AI agent supply chains and sandbox escapes are rapidly evolving into active exploitation vectors, as evidenced by ransomware targeting ML datasets, autonomous breaches at Hugging Face, and CLI tool vulnerabilities. Concurrently, critical web application and SaaS flaws like the WP2Shell WordPress RCE and actively exploited ServiceNow pre-auth RCE demand immediate WAF rule tuning and API security validation. For enterprise defenders, prioritizing AI model/data protection, tightening client-side file parsing, and monitoring zero-day VPN exploitation will be essential to maintaining robust appsec and infrastructure postures.
This legacy edition is awaiting expanded Slugnet analysis and is not yet indexed.
Audio briefing
A spoken version of today’s prioritized cybersecurity briefing.
The audio edition is not available yet.
The JadePuffer autonomous agent now deploys the EncForge ransomware to encrypt AI training datasets, vector databases, and model checkpoints, highlighting a new threat vector for ML platform security.
This legacy edition predates Slugnet’s expanded analytical assessment.
Attackers are actively chaining two WordPress vulnerabilities to achieve remote code execution across millions of sites, creating immediate WAF bypass opportunities for web application defenses.
This legacy edition predates Slugnet’s expanded analytical assessment.
A critical pre-authentication code injection flaw in the ServiceNow AI Platform is being exploited in the wild, allowing unauthenticated attackers to escape script sandboxes and execute arbitrary commands via API calls.
This legacy edition predates Slugnet’s expanded analytical assessment.
Nearly 7,600 malicious GitHub repositories are distributing SmartLoader malware, with over 800 masquerading as AI skills or MCP servers to compromise developer environments and CI/CD pipelines.
This legacy edition predates Slugnet’s expanded analytical assessment.
An autonomous AI agent breached Hugging Face’s production infrastructure by abusing a malicious dataset, compromising internal datasets and service credentials used across its ML platform.
This legacy edition predates Slugnet’s expanded analytical assessment.
Researchers successfully escaped sandboxes in Cursor, Codex, Gemini CLI, and Antigravity by tricking agents into writing host-trusted files, demonstrating a critical supply-chain risk for AI-assisted development tools.
This legacy edition predates Slugnet’s expanded analytical assessment.
Two zero-day vulnerabilities in the SonicWall SMA1000 have been actively exploited to deploy custom malware on VPN appliances, underscoring the need for rapid WAF and network segmentation rule updates.
This legacy edition predates Slugnet’s expanded analytical assessment.
An exposed server reveals a fully operational AI-assisted phishing toolkit that leverages LLMs to rapidly generate lures and test delivery paths, signaling a shift toward productized malware operations targeting enterprise endpoints.
This legacy edition predates Slugnet’s expanded analytical assessment.
Capital One open-sourced an agentic security tool that traces attack paths through codebases and recommends targeted remediations, offering a scalable model for integrating AI into IAST and SAST workflows.
This legacy edition predates Slugnet’s expanded analytical assessment.
A heap-based buffer overflow in 7-Zip allows crafted XZ archives to execute arbitrary code during extraction, posing a persistent client-side threat that requires strict file-type filtering and IAST validation.
This legacy edition predates Slugnet’s expanded analytical assessment.