Archive | Hardened Cybersecurity and AI Newsletter

Prompt Injection Is the New Remote Code Execution

Jun 15, 2026

How to Secure Your Agentic AI Frameworks Against Escalating Critical Vulnerabilities

Attackers are turning Cisco's SD-WAN Manager against the network it runs — CVE-2026-20245 is an exploited, still-unpatched root bug

Jun 8, 2026

Cisco confirms exploitation across on-prem, cloud, and FedRAMP deployments: a netadmin-to-root command-injection bug that has already been used to push configuration changes to edge devices.

A third-party Magento cache plugin is handing attackers full store takeover — CVE-2026-45247 is unauthenticated RCE, and it is already being exploited

Jun 5, 2026

The Mirasvit Full Page Cache Warmer extension deserializes an attacker-controlled cookie on ordinary storefront requests, turning a single unauthenticated HTTP request into remote code execution; CISA added the flaw to its Known Exploited Vulnerabilities catalogue on June 3 after researchers observed live attacks.

An autonomous AI tool found a two-year-old RCE hiding in Redis — CVE-2026-23479 puts the cloud's most common datastore at risk

Jun 4, 2026

An AI bug-hunter found CVE-2026-23479, a use-after-free in Redis that an authenticated session escalates to remote code execution — and in default, passwordless deployments the default user already carries every privilege required.

Miasma worm poisons 32 official Red Hat npm packages — every install since June 1 leaks your cloud and CI/CD secrets

Jun 2, 2026

A hijacked Red Hat developer account pushed a Mini Shai-Hulud variant into @redhat-cloud-services; its preinstall hook steals cloud, Vault, and pipeline credentials before any code runs.

Gogs ships a working exploit and no patch — one new account owns the whole Git server

Jun 1, 2026

Rapid7 released a Metasploit module for an unpatched Gogs flaw; on default installs, any self-registered user runs code and reads every repo, token, and SSH key.

Luna Moth Operatives Walk Into Law Firms, Walk Out With Client Files — FBI FLASH Confirms No Malware Deployed

May 29, 2026

Operatives impersonating IT support now physically enter law firm offices and connect USB storage to workstations, exfiltrating attorney-client files without triggering a single endpoint alert — the FBI's May 26 FLASH confirms 100-plus attacks and 38 firms' data already published.

One Malformed HTTP Header Bypasses Auth on Starlette's Entire AI Stack — CVE-2026-48710

May 28, 2026

X41 D-Sec found the flaw during an OSTIF-sponsored vLLM audit; any FastAPI, vLLM, LiteLLM, or MCP service running Starlette below 1.0.1 is open to unauthenticated path bypass with a single crafted request.

Nimbus Manticore Targets Aviation and Defence With AI-Assisted Backdoor

May 27, 2026

Nimbus Manticore weaponized Zoom installers to deliver MiniFast against aviation, defence, and telecom targets, placing Canadian prime contractors and Crown corporations in direct scope through supply chain exposure with confirmed victims.

Megalodon Poisoned 5,561 GitHub Repos in Six Hours — No CVE, No Patch, Just a Missing Branch Protection Rule

May 26, 2026

Attackers with stolen GitHub credentials injected backdoored CI/CD workflows into 5,561 unprotected repositories, harvesting cloud credentials and SSH keys from every pipeline run that followed.