AI-Powered Attacks Escalate; Critical Vulnerabilities and Supply Chain Risks Dominate

This daily cybersecurity publication highlights a significant escalation in AI-driven cyber threats, alongside critical vulnerabilities and ongoing supply chain risks. Microsoft Threat Intelligence has attributed the ConnectWise Cloud Backup supply chain attack to Storm-0940, a China-linked threat actor, noting their use of a custom AI agent framework named 'ARTEX' to automate credential abuse and accelerate unauthorized access to Microsoft 365 environments. Similarly, threat actor 'BUGSTER' is actively weaponizing jailbroken AI tools for credential theft and VoIP fraud, demonstrating increased operational efficiency and sophistication.

Critical vulnerabilities remain a major concern. The PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) are experiencing millions of active exploitation attempts, prompting a CISA emergency directive for federal agencies and precautionary system shutdowns globally. GitLab has also patched a critical integer overflow vulnerability in its Community and Enterprise Editions, urging immediate upgrades for self-managed installations.

Supply chain attacks continue to pose a widespread threat. The popular AI gateway tool LiteLLM has suffered its second supply chain attack, with a malicious version distributing malware to harvest cloud and AI service keys. Kroll's 2026 Data Breach Outlook report indicates that 69% of organizations experienced data breaches in the past year, with breaches originating from third-party technology providers having the widest impact.

New advisories warn of prolific ransomware and phishing campaigns. The SafePay ransomware group is reportedly exploiting five specific CVEs for initial access to critical infrastructure, with updated guidance emphasizing urgent patching. Users of the Ngrave hardware wallet have lost approximately $2.56 million due to a phishing attack that compromised a third-party notification service, leading users to a counterfeit website to steal recovery phrases. Additionally, the IT firm Computer Task Group (CTG) has disclosed a data breach exposing sensitive personal data, including Social Security numbers and health information.