI agent exploitation, command-and-control tooling, ClickFix social engineering campaigns, JavaScript backdoors, and over 20 additional threat stories. It matters because it reflects the accelerating normalisation of sophisticated attack techniques being accessible to lower-skilled threat actors, and highlights emerging risks from AI systems being leveraged in real attacks.

Architect’s Take: Use this bulletin as a prompt to review your threat model against ClickFix-style social engineering vectors and any AI agent integrations in your environment — particularly where agents have access to cloud APIs or can execute code. Ensure your JavaScript supply chain controls and browser security policies are current.

Original advisory: ThreatsDay Bulletin: AI Agents Gone Wrong, Sketchy C2 Tools, ClickFix Tricks, JS Backdoors & 20+ New Stories

This is a broad threat intelligence bulletin covering a range of current attack trends including malicious AI agents, command-and-control tooling, ClickFix social engineering, JavaScript backdoors, and more. It reflects the increasingly commoditised nature of offensive tooling, where even low-skilled threat actors now have access to sophisticated capabilities. The significance lies in the breadth of attack vectors being actively exploited across web, endpoint, and AI-adjacent surfaces.

Architect’s Take: Use this bulletin as a prompt to review your AI agent integrations, third-party plugin dependencies, and JavaScript supply chain controls — particularly CSP policies, SRI hashing, and egress monitoring for unexpected C2 traffic patterns.

Original advisory: ThreatsDay Bulletin: AI Agents Gone Wrong, Sketchy C2 Tools, ClickFix Tricks, JS Backdoors & 20+ New Stories

A China-linked threat actor, TA4922, has expanded its phishing campaigns beyond its previous targets to now include organisations in the UK, Germany, Italy, and South Africa. The group is deploying known malware families including ValleyRAT and Atlas RAT, with a rapidly evolving toolkit suggesting well-resourced, sustained operations. This represents a significant escalation in geographic scope and poses a direct threat to European enterprises.

Architect’s Take: Review and tighten email gateway controls to block phishing lures associated with TA4922, and ensure endpoint detection rules cover ValleyRAT (Winos 4.0) and Atlas RAT indicators. Consider hunting for lateral movement or C2 beaconing patterns consistent with these RAT families across cloud-hosted workloads and on-premises infrastructure.

Original advisory: China-Linked TA4922 Expands Phishing Attacks to U.K., Germany, Italy, and South Africa

A China-linked threat group, TA4922, has significantly expanded its phishing campaigns beyond its previous targets to now include organisations in the UK, Germany, Italy, and South Africa. The group is deploying known remote access trojans including ValleyRAT and Atlas RAT, with a fast-moving operational pace and an evolving malware toolkit. This matters because the expansion into European markets signals a deliberate strategic shift, increasing risk for organisations in these regions.

Architect’s Take: Review email gateway and endpoint detection rules for ValleyRAT (Winos 4.0) and Atlas RAT indicators of compromise, and ensure phishing-resistant MFA is enforced across all cloud console and SaaS access points. Consider threat intelligence feeds covering Chinese APT activity to stay ahead of this group’s rapidly evolving malware arsenal.

Original advisory: China-Linked TA4922 Expands Phishing Attacks to UK, Germany, Italy, and South Africa

The Five Eyes intelligence alliance has issued a warning about China’s ongoing campaign to recruit Western nationals via LinkedIn and other professional networks, offering cash in exchange for state secrets and sensitive government or corporate information. The campaign targets individuals with access to classified or commercially valuable data, using social engineering tactics that have been observed for several years but appear to be intensifying. This matters because cloud engineers and architects working on government or defence-adjacent projects are plausible targets given their access to sensitive infrastructure.

Architect’s Take: Review your organisation’s social media and acceptable use policies to ensure staff understand the risks of unsolicited professional outreach, particularly from overseas contacts offering paid consulting or research opportunities. Consider adding LinkedIn-based social engineering scenarios to your security awareness training, especially for teams handling government, defence, or critical national infrastructure workloads.

Original advisory: Five Eyes: Watch out for odd LinkedIn connection requests, China’s back on the hunt for state secrets

The Five Eyes intelligence alliance has issued a warning about China’s ongoing campaign to recruit Western government employees and contractors via LinkedIn, offering cash in exchange for state secrets. The tradecraft involves seemingly innocuous connection requests that escalate into paid intelligence relationships. This is a long-running threat that intelligence officials say continues to grow in scale and sophistication.

Architect’s Take: Cloud security architects with clearances or access to sensitive government cloud environments should review their organisation’s social media policies and ensure staff handling sensitive infrastructure are briefed on LinkedIn-based social engineering. Consider implementing insider threat monitoring and reinforcing acceptable use policies around unsolicited professional contact from unknown foreign nationals.

Original advisory: Five Eyes: Watch out for odd LinkedIn connection requests, China’s back on the hunt for state secrets

A macOS malvertising campaign called Operation FlutterBridge is distributing a new backdoor, FlutterShell, through malicious Google and YouTube advertisements. The campaign is an evolution of a previously identified threat cluster (JSCoreRunner/FileRipple) first observed in late 2025. This matters because it uses trusted ad platforms to target macOS users, broadening the attack surface beyond traditional phishing vectors.

Architect’s Take: Enforce endpoint detection and response (EDR) tooling on all macOS devices, including developer and privileged-access workstations, and consider restricting or monitoring ad-network traffic at the corporate proxy or DNS layer. Review browser isolation and application allowlisting policies to limit the execution of unsigned or unnotarised binaries delivered via browser-based download prompts.

Original advisory: FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads

Two former RAC employees who sold personal data belonging to car crash victims to claims management companies have been ordered to repay £118,000 under the Proceeds of Crime Act, following earlier sentences of imprisonment and community service. The pair exploited their privileged access to customer data for financial gain, representing a textbook insider threat and data protection failure. The case underscores the real-world financial and legal consequences of misusing access to sensitive personal data.

Architect’s Take: Review and tighten data access controls for employees handling sensitive personal information — implement least-privilege access, robust audit logging, and anomaly detection to identify unusual data exports or queries, particularly in systems holding customer PII.

Original advisory: Duo who sold car crash victims’ data must repay £118k

Two former RAC employees who unlawfully accessed and sold personal data belonging to car crash victims have been ordered to repay £118,000 under the Proceeds of Crime Act, following earlier sentences of imprisonment and community service. The pair exploited their privileged access to customer data systems to pass information to claims management companies. The case highlights the ongoing risk of insider threats and the serious financial consequences now being pursued by regulators and prosecutors.

Architect’s Take: Review and tighten data access controls for staff handling sensitive personal data — implement least-privilege access, robust audit logging, and anomaly detection to identify unusual data exports or queries, particularly in systems holding customer contact or incident data.

Original advisory: Duo who sold car crash victims’ data must repay £118k

Attackers are exploiting Meta’s AI support chatbot to hijack Instagram accounts by tricking the bot into adding a hacker-controlled email address and issuing a password reset. The attack requires no prior account access and bypasses Instagram’s automated protections using a VPN to spoof the victim’s location. This demonstrates a critical flaw in how AI-powered support systems validate identity before performing sensitive account actions.

Architect’s Take: Organisations deploying AI chatbots for customer support or account management must enforce out-of-band identity verification for any privileged actions — such as adding credentials or triggering resets — and ensure the AI cannot be the sole authorisation path for account takeover-enabling operations. Review your own AI assistant integrations for similar trust boundary weaknesses where bot-initiated actions bypass human or MFA controls.

Original advisory: Hacking Meta’s AI Chatbot

Attackers are exploiting Meta’s AI support chatbot to hijack Instagram accounts by social-engineering the bot into adding a hacker-controlled email address and triggering a password reset. The attack requires no technical vulnerability in the traditional sense — the AI simply complies with the request after a verification code exchange. This highlights a significant trust and authorisation flaw in how Meta’s AI assistant handles account management actions on behalf of unauthenticated parties.

Architect’s Take: Treat AI-powered support agents as a privileged access vector and apply the same controls you would to any account recovery flow — ensure they cannot perform account modifications without verified, out-of-band identity confirmation tied to the existing account owner, not the requester.

Original advisory: Hacking Meta’s AI Chatbot

Attackers have built convincing fake websites impersonating popular open-source and freeware tools, engineering them to rank highly in Google search results. Visitors are silently routed through a Traffic Distribution System (TDS) that profiles them before delivering tailored malware, including credential stealers and session hijacking frameworks. The campaign is notable for its scale and the quality of the spoofed sites, making it easy for developers and engineers to be deceived.

Architect’s Take: Enforce approved software procurement channels and block unapproved download sources at the network or endpoint level. Mandate that developers and engineers source open-source tooling exclusively from verified repositories such as official GitHub pages or package managers, and consider deploying DNS filtering to flag newly registered or lookalike domains.

Original advisory: Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS

Attackers have created convincing fake websites impersonating popular open-source tools, optimising them to rank highly on Google search results. Visitors are silently routed through a Traffic Distribution System (TDS) that delivers malware including credential stealers and session hijacking frameworks. This is a supply chain-adjacent threat targeting developers and technical users who search for and download software directly from the web.

Architect’s Take: Enforce organisational policies requiring software to be sourced only from verified package managers (npm, PyPI, etc.) or official repositories, and block direct binary downloads from unvetted sites via web proxy or CASB controls. Consider adding developer workstations to your threat model and ensure EDR coverage extends to engineering endpoints.

Original advisory: Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS

Unknown threat actors maintained covert access to a senior stock exchange executive’s Outlook mailbox for at least five months, quietly exfiltrating email data in small batches to evade detection. The stolen data was routed through legitimate cloud storage services — Dropbox and OneDrive — to blend with normal business traffic. Symantec and Carbon Black attribute the campaign to espionage, suggesting a nation-state or sophisticated threat actor targeting financial sector intelligence.

Architect’s Take: Review Microsoft 365 audit logs and Conditional Access policies for unusual mailbox delegation, mail forwarding rules, or OAuth app consents — particularly any third-party app with access to Mail.Read scopes. Implement Cloud App Security (Defender for Cloud Apps) policies to alert on bulk email access or large data transfers to consumer cloud storage services such as Dropbox and OneDrive.

Original advisory: Hackers Spied on a Stock Exchange Executive’s Outlook Mailbox for Five Months

Unknown threat actors maintained covert access to a senior stock exchange executive’s Microsoft Outlook mailbox for at least five months, systematically exfiltrating email data in small batches to avoid detection. The stolen data was routed through Dropbox and OneDrive to blend with legitimate cloud traffic, making it harder for security tools to flag the activity. The campaign bears the hallmarks of a state-sponsored or sophisticated espionage operation targeting high-value financial intelligence.

Architect’s Take: Review Microsoft 365 audit logs and Defender for Cloud Apps policies for anomalous mail export activity, particularly incremental inbox syncs or delegated access from unfamiliar locations — and enforce conditional access policies that restrict OAuth app permissions for third-party cloud storage providers such as Dropbox and OneDrive to prevent data staging and exfiltration via trusted cloud channels.

Original advisory: Hackers Spied on a Stock Exchange Executive’s Outlook Mailbox for Five Months

Researchers have demonstrated that freely available open source AI models are sufficient to build self-spreading computer worms capable of exploiting known vulnerabilities at scale across enterprise networks — no expensive or specialised AI tools required. The study shows attackers no longer need cutting-edge proprietary models to automate vulnerability exploitation, dramatically lowering the barrier to entry for large-scale attacks. This represents a meaningful shift in the threat landscape, where mass exploitation of known but unpatched vulnerabilities becomes significantly cheaper and faster to operationalise.

Architect’s Take: Prioritise rapid patching cadence and automated vulnerability remediation pipelines — the research confirms that the window between public vulnerability disclosure and weaponised exploitation is shrinking fast. Review your network segmentation controls and lateral movement detection capabilities to limit the blast radius of any self-propagating worm that gains an initial foothold.

Original advisory: Nobody needs Mythos or 0-days to build a chaos-causing computer worm – free open source models work just fine

The US Department of Justice ran a coordinated ‘Disruption Week’ operation from May 2026 targeting Southeast Asian criminal networks running cryptocurrency and cyber-enabled fraud schemes against American victims. The action involved both government agencies and private sector partners, resulting in the takedown of millions of fraudulent social media, email, and internet accounts, and the freezing of $3.8 million in assets. These operations are typically linked to pig butchering and romance scam networks, which increasingly exploit cloud-hosted infrastructure and social engineering at scale.

Architect’s Take: Review your organisation’s cloud egress controls and user awareness posture around unsolicited crypto investment opportunities, as these networks actively target employees and high-value individuals. Consider integrating threat intelligence feeds covering known fraud infrastructure into your SIEM to detect communications with associated domains and IPs.

Original advisory: DoJ Disrupts Southeast Asia Crypto Fraud Networks, Freezes $3.8 Million in Assets

Passwords were found stored in plaintext within Active Directory user and computer description fields, making them trivially accessible to any authenticated user on the network. Because AD description fields are readable by all domain users by default, a low-privilege attacker or compromised account could harvest credentials at scale with a simple LDAP query. This represents a significant credential exposure risk in any hybrid or cloud-connected environment where AD is the identity backbone.

Architect’s Take: Audit your Active Directory environment immediately for plaintext credentials in description fields using tools such as BloodHound or a targeted LDAP query, and enforce a policy prohibiting sensitive data in AD attributes. In Azure AD/Entra ID hybrid environments, also check synced attributes to ensure no plaintext secrets have been replicated to the cloud directory.

Original advisory: All the passwords were stored in Active Directory description fields

Commvault is urging organisations to fundamentally reassess their cyber resilience strategies as AI-powered attackers increasingly target backup and recovery infrastructure, leaving victims unable to restore operations. The concern is that traditional backup plans are insufficient if they are not regularly tested and hardened against modern threat actors who specifically seek to neutralise recovery capabilities. This matters because the failure point is no longer just data loss — it is the complete inability to recover.

Architect’s Take: Conduct immutable backup validation and regular recovery rehearsals in isolated environments; ensure your backup control plane and admin credentials are air-gapped or protected by separate identity controls from your primary estate to prevent attackers from disabling recovery options before deploying ransomware.

Original advisory: Commvault says it’s time to rethink resiliency as AI crooks leave victims in a ‘dark, dead’ state

Commvault is urging organisations to fundamentally rethink their resilience strategies as AI-powered attackers increasingly target backup and recovery infrastructure, leaving victims unable to recover. The warning highlights that traditional backup plans are insufficient if they are not regularly tested under realistic attack conditions. As ransomware operators and AI-assisted threat actors specifically seek out and corrupt backup systems, untested recovery capabilities offer a false sense of security.

Architect’s Take: Conduct adversarial recovery testing — specifically simulate scenarios where backup infrastructure is compromised or unavailable — and ensure immutable, air-gapped backup copies exist outside the blast radius of your primary cloud environment. Review your recovery time objectives against actual tested recovery performance, not theoretical estimates.

Original advisory: Commvault says it’s time to rethink resiliency as AI crooks leave victims in a ‘dark, dead’ state

Researchers at Rice University have demonstrated that curving radio beams can defeat anti-jamming systems by making it difficult to pinpoint the true origin of a jamming signal. Traditional anti-jamming defences rely on locating and neutralising the source of interference, but bent beams confound that localisation process. This has significant implications for secure wireless communications, including satellite links and GPS systems that underpin cloud and critical infrastructure connectivity.

Architect’s Take: Cloud architects relying on satellite uplinks, GPS-dependent services, or wireless backhaul should review their signal redundancy and failover strategies, as physical-layer jamming attacks may become harder to detect and mitigate at the source. Consider layering application-level integrity checks and network path diversity rather than assuming radio anti-jamming controls will hold.

Original advisory: Bend the beam like Beckham to defeat anti-jamming tech

Researchers at Rice University have demonstrated that curving or bending radio beams can defeat anti-jamming systems that rely on locating the source of interference. Because the signal no longer travels in a straight line, direction-finding techniques used to identify and counter jammers become ineffective. This has implications for any wireless communication infrastructure, including those supporting cloud-connected IoT, satellite links, and enterprise wireless networks.

Architect’s Take: Cloud architects relying on wireless backhaul, satellite connectivity, or IoT sensor networks should review their signal resilience strategy — consider whether your anti-jamming or interference-detection controls assume line-of-sight propagation, and engage your network security team to assess whether alternative detection methods (e.g. signal fingerprinting or multi-point triangulation) are in scope.

Original advisory: Bend the beam like Beckham to defeat anti-jamming tech

A vulnerability in Google Gemini’s Android integration allowed malicious content embedded in notifications from apps such as WhatsApp, Slack, Signal, and SMS to hijack the AI assistant without requiring any installed malware. An attacker could craft a poisoned notification that caused Gemini to open browser windows, impersonate contacts, initiate calls, or corrupt the assistant’s long-term memory. This is a prompt injection attack exploiting the trust Gemini places in notification content it processes.

Architect’s Take: Organisations deploying Android devices with Gemini enabled should review mobile device management (MDM) policies to restrict AI assistant access to sensitive notification streams, and treat AI assistants as untrusted data processors when designing data-handling workflows. Raise awareness with security teams about prompt injection as a realistic attack vector on enterprise mobile estates.

Original advisory: WhatsApp, Slack Notifications Could Hijack Google Gemini on Android

A prompt injection vulnerability in Google Gemini on Android allowed hostile content embedded in notifications from apps such as WhatsApp, Slack, Signal, and SMS to hijack the AI assistant without requiring any malicious app to be installed. An attacker could craft a poisoned message or notification that caused Gemini to perform unauthorised actions — including impersonating contacts, initiating calls, or corrupting its long-term memory. The attack required no user interaction beyond the assistant processing the notification, making it particularly dangerous for enterprise users relying on AI-assisted workflows.

Architect’s Take: Review your organisation’s mobile device management (MDM) policies to restrict or audit Gemini’s access to third-party app notifications, particularly on corporate Android devices. Until Google confirms a fully patched release, consider disabling Gemini’s notification-reading capabilities via app permissions and assess whether AI assistant integrations meet your acceptable risk threshold for enterprise use.

Original advisory: WhatsApp, Slack Notifications Could Hijack Google Gemini on Android

A one-click attack targeting GitHub.dev, the browser-based VS Code environment, allows an attacker to steal a victim’s GitHub OAuth token simply by having them click a crafted link. The stolen token grants full read and write access to both public and private repositories. This is particularly dangerous because it requires no malware installation and exploits a legitimate GitHub feature.

Architect’s Take: Audit OAuth token scopes granted to GitHub.dev within your organisation and consider enforcing fine-grained personal access tokens with minimal repository permissions instead of broad OAuth tokens. Ensure developer awareness training covers the risk of clicking unsolicited GitHub.dev links, and review whether your GitHub organisation policies can restrict OAuth app access.

Original advisory: One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens

A one-click attack targeting Microsoft VS Code’s GitHub.dev feature allows an attacker to steal a victim’s GitHub OAuth token simply by tricking them into clicking a crafted link. The stolen token grants read and write access to all repositories the victim can access, including private ones. This poses a significant supply chain risk, as compromised tokens could be used to inject malicious code into codebases.

Architect’s Take: Enforce short-lived, scoped OAuth tokens across your organisation and audit any GitHub Apps or integrations permitted in VS Code. Consider restricting or monitoring use of GitHub.dev in your developer environment policy, and enable GitHub token scanning and push protection to limit the blast radius of any token compromise.

Original advisory: One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens

A critical remote code execution vulnerability (CVE-2026-23479) in Redis, introduced in version 7.2.0 over two years ago, has been patched following discovery by an autonomous AI-powered bug-hunting tool. The flaw is a use-after-free bug in Redis’s blocking-client handling code, allowing any authenticated user to execute arbitrary operating system commands on the host server. This is significant because Redis is widely deployed across cloud environments as a caching and data store layer, meaning exposure could lead to full host compromise.

Architect’s Take: Prioritise patching all Redis instances to the May 5 fixed release immediately, paying particular attention to managed Redis services (AWS ElastiCache, Azure Cache for Redis, GCP Memorystore) and self-hosted deployments — check with your vendors for patch availability. In the interim, enforce network segmentation and strict authentication controls to limit which services and users can reach Redis endpoints, reducing the authenticated-user attack surface.

Original advisory: Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479)

A use-after-free vulnerability in Redis (CVE-2026-23479) allows an authenticated user to execute arbitrary operating system commands on the host machine. Present in every stable Redis branch since version 7.2.0, the flaw went undetected for over two years before being discovered by an autonomous AI-powered code analysis tool. Because Redis is widely deployed as a caching and session layer in cloud environments, successful exploitation could lead to full host compromise.

Architect’s Take: Patch Redis to the May 5 release immediately across all environments — prioritise internet-adjacent or multi-tenant deployments. In the interim, enforce strict network segmentation so that only authorised application services can reach Redis, and audit whether any Redis instances permit external or untrusted client authentication.

Original advisory: Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479)

CISA has added CVE-2026-45247, a critical remote code execution vulnerability in the Mirasvit Cache Warmer Magento extension, to its Known Exploited Vulnerabilities catalogue following confirmed active exploitation. The flaw, scoring 9.8 on the CVSS scale, stems from insecure deserialisation of untrusted data, allowing an attacker to execute arbitrary code on affected systems. Any organisation running this extension on their Magento e-commerce platform should treat this as an urgent remediation priority.

Architect’s Take: Audit your Magento deployments immediately for the Mirasvit Cache Warmer extension and apply the vendor patch or remove the extension if no patch is available. Given active exploitation, also review web application firewall rules and inspect recent server logs for anomalous deserialisation payloads or unexpected outbound connections.

Original advisory: CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog

Attackers are exploiting Google’s DoubleClick ad-serving domain as a redirect hop in malicious email campaigns, using its trusted reputation to bypass security filters before delivering the DesckVB remote access trojan. Because many email and web security tools whitelist or deprioritise scrutiny of well-known Google-owned domains, the technique significantly increases the likelihood of successful delivery. Once installed, a RAT gives attackers persistent remote control over the victim’s machine.

Architect’s Take: Review your email and web proxy security policies to ensure that redirects through trusted domains — including Google-owned properties like DoubleClick — are still subject to full URL chain inspection and sandbox detonation. Consider enforcing policies that follow and evaluate the final destination URL rather than trusting the initial domain at face value.

Original advisory: Google DoubleClick Abused in New Malspam Campaign to Deliver DesckVB RAT

Attackers are exploiting Google’s DoubleClick ad-serving domain as a redirect layer in malicious spam emails, using its trusted reputation to bypass security filtering tools before routing victims to attacker-controlled infrastructure that delivers the DesckVB remote access trojan. Because DoubleClick is a widely trusted Google domain, many email and web security products will not flag the initial link as suspicious. This technique is a growing trend of abusing legitimate cloud services to obscure the early stages of an attack chain.

Architect’s Take: Review your email and web proxy security controls to ensure they inspect the full redirect chain rather than trusting links solely based on the root domain — allowlisting DoubleClick or similar Google domains without inspecting downstream redirects creates a blind spot. Consider enforcing URL rewriting and sandboxed link-following in your email security gateway, and ensure endpoint detection controls are tuned to flag RAT behaviour post-delivery.

Original advisory: Google DoubleClick Abused in New Malspam Campaign to Deliver DesckVB RAT

This is a webinar announcement featuring HD Moore, creator of Metasploit, focused on network exposure and attack surface visibility rather than reactive patching. The core argument is that with zero-days arriving faster than patches and AI accelerating exploit development, organisations must shift focus to limiting what an attacker can reach once inside. It matters because it reframes security strategy around blast radius reduction rather than the increasingly futile race to patch everything in time.

Architect’s Take: Use this as a prompt to audit your cloud network segmentation and lateral movement paths — map which workloads can reach critical data stores or control planes, and enforce least-privilege network policies (e.g. security groups, VPC firewall rules, micro-segmentation) so a compromised instance has minimal onward reach.

Original advisory: Beyond the Zero-Day: See Your Network Like an Attacker | Webinar with HD Moore

This is a webinar featuring HD Moore, creator of Metasploit, focused on shifting security strategy away from reactive patching and towards understanding network exposure and attack paths. The core argument is that zero-days and AI-generated exploits make ‘patch everything in time’ an unrealistic goal. What matters more is controlling what an attacker can reach once they’re inside — a principle of blast radius reduction.

Architect’s Take: Use this as a prompt to audit your network segmentation and lateral movement paths in cloud environments — map east-west traffic flows, review VPC peering and transit gateway configurations, and validate that microsegmentation or zero-trust controls are actually limiting what a compromised workload can reach.

Original advisory: Beyond the Zero-Day: See Your Network Like an Attacker | Webinar with HD Moore

A debug flag accidentally left enabled in production builds of multiple Microsoft 365 Android apps disabled a security check that restricts account token sharing to trusted Microsoft applications. As a result, any app installed on the same Android device could silently request and receive the signed-in user’s authentication token, granting full access to email, files, calendar, and the ability to send messages on their behalf. No user interaction, credentials, or elevated permissions were required to exploit this.

Architect’s Take: Audit your mobile application management (MAM) and Conditional Access policies to ensure app-based controls are enforced at the resource level and are not solely reliant on client-side token handling. Until Microsoft confirms a fully patched build is deployed, consider enforcing Continuous Access Evaluation (CAE) and restricting M365 access on Android to Intune-managed devices with compliant app versions.

Original advisory: Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag

A debug flag accidentally left enabled in production builds of multiple Microsoft 365 Android apps disabled the trust check that normally restricts account-token sharing to authorised Microsoft applications. As a result, any app installed on the same Android device could silently request and receive a valid authentication token, granting full access to the victim’s email, files, calendar, and messaging without any user interaction or additional permissions. The flaw affects any user running a vulnerable Microsoft 365 Android app while also having a malicious or compromised app on the same device.

Architect’s Take: Mandate immediate updates to all affected Microsoft 365 Android apps across your managed device estate via your MDM/UEM solution, and review Conditional Access policies to detect anomalous token usage or unexpected app sign-ins. Consider temporarily blocking unmanaged Android devices from accessing Microsoft 365 resources until patched app versions are confirmed deployed.

Original advisory: Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag

A security researcher has publicly leaked Microsoft exploit code in protest at how the company handles vulnerability disclosures, following a similar incident by a researcher known as Nightmare Eclipse. The move bypasses responsible disclosure norms, meaning working exploits are now publicly available before Microsoft has necessarily issued patches. This significantly raises the risk for organisations running unpatched Microsoft and Azure environments.

Architect’s Take: Review your Microsoft and Azure patch status immediately and prioritise any outstanding security updates — publicly available exploit code dramatically shortens the window between disclosure and active exploitation. Ensure your vulnerability management process includes alerting on zero-day and pre-patch public exploit releases, not just CVE publication.

Original advisory: Another bug hunter leaks Microsoft exploits in defiance of company’s handling of vulnerability disclosures

A security researcher has publicly leaked Microsoft exploit code in protest at how the company handles vulnerability disclosures, following a similar incident by a researcher known as Nightmare Eclipse. The researcher chose to bypass responsible disclosure and release exploits immediately, arguing Microsoft’s process is inadequate. This creates immediate risk as working exploit code is now publicly available before patches may be widely applied.

Architect’s Take: Review your Azure and Microsoft 365 patch status urgently and prioritise any outstanding Microsoft security updates, as publicly available exploit code significantly shortens the window between disclosure and active exploitation. Monitor Microsoft’s Security Response Center and threat intelligence feeds closely for CVE details tied to these leaks.

Original advisory: Another bug hunter leaks Microsoft exploits in defiance of company’s handling of vulnerability disclosures

Modern enterprise identity and access management (IAM) is increasingly fragmented across applications, machine identities, and decentralised teams, creating blind spots known as ‘Identity Dark Matter’ — activity that falls outside centralised IAM controls. Identity Visibility and Intelligence Platforms (IVIP) are emerging as a way to consolidate this visibility and reduce the exploitable attack surface. This matters because unmanaged identities are a primary vector for privilege abuse and lateral movement in cloud environments.

Architect’s Take: Audit your current IAM coverage gaps by mapping all human, machine, and federated identities across your cloud estate — then evaluate IVIP tooling to surface shadow identities and unmanaged service accounts that your existing IAM tooling cannot see.

Original advisory: Shrinking the IAM Attack Surface through Identity Visibility and Intelligence Platforms (IVIP)

Researchers are applying machine learning techniques to crack historical hand-written ciphers used in medieval correspondence, including diplomatic and personal communications. While academically fascinating, this work demonstrates that AI can systematically analyse and break pattern-based encryption schemes that were previously considered too obscure to decode at scale. It highlights the broader capability of AI to accelerate cryptanalysis against weak or legacy cipher designs.

Architect’s Take: No immediate action is required, but this research serves as a timely reminder to audit any legacy or proprietary encryption schemes in your environment — AI-assisted cryptanalysis lowers the bar for breaking non-standard ciphers. Ensure all sensitive data at rest and in transit is protected by modern, well-vetted standards such as AES-256 and TLS 1.3, and avoid reliance on security through obscurity.

Original advisory: AI Used to Decrypt Medieval Ciphers

Researchers are applying machine learning techniques to decode historical hand-written ciphers used in medieval correspondence, including diplomatic and personal communications. Whilst not a direct cybersecurity threat, it demonstrates AI’s growing capability to break encryption schemes that were previously considered uncrackable. This has broader implications for understanding how AI might be applied to attack legacy or weak cryptographic implementations.

Architect’s Take: No immediate action required, but treat this as a signal to audit any legacy or non-standard encryption schemes in your environment — if AI can crack medieval ciphers, weak or deprecated algorithms (e.g. DES, MD5, RC4) are increasingly at risk. Ensure your cryptographic inventory is up to date and aligned with current NCSC guidance.

Original advisory: AI Used to Decrypt Medieval Ciphers

Anthropic has expanded its Glasswing partner programme fourfold, inducting 150 new organisations including the first non-US members, while UK banks have notably been excluded from the initiative. In parallel, OpenAI is offering UK financial institutions access to GPT-5.5, highlighting a competitive dynamic in AI partnerships within the regulated financial sector. The exclusion raises questions around data sovereignty, regulatory compliance, and which AI vendors UK-regulated entities can practically partner with.

Architect’s Take: Cloud security architects at UK financial institutions should assess the compliance and data residency implications of both OpenAI and Anthropic offerings before committing to either platform, paying close attention to FCA and PRA guidance on third-party AI risk and ensuring any AI partnership agreements include robust contractual controls around data handling and model governance.

Original advisory: UK banks offered access to OpenAI’s GPT-5.5 amid exclusion from Anthropic’s Glasswing expansion

Anthropic has expanded its Glasswing partner programme fourfold, inducting 150 new organisations including the first non-US members, while UK banks have notably been excluded. OpenAI has moved to fill the gap by offering UK financial institutions access to GPT-5.5. The development highlights growing competitive dynamics in enterprise AI access and raises questions about supply chain concentration risk for financial sector security teams.

Architect’s Take: Cloud security architects in UK financial services should assess the security posture, data residency commitments, and compliance certifications of any AI provider they are offered as an alternative — do not treat OpenAI’s GPT-5.5 access as a like-for-like replacement for Anthropic without conducting due diligence on API security controls, data handling agreements, and regulatory alignment with FCA/PRA expectations.

Original advisory: UK banks offered access to OpenAI’s GPT-5.5 amid exclusion from Anthropic’s Glasswing expansion

An unpatched vulnerability in Windows’ ‘search:’ URI handler can be exploited to leak a user’s NTLMv2 credential hash to an attacker, similar to a recently disclosed flaw in the Windows Snipping Tool (CVE-2026-33829). NTLMv2 hashes can be cracked offline or used in relay attacks to authenticate as the victim. The vulnerability remains unpatched, making it an active risk for any Windows environment, including cloud-connected hybrid setups.

Architect’s Take: Block or restrict outbound SMB traffic (TCP 445) at the network perimeter and enforce NTLM restrictions via Group Policy or Azure AD Conditional Access to reduce relay attack exposure. Additionally, consider deploying Defender for Endpoint or equivalent EDR rules to flag suspicious search: URI handler invocations until a patch is available.

Original advisory: Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes

A newly discovered vulnerability dubbed ‘HTTP/2 Bomb’ allows attackers to remotely crash major web servers — including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora — without authentication. The flaw exploits default HTTP/2 configurations, meaning most deployments are vulnerable out of the box. Because it affects such a broad range of widely used infrastructure, the potential impact is significant across cloud and on-premises environments alike.

Architect’s Take: Audit your HTTP/2 configurations across all edge and origin servers immediately, and apply vendor patches or mitigations as they are released — prioritising internet-facing NGINX, Apache, IIS, and Envoy instances. In the interim, consider enforcing HTTP/2 connection and stream limits at your load balancer or WAF layer to reduce exposure.

Original advisory: New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare

A malware-as-a-service campaign dubbed Weedhack has been targeting Minecraft players since January 2026, distributing malicious software disguised as game clients and mods via YouTube. The operation has already compromised approximately 86,000 systems and includes components such as CountLoader and cryptocurrency miners. The campaign highlights how gaming communities remain a significant vector for delivering credential-stealing and system-control malware at scale.

Architect’s Take: If your organisation permits personal devices or BYOD access to cloud workloads, ensure endpoint detection controls can identify MaaS-delivered loaders such as CountLoader, and audit whether compromised personal credentials could pivot into corporate cloud environments via SSO or reused passwords.

Original advisory: Weedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated Content

A malware-as-a-service campaign dubbed Weedhack has been targeting Minecraft players since January 2026, distributing malware through YouTube by impersonating legitimate Minecraft clients and mods. The campaign has compromised thousands of systems and is linked to a loader dubbed CountLoader, which has recorded over 86,000 infections. The threat is notable for its exploitation of gaming communities and pirated software channels as a delivery mechanism for system-control malware.

Architect’s Take: While this campaign primarily targets consumers, architects should review endpoint security policies for corporate devices that may have gaming software installed, and ensure DNS filtering and web proxies block known malicious YouTube redirect chains and payload-hosting domains associated with Weedhack. Consider adding gaming and piracy-related domains to URL category block lists on managed endpoints.

Original advisory: Weedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated Content

A critical vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento/Adobe Commerce allows unauthenticated attackers to execute arbitrary code on affected servers. The flaw stems from unsafe deserialisation of a crafted PHP object passed via the CacheWarmer cookie, requiring no login or prior access. This vulnerability is actively being exploited in the wild, confirmed by CISA’s inclusion in its Known Exploited Vulnerabilities catalogue.

Architect’s Take: Identify any Magento or Adobe Commerce instances running the Mirasvit Full Page Cache Warmer extension and apply the vendor patch immediately ahead of the 6 June 2026 remediation deadline. Where patching is not immediately possible, implement a WAF rule to inspect and block malicious serialised PHP objects in the CacheWarmer cookie as an interim control.

Original advisory: CVE-2026-45247: Mirasvit Mirasvit Full Page Cache Warmer

A ransomware operator has broken the unwritten but widely observed rule among Russian-speaking cybercriminal groups by attacking targets within Russia or CIS countries, drawing attention to themselves and likely facing consequences from both law enforcement and criminal peers. This norm has historically served as an informal shield, with many ransomware variants including code to abort execution if a CIS locale is detected. The incident highlights the internal politics and geographic conventions that shape how ransomware gangs operate.

Architect’s Take: Use this as a reminder to review whether your ransomware detection and response playbooks account for threat actors who may no longer respect traditional geographic boundaries — do not assume CIS-origin malware will avoid your organisation based on locale checks alone.

Original advisory: ‘Dumbass’ criminal breaks the ‘first rule of ransomware club’

A ransomware operator has been caught after violating one of the unwritten rules of Russian-linked cybercrime: never target victims in Russia or other CIS nations. This breach of convention drew attention from Russian authorities, who typically turn a blind eye to ransomware gangs operating abroad. The case highlights the implicit geopolitical arrangement that has allowed many ransomware groups to operate with near-impunity.

Architect’s Take: While this story is primarily threat-intelligence context rather than a technical vulnerability, cloud security architects should use it as a prompt to review their ransomware resilience posture — ensure immutable, offline-tested backups exist in cloud environments, and verify that incident response plans account for ransomware-as-a-service actors who may face reduced operational risk depending on their geography.

Original advisory: ‘Dumbass’ criminal breaks the ‘first rule of ransomware club’

Google’s June 2026 Android security update addresses 124 vulnerabilities, including a high-severity privilege escalation flaw (CVE-2025-48595) in the Android Framework component that is actively being exploited in the wild. The flaw requires no user interaction, making it particularly dangerous as attackers can escalate privileges silently. Organisations with Android devices in their mobile fleet or BYOD programmes should treat this update as urgent.

Architect’s Take: Prioritise enforcement of this patch across managed Android devices via your MDM solution (e.g. Intune, Jamf, or Google Endpoint Management) — focus first on devices accessing corporate cloud resources or sensitive SaaS applications. Review your mobile threat defence policies to detect any exploitation attempts against unpatched devices in the interim.

Original advisory: Google June 2026 Android Update Patches 124 Flaws, One Actively Exploited

Cisco has publicly praised its AI model ‘Mythos’ for its performance in automated vulnerability discovery but has declined to disclose the number of bugs it actually found. Separately, Anthropic has expanded its Project Glasswing initiative by adding 150 new partners, signalling growing industry investment in AI-driven security tooling. The opacity around Mythos’ results raises questions about transparency and how organisations should evaluate AI security claims.

Architect’s Take: Treat vendor claims about AI-driven vulnerability discovery with scepticism until independently verifiable metrics are published — when evaluating AI security tooling, demand concrete, auditable outputs such as CVE counts, false-positive rates, and coverage scope before committing to any platform.

Original advisory: Cisco sings Mythos’ praises - but doesn’t say how many bugs the model uncovered

Russian state-linked threat group Gamaredon is actively exploiting CVE-2025-8088, a path traversal vulnerability in WinRAR, to deploy a chain of malware against Ukrainian targets. The attack begins with an HTML Application payload (GammaPhish) which then downloads further malware including GammaWorm and GammaSteel, designed for data theft and lateral propagation. This is a targeted, state-sponsored campaign with significant implications for organisations operating in or with Ukraine.

Architect’s Take: Ensure WinRAR is patched to a version addressing CVE-2025-8088 across all endpoints, and consider blocking HTA file execution via AppLocker or Windows Defender Application Control policies. Cloud-connected environments should review egress controls and data exfiltration detection rules, particularly for workloads with access to sensitive data stores.

Original advisory: Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine

A high-severity vulnerability in Oracle WebLogic Server (CVE-2024-21182) has been added to CISA’s Known Exploited Vulnerabilities catalogue following confirmed active exploitation in the wild. The flaw allows an unauthenticated attacker with network access to take full control of affected servers without any credentials. Any organisation running Oracle WebLogic in cloud or on-premises environments should treat this as an urgent remediation priority.

Architect’s Take: Audit your cloud environments immediately for internet-exposed or network-accessible WebLogic instances and apply Oracle’s patch from the January 2024 Critical Patch Update without delay. As an interim control, restrict network access to WebLogic admin ports using security groups or firewall rules, and consider placing instances behind a WAF or application gateway.

Original advisory: Oracle WebLogic CVE-2024-21182 Added to KEV Catalog After Active Exploitation