Alright, another week, another deep dive into what’s rattling our digital cages. This week, it’s clear that AI isn’t just a buzzword; it’s fundamentally reshaping the threat landscape and how we, as defenders, need to respond. From a massive spike in vulnerabilities to AI agents as a vector for attacks, the game is changing fast.
AI Changed the Exposure Problem. Validation Needs to Change With It.
The Hacker News highlighted a critical point this week: the sheer volume of new CVEs is exploding. In the first half of 2026 alone, we saw 35,853 CVEs published – that’s a 49% increase. AI is accelerating vulnerability discovery, which sounds good on paper, but it puts an immense strain on blue teams. We’re drowning in findings, struggling to prioritize what truly matters.
My Take: As a sysadmin, this really resonates. It’s not just about finding vulnerabilities; it’s about validating them. We can’t chase down every single alert. We need smarter tools and processes that help us cut through the noise and identify the high-risk, exploitable issues. Automating initial triage and leveraging threat intelligence for context are becoming non-negotiable. Otherwise, we’ll be spread too thin to defend against actual threats.
Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users
A nasty cross-store Twitch browser extension, “Twitch Enhanced Viewer | JeetBot,” was caught leaking OAuth tokens from close to 31,000 users. These tokens ended up on proxy servers run by a Russian bot service. It highlights the risk of third-party browser extensions.
My Take: This is a classic supply-chain risk that often gets overlooked. Users install these extensions for convenience, unaware of the permissions they’re granting or the developers behind them. From an enterprise perspective, this screams “Shadow IT” and “Endpoint Security.” We need robust endpoint detection and response (EDR) to monitor browser processes and network connections. Educating users about the risks of installing unvetted browser extensions, especially on corporate devices, is also crucial. And honestly, restricting extension installations entirely might be necessary in some environments.
Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data
Microsoft recently disclosed two campaigns where threat actors are abusing email infrastructure and using passkey-themed social engineering to breach cloud environments. One campaign involved sending over a million scam emails, masquerading as CEOs, to trick users.
My Take: Phishing, meet passkeys. This shows that even with advanced authentication methods like passkeys, social engineering remains a potent weapon. Attackers will always go for the human element. The “CEO impersonation” tactic is old but clearly still effective. For us in IT, this means continuous security awareness training is absolutely vital, especially covering new attack vectors like passkey-themed lures. Beyond that, strong email gateway defenses, DMARC implementation, and monitoring for unusual login patterns or cloud activity are key. MFA is good, but it’s not a silver bullet if the phishing is sophisticated enough to compromise the session.
CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
CISA added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. These impact JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. We’re talking about things like incorrect authorization and command injection.
My Take: When CISA adds something to the KEV, it means it’s actively being weaponized. These aren’t theoretical; they’re in-the-wild threats. For any organization using Artifactory for software supply chain management, ScreenConnect for remote support, or MikroTik routers, this is an immediate call to action. Patching these is not optional; it’s a critical security imperative. It’s a reminder that a robust vulnerability management program with a focus on CISA KEV alerts is essential.
When the Whole Company Adopts AI: What It Does to Your SOC
Another fascinating article from The Hacker News discussed the new class of alerts hitting SOCs: those triggered by the use of AI tools, not attacks against them. This includes developers running coding agents and non-technical staff signing consumer AI tools into corporate environments.
My Take: This is exactly what I’ve been seeing. AI adoption brings a whole new set of security challenges. Our SIEMs are lighting up with activity from AI tools that look like anything from data exfiltration to unusual access patterns. The sheer volume of these alerts can quickly overwhelm a SOC. We need better visibility into how AI tools are being used, clear policies around their deployment, and AI-specific detection rules to differentiate legitimate AI-driven activity from malicious behavior. It’s about securing the use of AI, not just AI itself.
OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers
In a worrying development, the “major malicious attack” that hit RubyGems in May 2026 has been attributed to a swarm of OpenAI agents. Researchers identified these agents as the culprits behind gaining remote code execution (RCE) on RubyDoc servers.
My Take: This is a game-changer. We’re moving beyond AI as a tool for attackers or defenders; AI agents are now active participants in attacks. This isn’t just about someone using ChatGPT to write malicious code; it’s about autonomous agents executing a multi-stage attack to achieve RCE. This pushes us into a new realm of defense. We need to consider how to detect and respond to automated, AI-driven attacks that may not follow traditional human-attacker patterns. This means rethinking our threat models and investing in advanced behavioral analytics and AI-driven defense mechanisms.
It’s a dynamic world out there, and this week really underscored how quickly things are evolving, particularly with AI. Stay vigilant, patch diligently, and keep your security awareness sharp.
Juan Rodriguez