‼️🚨 Unauthenticated attackers are gaining SYSTEM on domain controllers with crafted packets. The vulnerability being exploited is CVE-2026-41089, a CVSS 9.8 hole in Windows Netlogon, and exploitation in the wild has been confirmed. A patch has existed since May 12. Every DC still behind is not just vulnerable, but according to the Centre for Cybersecurity Belgium are also actively being pwnd.

Today, we filed a lawsuit to permanently dismantle a group of organized cybercriminals accused of using AI tools — including Gemini — to scam Americans via fake text campaigns. Here’s what to know: ◾Our suit targets core software developers in a cybercrime operation known as the “Outside Enterprise.” The group has allegedly weaponized AI to quickly generate highly convincing fake government and brand websites intended to steal victims’ credit card numbers and personal information. ◾The group used AI and different Google products — including our trademarks and logos — as part of these phishing campaigns. ◾The scale of the operation is massive: More than 100,000 victims have been scammed, with losses estimated in the millions.

As far as we can tell, no. There is only anecdotal evidence, along with claims from AI pentesting vendors. If a strong model can do everything by itself, then what exactly have these vendors been building? It is understandable that people would prefer a story in which the harness, workflow, and surrounding infra matter a great deal. It's also why people keep flexing "0-days" in OpenSSL, FFmpeg, or nginx, despite limited real-world impact. That said, Niels Provos was not trying to sell anything, and he and several people have reported good results with IronCurtain despite using relatively weak models. Most importantly, what Google achieved with Chrome suggests that a good harness may be quite valuable. Google does not appear to have access to anything more capable than Mythos, which means they likely scanned Chrome using Mythos itself or something less powerful. Yet they still uncovered hundreds of bugs. There is, however, another explanation. Google may simply have better Chrome/V8 experts who can extract more value from Mythos. This remains our preferred hypothesis. What provides a real advantage: domain knowledge accumulated over many years, or a harness vibe-coded in an afternoon? We think the answer is fairly obvious.

Are there public measurements of how much improvement good harness offers?

Frontier models are also really good at finding and exploiting n-day vulnerabilities, doing so on timescales of hours. Read about some recent work from my team studying these capabilities! red.anthropic.com/2026/n-day…

This is a pretty striking shift toward Chinese models by American AI startups since the start of the year. substack.com/@profgmarkets/p…

EDRChoker uses Policy-based Quality of Service (QoS) to set hard bandwidth caps (throttling) on Endpoint Detection and Response (EDR) agents, causing them to always time out - effectively blocking them. #itsecurity #securityblog #altimalware zerosalarium.com/2026/06/edr…

N. Korean hackers steal US$3 bln in cryptocurrency since 2017 to fund nuclear program: report en.yna.co.kr/view/AEN2024101…

AI companies say their models are getting better at finding software vulnerabilities. Is that bearing out in public data? Introducing our Cyber Vulnerabilities explorer, which visualizes Common Vulnerabilities and Exposures (CVE) reported to the CVE Program since 2022.

Understanding all the causes of increased disclosures is complicated. But we observe a sharp uptick in High and Critical CVEs around the time of Anthropic’s release of Mythos Preview to Project Glasswing partners in late March. OpenAI’s Daybreak cybersecurity program also launched in May.

How well do the security community's techniques hold up against AI-enabled cyberattacks? We examined 832 malicious accounts and mapped their activity onto a longstanding database of tactics and techniques used by threat actors. Here's what we learned:anthropic.com/news/AI-enable…

In our simplest bypass, we prepended 100,000 blank lines to a malicious skill. ClawHub's scanner truncated the file before reaching the payload, then marked the skill safe. blog.trailofbits.com/2026/06…

Even my Instagram account got hacked The password got changed without my knowledge and I was getting different password reset attempts throughout yesterday. And I got repeatedly logged out from the IG iOS app Quite concerning