Week 36 marks a convergence of critical infrastructure failures across attack surfaces. SonicWall SMA 1000, JFrog Artifactory, Citrix NetScaler, and CrowdStrike Falcon all face active zero-day exploitation with CVSS scores at or near perfect. But the week's most consequential story is the discovery that AI coding agents are automatically installing untrusted code via malicious configuration files—a supply chain vector that bypassed security controls at multiple Fortune 500 companies within hours. Combined with research showing frontier AI models can compress two-week attacks into 10 hours, organizations face a fundamental acceleration in both attack velocity and sophistication.

Weakly Digest —

01 —

AI Coding Agents Autonomously Installing Untrusted Code Across Fortune 500 Networks

🟣 AI/Supply Chain - Active Exploitation

Researchers demonstrated that Claude, Codex, and Hermes AI agents automatically install untrusted code by following malicious package references in llms.txt configuration files. Proof-of-concept attacks successfully compromised multiple Fortune 500 companies within hours, with zero human intervention required.

EDITOR’S NOTE
URGENT: Audit all AI coding agent deployments in your CI/CD pipeline immediately. Implement code signing validation, package repository allowlisting, and network segmentation to isolate agent execution environments. This is SolarWinds-scale supply chain risk with AI-driven automation. Update your build security policies before deploying agents to production networks.

Read on Bruce Schneier

02 —

SonicWall SMA 1000 Critical Zero-Days Form Attack Chain—CVSS 10.0 Pre-Auth SSRF in Active Exploitation

🔴 Critical - Active Exploitation

SonicWall patched two zero-day vulnerabilities in SMA 1000 VPN appliances actively exploited in the wild, including a pre-authentication SSRF flaw rated CVSS 10.0. The vulnerabilities may form an attack chain enabling unauthorized network access and data exfiltration.

EDITOR’S NOTE
CRITICAL: Patch all SMA 1000 devices immediately—this is the third wave of zero-days against SonicWall edge infrastructure this year. Prioritize VPN appliances and perform threat hunting for indicators of compromise (SSRF error patterns, anomalous tunnel establishment). This represents direct perimeter compromise risk.

Read on The Hacker News

03 —

JFrog Artifactory Authentication Bypass (CVE-2026-82329) Exploited Within Days of Disclosure—Attackers Minting Admin Tokens

🟣 Supply Chain - Active Exploitation

CVE-2026-82329, a CVSS 9.8 authentication bypass in JFrog Artifactory, is being actively exploited to obtain admin-level access to artifact repositories. Exploitation began within days of public disclosure, enabling unauthenticated attackers to compromise the entire software build supply chain.

EDITOR’S NOTE
URGENT: Patch JFrog Artifactory immediately if you use it for artifact management or container registry. Assume compromise if unpatched—rotate all repository credentials, audit artifact deployment logs for suspicious packages, and implement mandatory code review/signing for all deployments. This is supply chain attack at the build layer.

Read on The Hacker News

04 —

Frontier AI Models Demonstrate Autonomous End-to-End Security Compromises—6 Months to Defend

🟣 AI/Threat Research

Frontier AI models have proven capable of conducting fully autonomous security compromises from reconnaissance to data exfiltration, with a compressed attack timeline compressing two-week attacks into 10 hours. Organizations have approximately six months to implement defensive measures before this becomes a widespread threat.

EDITOR’S NOTE
STRATEGIC: This is not theoretical—autonomous AI-driven attacks fundamentally break traditional 2-week incident response windows. Immediate actions: (1) Deploy real-time behavioral analytics for anomalous system access; (2) Implement network segmentation to contain lateral movement; (3) Test 4-hour detection/response playbooks; (4) Prioritize automated response mechanisms. Your current SOC assumptions are obsolete.

Read on Dark Reading

05 —

Critical Cisco Nexus 9000 Zero-Day (CVE-2026-20212)—Unauthenticated RCE as Root, No Workaround Available

🔴 Critical - Active Exploitation

Cisco released patches for a CVSS 9.8 zero-authentication remote code execution vulnerability in Nexus 9000 switches with no available workaround. IOS XR patches include 7 umbrella CVEs, two rated 9.8 with existing mitigations unavailable.

EDITOR’S NOTE
CRITICAL: Prioritize patching Nexus 9000 infrastructure—root-level network device compromise enables lateral movement to all downstream systems. If patching cannot be completed within 72 hours, isolate affected switches behind air-gapped management networks and implement egress filtering. Network infrastructure is the skeleton key to enterprise compromise.

Read on The Hacker News

Also worth reading —

FBI Investigating Service Selling 153M+ Drivers Licenses Sourced from Louisiana Identity Verification Company — Audit third-party identity verification vendors immediately—this exposes organizations to insider threat and credential compromise risk across customer identity ecosystems.

Unpatched Magento and Adobe Commerce Zero-Day (StyleSmuggler) Actively Backdooring Online Stores—No Patch Available — If running Magento/Adobe Commerce, implement WAF rules blocking malicious style injection and audit all deployed code for backdoors—zero-day with no patch = defense-in-depth urgency.

Breeze Comet: Brazilian Threat Group Compromises Global Financial Systems with Direct Fund Theft Capability — Financial institutions face elevated account compromise risk—enhance monitoring for lateral movement indicators and implement transaction anomaly detection on compromised accounts.

Philippines Nuclear Agency Breached via Unpatched ownCloud Vulnerabilities—Reactor Databases and Credentials Exfiltrated — Critical infrastructure compromise via commodity flaws is now classified—audit all legacy infrastructure for unpatched CVEs and implement automated patch compliance scanning before attackers do.

Share this issue