Issue 28

10 July 2026

Hi there,

Sysdig’s JADEPUFFER report is grim. The agent got in through Langflow, stole credentials and encrypted 1,342 database entries. When a login failed, it tried again with a corrected command. The ransom note didn’t include a usable decryption key.

Curl’s Daniel Stenberg had a different problem: he closed the project’s vulnerability-report inbox for July after AI-generated submissions overwhelmed the maintainers. They’re volunteers. Reading a hundred convincing but worthless reports is still work, even if a machine wrote them in seconds.

Industry

1. OpenAI’s July outage leaves FedRAMP tools impaired

OpenAI’s 7 July disruption affected Codex, workspace analytics, conversation search, Custom GPT search, user invitations and compliance-log downloads in FedRAMP workspaces. OpenAI said core functionality was restored while it worked on the remaining FedRAMP issues. The important distinction is scope: reports of a ChatGPT outage do not establish that the entire service or all API customers were down. For an organisation depending on these features, a status page that says core service is up is not the same as its workflow being restored.

2. Chinese AI is winning on price, and US enterprises are noticing

Some US companies are shifting workloads onto Chinese models as they seek lower-cost alternatives. Z.ai’s GLM 5.2 – released in June – hit the fastest adoption curve of any model Vercel tracked this year, growing token volume 27x and customer count 80x in its first full week, landing within a percentage point of Anthropic’s Opus 4.8 on a closely-watched agentic benchmark at roughly a fifth of the cost. The share of tokens flowing through Chinese models on OpenRouter has sat above 30% every week since February, touching 46% at its peak. In the first half of 2025 it was 4.5%, CNBC reports. Those figures come from Vercel and OpenRouter usage reported by CNBC, not a census of all enterprise AI workloads.

Artificial Intelligence

3. Apple expands its AI developer tools at WWDC

At WWDC in June, Apple announced new developer AI frameworks and Xcode 27 integrations. Core AI is a new framework for running custom models on-device; Apple also offered qualifying small developers access to its newer cloud-based Foundation Models at no cloud API cost. Separately, Xcode 27 integrates coding agents and models from Anthropic, Google and OpenAI into the developer workflow. These are distinct integrations, not an announcement that Apple’s Foundation Models framework is open source or a single interchangeable API for all three services.

4. Rowboat: open-source AI coworker with memory

Rowboat (from Rowboat Labs) turns your work into a living knowledge graph and runs agents on top of it – drafting email responses with full work context, scheduling background agents triggered by events like new mail, browsing the web, executing code. It connects to external systems via MCP, and its multi-agent architecture lets specialised agents collaborate rather than routing everything through one model. The Show HN thread generated solid interest. Worth a look if you’re evaluating open-source agentic infrastructure rather than building on top of a vendor’s platform.

Infrastructure

5. TrojPix leaks data from air-gapped machines via video cable emissions

Researchers at Shandong University demonstrated TrojPix, a technique for exfiltrating data from air-gapped computers by modulating on-screen pixels to force the attached video cable to emit a faint radio signal – readable up to 208 metres away. Peak throughput: 8.1 Mbps, enough to move 100 MB in under two minutes. The pixel changes are imperceptible to the human eye. TrojPix requires only user-level privileges and no hardware modification; the attacker needs malware on the target first, and then a radio receiver within range. It doesn’t work as an initial intrusion vector, only as an exfiltration channel. For the vast majority of environments this is academic – but for the facilities where air-gapping is the actual security model (industrial control, classified networks), it’s a meaningful erosion of an assumption that’s carried a lot of weight.

Microsoft

6. SharePoint RCE on CISA’s KEV list – patch deadline was July 4th

CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalog and gave federal agencies three days to patch – a July 4th deadline. The flaw is a deserialization RCE (CVSS 8.8) in SharePoint Server Subscription Edition, 2019 and 2016, exploitable by any authenticated user with Site Member-level permissions or above, no interaction required. Microsoft patched it in May and originally rated exploitation as "less likely." CISA’s addition is the signal that "less likely" has become "actively happening." If you’re running on-prem SharePoint and haven’t applied the May update, the remediation deadline has already passed for the federal standard; the practical standard is the same.

7. Azure CLI password spray: 81 million attempts, MFA bypassed at 64 organisations

Between June 12 and 26, attackers ran 81 million login attempts against Microsoft 365 accounts via Azure CLI, compromising at least 78 accounts across 64 organisations – including at shops that had MFA enabled. The bypass wasn’t a cryptographic break. Attackers used the ROPC OAuth flow (deprecated in OAuth 2.1), which exchanges credentials directly at the token endpoint without triggering an interactive authorisation step. Conditional Access Policies that enforce MFA at the authorisation endpoint, but not across all cloud apps or all users, don’t catch it. Eight of the affected organisations had no MFA at all. The fix: enforce Conditional Access across all cloud apps, block legacy auth flows, and treat Azure CLI as the same authentication surface as the browser. The ROPC gap has been documented for years; it’s still open at a depressing number of organisations.

Development

8. curl closes its bug inbox for July – AI spam made it unsustainable

Daniel Stenberg declared a "summer of bliss": curl’s HackerOne form and security email are closed for the entirety of July, reopening in August. The reason is AI-generated vulnerability reports. The confirmation rate for reports had fallen below 5% – down from historically above 15%. The volume had doubled year-on-year, which was already double the year before that. Stenberg estimates the rate of useful reports has collapsed while the total count has surged, and the project’s volunteer capacity to triage them ran out. libexpat’s Sebastian Pipping announced a similar pause. This is the unglamorous practical consequence of AI agent access to bug bounty pipelines: the signal-to-noise ratio collapsed, and the people who actually maintain the software – for free – paid the cost. Only paid support contracts retain access during the break.

9. Fortress: a Chromium build claiming stronger anti-detection

Fortress (tiliondev) is a Chromium build that corrects the browser fingerprint at the C++ level, so it presents as an ordinary Chrome install. Its maintainers claim their build passes CreepJS, Sannysoft, BrowserScan and live Cloudflare Turnstile checks; those results are not independently verified here. You point existing Playwright or Puppeteer at it over CDP – nothing else in the code changes. Available via Docker, pip, npm or direct build. If you run any kind of browser automation at scale and have been fighting Cloudflare or similar, it’s worth testing.

Information Security

10. JADEPUFFER: the first documented end-to-end AI agent ransomware

Sysdig’s threat research team published their analysis of JADEPUFFER, what they assess as the first fully autonomous AI-agent ransomware operation. The agent exploited CVE-2025-3248 (a Langflow RCE) for initial access, harvested cloud and LLM-provider credentials, pivoted to a production MySQL/Alibaba Nacos server, encrypted 1,342 configuration items, and left a ransom note whose decryption key was never saved – making recovery impossible even with payment. No human in the loop at any point. The clearest evidence of autonomous reasoning: when an admin login failed, the agent diagnosed the cause and issued a corrected attempt within 31 seconds. More than 600 payloads across the operation contained plain-language comments explaining the agent’s own reasoning. The cost to run an operation like this, Sysdig notes, approaches zero if the attacker is running on stolen LLM credentials via LLMjacking. The skill floor for ransomware just dropped by a floor.

11. DHS confirms intrusion into its information-sharing network

DHS confirmed an intrusion into HSIN, the unclassified collaboration platform used by government and private-sector security partners. The attack is believed to have occurred between late May and early June, and investigators also examined a SharePoint system used for collaboration. DHS says it isolated the affected environment, that classified networks were not impacted, and that HSIN remains operational. The scope of access and whether any documents were stolen were not yet established as of the July 1 report; World Cup security planning is a potential concern, not a confirmed leak. Attribution remains open.

12. Gitea Docker image trusts too many reverse proxies

Gitea’s advisory for CVE-2026-20896 describes a dangerous combination in official Docker images through 1.26.2: the bundled configuration sets REVERSE_PROXY_TRUSTED_PROXIES = *, whereas the documented default trusts only loopback. The bypass requires an administrator to have enabled reverse-proxy authentication, and an attacker to reach the container directly rather than through its authenticating proxy. Under those conditions, an X-WEBAUTH-USER header can impersonate a known user, including an admin, with no password. Binary and self-built installs that retain the documented default are not affected. Upgrade the Docker image to 1.26.4 or later; until then, restrict trusted proxies to the actual proxy address or disable reverse-proxy authentication if unused.

13. CitrixBleed returns: NetScaler memory overread exploited within 24 hours

CVE-2026-8451, a memory-overread in NetScaler ADC and Gateway’s SAML IdP path, was exploited in the wild less than 24 hours after Citrix published the patch on June 30. The flaw lives in the XML parser at /saml/login: malformed input causes the parser to read past the buffer, with excess memory returned to the attacker in the NSC_TASS cookie. Session tokens, cookies, and credentials for the whole workforce sit in that memory on an appliance that sees constant authentication traffic. CVSS 8.8, unauthenticated, pre-auth. Fix: NetScaler ADC/Gateway 14.1-72.61 or later, or 13.1-63.18 or later. If you can’t patch, disabling SAML IdP removes the attack surface.

Coming up

• 1–6 August · Black Hat USA, Las Vegas. Trainings run 1–4 August; the main Briefings and Arsenal programme is 5–6 August. Official programme.

If anything in here is worth unpacking further, reply and let me know.

Until next week,
Julian