Verizon DBIR Crowns Vulnerability Exploits as Top Breach Vector; Microsoft Disrupts Fox Tempest Malware-Signing Service

Security experts, including Check Point's Yochai Corem, warn that the 'agentic speed' of AI-powered attacks, which can autonomously chain exploits and pivot rapidly, creates a critical mismatch with slow, manual human remediation cycles. This asymmetry is now considered the most exploitable vulnerability. Organizations must shift to automated discovery, validation, and remediation to match the adversary's pace, as demonstrated by a healthcare organization reducing MTTR to 0.87 hours. This requires embracing exposure management and redefining security analyst roles.

The 'MiniPlasma' zero-day exploit's proof-of-concept has been further verified by multiple independent security researchers, confirming its reliability on fully patched Windows 11 systems. This widespread confirmation significantly increases the urgency, with active exploitation by threat actors now considered highly likely. The new report also provides specific external sources, including direct links to articles detailing the vulnerability and its impact, offering additional context and verification for the ongoing threat.

Check Point Research reports new AI-powered exploits. 'Claw Chain' (CVE-2026-44112, CVSS 9.6) vulnerabilities were found in the OpenClaw autonomous AI agent platform, allowing sandbox bypass and full control. Additionally, an AI-assisted exploit was demonstrated to bypass Apple's Memory Integrity Enforcement on M5 chips, granting full system control. These disclosures provide concrete examples of the emerging threat of AI in vulnerability discovery and exploitation, making the previously theoretical threat more tangible.

Recent campaigns like TeamPCP and 'mini Shai-Hulud' exemplify a strategic shift by threat actors to target developer workstations directly. These environments are now considered the 'epicenter' for compromising the entire software delivery lifecycle, as they contain high-value credentials, API keys, and secrets. Experts emphasize the need to treat developer machines as production environments, implementing robust endpoint security, credential hygiene, and containerized development to mitigate widespread supply chain compromise.

New details from TanStack confirm the 'Mini Shai-Hulud' campaign compromised 42 of their npm packages on May 11, 2026, publishing 84 malicious versions. The attack leveraged GitHub Actions cache poisoning and, critically, the theft of a short-lived OIDC token from the build environment. This sophisticated method allowed attackers to publish packages without compromising maintainer credentials, highlighting a dangerous new vector for supply chain attacks through CI/CD pipelines. The payload was credential-stealing malware targeting developer environments.