nGuard

Call us p. 704.583.4088
Client PortalSpeak to an Expert

vulnerability management

TWiC: Citrix NetScaler Zero-Day, 500,000 Exposed GitHub Credentials, & Azure DevOps Pipeline Hijacking

This Week in Cybersecurity (TWiC) Security Advisory

Zero-Days, Exposed Credentials, & Hijacked Cloud Pipelines

Attackers continue to exploit the connections between internet-facing infrastructure, developer credentials, and trusted cloud platforms—turning a single weakness or compromised identity into a path toward broader organizational access.

2 Critical Citrix NetScaler
zero-days actively exploited
543,699 Unique active credentials
found exposed on GitHub
7 Kubernetes configuration files
stolen by Storm-3068

This week, threat actors demonstrated how trusted infrastructure can become an attacker’s foothold. Citrix NetScaler zero-days were exploited to deploy web shells and tunnel into internal networks. Researchers found more than 543,000 active credentials exposed across public GitHub repositories. Meanwhile, Microsoft detailed how Storm-3068 compromised a legitimate account and used Azure DevOps pipelines to steal Kubernetes credentials. Together, the incidents highlight the importance of securing not only individual systems, but also the relationships between identities, applications, infrastructure, and development environments.

Threat Status First Move
Status Actively Exploited
First move Patch affected appliances and investigate for web shells, unauthorized changes, persistence, and unusual network activity.
Status 543K+ Active
First move Revoke and rotate exposed credentials, then audit repositories, CI/CD pipelines, and development environments for additional secrets.
Status Cloud Credential Theft
First move Review password-reset activity, authentication methods, pipeline permissions, service connections, and Kubernetes access.
■Internet-Facing Infrastructure
Actively Exploited

Citrix NetScaler Zero-Days Used to Plant Web Shells and Tunnel Into Networks

CVE-2026-88771  /  Critical   ·   CVE-2026-88772  /  Critical   ·   Citrix NetScaler ADC & Gateway

Threat actors have been actively exploiting two critical zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances, tracked as CVE-2026-88771 and CVE-2026-88772. The attacks, which began as early as September 2026, have affected organizations across North America and Europe, including government, financial services, education, and professional services.

Citrix confirmed that both vulnerabilities were exploited before patches became available. CVE-2026-88771 allows unauthenticated remote code execution, while CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or denial of service when Datagram Transport Layer Security (DTLS) is enabled.

NetScaler appliances are particularly attractive targets because they frequently sit at the network perimeter while lacking many of the endpoint detection capabilities found on traditional servers and workstations.

Attackers leveraged the vulnerabilities to gain root-level access, deploy custom PHP web shells, and establish persistent access to compromised appliances. Researchers identified two previously undocumented malware families, WHIPSHOT and SLAPSHOT, which were used to facilitate remote access and tunneling into internal networks.

These tools allowed attackers to conduct reconnaissance, steal credentials, and potentially move deeper into organizational infrastructure.

Insights & Recommendations

  • Patch immediately. Apply the latest Citrix security updates to all affected NetScaler ADC and Gateway appliances. Patching alone is not sufficient if attackers have already established persistence.
  • Investigate for persistence. Review appliances for suspicious PHP web shells, unauthorized web server configuration changes, unexpected system permission modifications, unusual processes, and abnormal network connections.
  • Restrict administrative access. Limit management interfaces to trusted sources and restrict administrative access to NetScaler appliances wherever operationally feasible.
  • Evaluate DTLS exposure. Where operationally feasible, disable Datagram Transport Layer Security as a temporary mitigation for CVE-2026-88772, recognizing that this does not protect against CVE-2026-88771.

How nGuard Helps

  • Continuous Vulnerability Management helps organizations identify exposed infrastructure, prioritize critical vulnerabilities, and track remediation before attackers can exploit unpatched systems.
  • External Penetration Testing evaluates internet-facing infrastructure and identifies potential attack paths that could allow threat actors to gain unauthorized access.
  • If an appliance is suspected of compromise, Cybersecurity Incident Response helps organizations investigate malicious activity, identify persistence, contain the threat, and support recovery.
■Credential Exposure
543K+ Active Credentials

More Than 543,000 Active Credentials Left Exposed on GitHub

543,699 unique active credentials  /  224M+ public repositories scanned   ·   1.1M+ individual exposures

Security researchers discovered more than 543,000 active credentials exposed in public GitHub repositories, highlighting the continued risks associated with accidentally publishing sensitive information.

Researchers scanned more than 224 million public repositories and identified 543,699 unique credentials that were still active when tested in July 2026. Those credentials appeared in more than 1.1 million individual exposures across files and repositories, including copies contained in repository forks.

The scale of the exposure

543,699 Unique active credentials
1.1M+ Individual exposures
224M+ Public repositories scanned
~17% Published after push protection was enabled

Some credentials had remained exposed for years, including an AWS key originally committed in 2009. Removing a secret from a repository does not automatically invalidate the underlying credential.

Nearly 200,000 of the active credentials were published after GitHub enabled default push protection, a security feature intended to prevent developers from accidentally committing secrets.

The exposed information included Google Cloud service account credentials, MongoDB connection strings, and Google API keys. Although GitHub provides secret-scanning alerts and notifies credential providers about exposed secrets, credentials are not automatically revoked in every case.

As a result, organizations may continue to face exposure even when security scanning and preventative controls are already in place.

Insights & Recommendations

  • Enable secret scanning and push protection. Apply these controls across all applicable GitHub repositories to identify exposed credentials and block new secrets from being committed.
  • Revoke and rotate exposed credentials. Immediately invalidate exposed API keys, cloud service account credentials, database connection strings, and other secrets.
  • Audit development environments. Regularly review repositories, development environments, and CI/CD pipelines for hardcoded credentials and other sensitive information.
  • Apply least privilege. Limit service accounts and API keys to only the permissions and resources necessary for their intended functions.

How nGuard Helps

■Cloud & Development Security
Cloud Credential Theft

How One Hijacked Account Gave Storm-3068 a Path to Kubernetes

Attack vector  /  Compromised user account   ·   Platform  /  Azure DevOps   ·   Target  /  Kubernetes credentials

Microsoft recently detailed an intrusion involving Storm-3068, a threat actor that compromised a user account and leveraged Azure DevOps to steal Kubernetes credentials.

The attack began with the abuse of a self-service password reset process, allowing the threat actor to take control of a legitimate account. After gaining access, the attackers registered their own authentication methods, established persistent access, and began enumerating repositories, projects, pipelines, and deployment environments within Azure DevOps.

From one compromised identity to Kubernetes access

01 / Identity Self-service password reset abused
02 / Persistence New authentication methods registered
03 / Discovery Azure DevOps projects and pipelines enumerated
04 / Pipeline Malicious pipeline created to collect configuration files
05 / Cloud Kubernetes credentials stolen from seven configuration files

The attackers subsequently created a malicious pipeline designed to collect Kubernetes configuration files, which contain sensitive cluster connection and authentication information. The malicious pipeline was authorized to access more than 50 resources and services.

The threat actor also modified pipeline scripts to install the Atera remote management agent and Chisel tunneling utility, creating additional methods for remote access and communication with compromised environments.

The incident demonstrates how a single compromised account can provide access to development platforms, cloud infrastructure, and potentially critical production environments.

Insights & Recommendations

  • Monitor account recovery activity. Watch self-service password reset activity for unexpected authentication method registrations, repeated reset attempts, and unusual account behavior.
  • Strengthen authentication. Require phishing-resistant multifactor authentication for privileged accounts wherever possible.
  • Restrict pipeline permissions. Enforce least-privilege access across Azure DevOps, cloud infrastructure, and development environments. Limit who can create, modify, or execute pipelines.
  • Protect critical branches and deployments. Implement branch protection policies and require approvals for changes to critical repositories and deployment pipelines.
  • Review service connections. Regularly evaluate service connections, pipeline permissions, and stored credentials to ensure compromised accounts cannot access unnecessary resources or production environments.

How nGuard Helps

  • Configuration Assessments identify weaknesses in cloud configurations, identity management, and access controls that could allow attackers to move from compromised accounts into critical infrastructure.
  • Cybersecurity Incident Response provides the expertise needed to investigate account compromises, identify malicious pipeline activity, contain threats, and recover affected environments.

Wrap

Whether exploiting internet-facing infrastructure, exposing sensitive credentials, or hijacking trusted development pipelines, this week’s incidents demonstrate how attackers continue to target the connections between an organization’s systems.

A single vulnerability or compromised account can provide an entry point into critical infrastructure, sensitive data, and cloud environments. Organizations must prioritize vulnerability remediation, enforce strong identity and access controls, and regularly assess the security of their development and production environments to reduce the risk of widespread compromise.

Know where your attack paths lead? nGuard helps organizations identify exposed infrastructure, weaknesses in applications and APIs, credential risks, and gaps in incident readiness.

Talk to nGuard

TWiC: Cisco ISE Emergency Patch, Microsoft’s Record 974 Flaws, & Boston Scientific Disruption

This Week in Cybersecurity (TWiC) Security Advisory

Cisco ISE Emergency Patch, Microsoft’s Record 974 Flaws, & Boston Scientific Disruption

This Week in Cybersecurity (TWiC), infrastructure and supply chains faced relentless pressure from high-severity disclosures and real-world operational halts.

10.0 CVSS on a Cisco ISE zero-day
granting unauthenticated root
974 Microsoft vulnerabilities
patched in a single cycle
3 days CISA remediation deadline
for federal agencies

Cisco issued emergency updates for a maximum-severity zero-day in its Identity Services Engine (ISE) that grants unauthenticated root access and is actively exploited in the wild. Microsoft set a new record by patching 974 vulnerabilities in a single cycle, including two exploited privilege escalation zero-days and 20 wormable bugs. Meanwhile, medical technology leader Boston Scientific suffered a cyberattack that caused a global operational network outage, crippling order processing, manufacturing, and shipping workflows.

Threat Status First move
StatusActively Exploited
First movePatch, restrict management access with iACLs, and re-image any node showing signs of compromise.
Status2 Exploited Zero-Days
First moveDeploy fixes for CVE-2026-85880 and CVE-2026-81963 first, then external-facing servers.
StatusMulti-Week Recovery
First moveConfirm corporate IT cannot take down manufacturing, fulfillment, and distribution networks.
■Identity Infrastructure
Actively Exploited

Cisco ISE Zero-Day

CVE-2026-76460  /  CVSS 10.0  /  ISE and ISE-PIC   ·   CISA KEV  /  3-day federal deadline

Cisco released emergency patches for CVE-2026-76460, a 10.0 CVSS zero-day in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that is actively exploited and grants unauthenticated root access. The flaw stems from insufficient authentication controls on an API endpoint, enabling unauthenticated remote attackers to bypass the web management interface via crafted requests. Active exploitation prompted CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog with a tight three-day remediation deadline for federal agencies.

Because successful exploitation gains root privileges on the device, threat actors can alter or delete telemetry to cover their tracks.

Cisco warned that administrators looking solely at local logs like access.log or running checks on ise-kong/access.log for suspicious entries may find cleared trails.

Beyond this zero-day, Cisco released fixes for 77 total CVEs, including 21 critical flaws across ISE and 28 across its Secure Firewall suite.

Insights & Recommendations

  • Validate local logs for anomalies, but rely heavily on upstream network and firewall logs to detect unexpected egress traffic or file transfers.
  • Implement infrastructure Access Control Lists (iACLs) immediately to restrict management plane access to trusted sources only.
  • Given the root level access granted, removing persistence requires re-imaging affected nodes and restoring from clean, verified configuration backups.

How nGuard Helps

■Patch Cycle
2 Exploited Zero-Days

Microsoft Patches Record 974 Flaws, Including Two Exploited Zero-Days

CVE-2026-85880  /  CVSS 7.8  /  ALPC heap overflow   ·   CVE-2026-81963  /  CVSS 7.8  /  Update Stack

Microsoft delivered its largest security update on record, patching 974 vulnerabilities across Windows, Office, SQL Server, and enterprise platforms. The increase in disclosures reflects the growing use of automated and AI-assisted vulnerability discovery tools, pushing 2026 totals past 2,700 resolved bugs. Among the disclosures are over 110 Critical-rated bugs and 20 wormable remote code execution flaws.

The update resolves two actively exploited privilege escalation zero-days rated CVSS 7.8. CVE-2026-85880 is a heap buffer overflow in Windows Advanced Local Procedure Call (ALPC) that allows attackers executing code in a low-privilege AppContainer sandbox to break out and obtain SYSTEM access. CVE-2026-81963 is an improper link resolution defect in the Windows Update Stack, also allowing local elevation to SYSTEM. Both vulnerabilities have been added to CISA’s KEV catalog.

Insights & Recommendations

  • Do not treat all 974 CVEs equally. Focus immediate deployment efforts on the two active zero-days (CVE-2026-85880 and CVE-2026-81963) and external-facing infrastructure like Exchange Server, Remote Desktop Services, and SQL Server.
  • Massive disclosure cycles are creating administrative fatigue. Focus on contextual exploitability, asset exposure, and system criticality rather than chasing raw numbers.

How nGuard Helps

■Operations & Supply Chain
Global Disruption

Cyberattack Causes Global Operational Disruption at Boston Scientific

Disclosed via  /  SEC filing   ·   Impact  /  Core IT systems and business applications

Medical device giant Boston Scientific suffered a cyberattack that forced a network outage and caused global disruptions to its operations. Disclosed in SEC filings, the incident impacted core IT systems and business applications, disabling the company’s ability to process and ship customer orders, as well as halting sterilization and manufacturing workflows in facilities across the globe.

Halted

  • Customer order processing
  • Order shipping
  • Sterilization workflows
  • Manufacturing workflows

Backlogged

  • New device activations
  • Global supply lines

Kept Running

  • Remote patient monitoring devices
  • Patient data transmission

The attack shows the operational consequences when corporate IT breaches ripple into manufacturing, distribution, and logistics supply chains. While remote patient monitoring devices remained operational and data transmission continued safely, new device activations and global supply lines faced significant backlogs. Boston Scientific activated incident response protocols with third-party experts to contain the threat, isolate networks, and rebuild systems over a multi-week recovery effort.

Insights & Recommendations

  • Isolate administrative IT networks from distribution, fulfillment, and manufacturing networks to prevent a corporate domain compromise from shutting down core operations.
  • Ensure operational continuity by regularly backing up critical operational databases offline and testing manual order, inventory, and fulfillment procedures.

How nGuard Helps

Wrap

Whether dealing with zero-days in identity management engines, sorting through hundreds of monthly software patches, or managing global operational outages, modern cyber threats target core infrastructure and supply chain dependencies. Organizations must move beyond static patching assumptions by validating network segmentation, prioritizing risk-based remediation, and regularly exercising emergency incident response plans.

Not sure what you have exposed?nGuard validates it rather than assuming it, through penetration testing, configuration audits, and continuous vulnerability management.

Talk to nGuard

TWiC: Copying Claude, Compromising Copilot, & Microsoft’s Patch Apocalypse

This week in cybersecurity, AI is playing both sides of the field. Anthropic accused Alibaba of running an industrial-scale campaign to clone Claude’s capabilities via tens of millions of fraudulent API interactions. Meanwhile, a critical exploit chain was released that weaponizes Microsoft 365 Copilot into a silent data exfiltration tool with a single link click. Compounding these threats, Microsoft’s June Patch Tuesday shattered records with nearly 200 vulnerabilities, a massive volume driven by AI-accelerated bug discovery that is rapidly outpacing traditional defenses. Together, these incidents share a common thread: the enterprise tools organizations rely on most are becoming their most exploitable attack surface.

Anthropic vs. Alibaba: Industrial-Scale Model Cloning

Recent allegations from Anthropic reveal a massive, highly coordinated model distillation campaign targeting their frontier AI, Claude. In a detailed letter to the Senate Banking Committee, Anthropic disclosed that operators linked to Alibaba’s Qwen lab utilized approximately 25,000 fraudulent accounts to execute 28.8 million targeted interactions with Claude between April 22 and June 5.

The campaign focused precisely on high-value capabilities: advanced software engineering and multi-step agentic reasoning. Rather than a traditional data breach, this operation highlights the growing trend of unauthorized model distillation, using a leading AI’s outputs at scale to train a competitor’s model cheaply.

Insights & Recommendations

  • Treat APIs as Untrusted Boundaries: As LLM integration grows, API endpoints must be strictly monitored and tested for the high-volume, repetitive structures characteristic of extraction campaigns.
  • Proactive Security Architecture: Implement rigid rate-limiting, anomalous behavior detection, and advanced identity verification on all exposed corporate LLM frameworks.
  • Safeguard Public-Facing Entry Points and Applications: API Penetration Testing can uncover visibility gaps and unauthorized automation capabilities before they can be exploited.

SearchLeak: Turning Microsoft 365 Copilot into an Exfiltration Tool

Varonis Threat Labs has exposed a critical vulnerability chain in Microsoft 365 Copilot Enterprise named “SearchLeak” (tracked under CVE-2026-42824 with a max severity rating of Critical). The attack turns corporate AI assistance into a silent data exfiltration weapon via a single malicious link click.

SearchLeak combines an AI-native Parameter-to-Prompt (P2P) injection with an HTML rendering race condition and a Server-Side Request Forgery (SSRF) bypass through Bing. When a victim clicks a crafted microsoft.com link, the q parameter forces Copilot to search internal data (emails, MFA codes, OneDrive, and SharePoint files) and embed it into an image URL. During the streaming phase, the browser renders the image before output sanitization blocks it, using an allowlisted Bing endpoint to proxy the stolen text directly to an attacker-controlled server.

The Risk

Because Copilot Enterprise operates inside the corporate tenant with the user’s full graph permissions, a successful exploit inherits access to sensitive organizational files, metadata, and authentication bypass tokens without triggering standard security filters.

Insights & Recommendations

  • Enforce Strict Privilege Boundaries: Minimize user access permissions within the corporate environment to shrink the potential data blast radius of an enterprise assistant compromise.
  • Audit Allowlists and Output Handling: Ensure that any allowlisted system domain executing server-side fetches is monitored, and treat streaming AI outputs as entirely untrusted until final client-side rendering occurs.
  • Assess Your Internal Environment: Evaluate Active Directory permissions hierarchy, and post-compromise lateral movement risks with Internal Penetration Testing.

Microsoft’s AI-Driven “Patch Apocalypse”

Microsoft shattered all historical data records with its June 2026 Patch Tuesday release, pushing out updates for roughly 200 vulnerabilities across Windows operating systems and supported software. The release includes 32 critical CVEs and three publicly disclosed zero-days. When combined with concurrent updates from Google Chrome, Adobe, and Mozilla, security professionals are dealing with close to 600 total resolved flaws this month alone.

This dramatic escalation reflects a major shift in the threat landscape: both software vendors and security researchers are aggressively utilizing advanced artificial intelligence tools to surface software bugs at an unprecedented scale.

The Zero-Days to Prioritize

  1. CVE-2026-45586 (Windows Collaborative Translation Framework): An Elevation of Privilege (EoP) vulnerability caused by improper link resolution. It allows local, authenticated users to easily escalate standard access into full SYSTEM-level endpoint control.
  2. CVE-2026-49160 (HTTP.sys): A network-accessible Denial of Service (DoS) vulnerability stemming from uncontrolled resource consumption. It requires zero authentication and can immediately disrupt critical web services and business APIs.
  3. CVE-2026-50507 (Windows BitLocker): A security feature bypass that permits unauthorized individuals with physical access to a device to view encrypted data without inputting credentials.

Insights & Recommendations

  • Accelerate Patch Timelines: With the window from vendor disclosure to active exploitation compressed to mere days, testing and deployment pipelines must be continuous. Focus deployments immediately on network-accessible, unauthenticated flaws like HTTP.sys.
  • Secure Remote Assets: Address physical device exposure, particularly for remote and hybrid personnel, by enforcing immediate updates to BitLocker and local endpoint authentication controls.
  • Continuous Vulnerability Scanning: Move away from reactive, fragmented scanning routines and transition to continuous, verified threat visibility with continuous Vulnerability Management.

Why This Matters

The intersection of these incidents points to a structural shift in the enterprise attack surface:

  • Abstraction is the New Target: Attackers are exploiting trust boundaries by manipulating the tools meant to simplify operations, whether by copying proprietary logic via public APIs or turning enterprise assistants into automated data harvesters.
  • AI-Native Vulnerabilities Bridge Classic Exploits: Flaws like SearchLeak demonstrate that AI applications do not always require entirely novel exploit techniques; instead, they provide unique, unmonitored vectors to reach classic web infrastructure weaknesses that have existed for decades.
  • Defensive Timelines Must Automate: The overwhelming volume of monthly vulnerabilities proves that manual patch cycles and periodic compliance checks are no longer sustainable against AI-accelerated flaw discovery.

Wrap

The takeaway from this week’s developments is definitive: Traditional security boundaries are fundamentally dissolving. As enterprise workflows absorb large language models and software complexity reaches a tipping point, security teams cannot rely on the assumed trust of internal platforms or external perimeters. Posture management must shift to a continuous model grounded in stringent privilege isolation, thorough identity verification, and rapid vulnerability mitigation.

Mythos Update: The Government Pulled Claude Fable 5 After Three Days

When we first covered Claude Mythos and Project Glasswing in April, the story was that Anthropic considered the model so dangerous it refused to release it publicly, restricting it to a small group of vetted partners. That changed on June 9, when Anthropic launched Claude Fable 5, a public, Mythos-class model. Three days later, on the evening of June 12, the U.S. government pulled it.

In what appears to be the first application of export controls to a large language model, the Commerce Department ordered Anthropic to cut off all access to Fable 5 and its unrestricted sibling Mythos 5 for any foreign national anywhere, including Anthropic’s own foreign-national staff. With no way to verify nationality on every request, Anthropic disabled both models globally, for everyone. The episode is messy and unresolved, but for defenders it carries two clear lessons: a new risk to plan for, and a hard confirmation of what we have been flagging all along.

What Actually Happened

The directive arrived at 5:21 p.m. ET on June 12, sent to CEO Dario Amodei and signed by Commerce Secretary Howard Lutnick. It cited national security authorities but, per Anthropic, included no technical detail. The trigger was a jailbreak. According to the Wall Street Journal, Fortune, and TechCrunch, Amazon’s own security researchers found a technique that bypassed Fable 5’s guardrails, the controls meant to separate the consumer model from the Mythos cyber capabilities underneath, and Amazon CEO Andy Jassy flagged it to Treasury Secretary Scott Bessent around June 11. Separately, the red-teamer known as Pliny the Liberatorv had publicly bypassed the same guardrails and extracted working instructions for software exploits and chemical synthesis.

From there, accounts diverge. White House AI advisor David Sacks said a trusted partner found the jailbreak in testing and the administration asked Anthropic to fix it or pull the model, and Anthropic declined, leaving “the ball in Anthropic’s court” for restoration. Anthropic counters that the evidence was only a narrow, verbal jailbreak amounting to asking the model to read a codebase and fix its flaws, that the bugs were already findable by other public models, and that pulling a product used by hundreds of millions over one narrow bypass would halt frontier deployment entirely. Reporting from Semafor adds a wrinkle: the administration reportedly also acted on suspicion that a China-linked group had accessed Mythos, raising the risk of it being reverse-engineered or distilled.

Critically, every other Anthropic model, including Opus 4.8, remained online and unaffected. As of June 23, Fable 5 and Mythos 5 remain suspended and the API string for Fable 5 still returns errors, though Anthropic is in active talks with the Commerce Department and has said it expects access to return within days.

Lesson One: Model Dependency Is Now a Business Risk

Here is what matters most if you have built AI into your operations. Any organization that wired Fable 5 into a product or workflow watched it vanish overnight, for reasons that had nothing to do with them. Not an outage, not a bug, a government fight and a jailbreak the customer could neither see coming nor do anything about.

This is not the first time. When the Defense Department labeled Anthropic a “supply chain risk” earlier this year, contractors lost access across defense supply chains effectively overnight. The pattern is the lesson: a frontier AI model your business depends on can disappear with no notice, and concentration on a single provider is now a real continuity risk. Practically, that means not hard-wiring any one model into something you cannot afford to lose, maintaining a tested fallback, and treating your AI providers as the third-party dependencies they are.

This is exactly the kind of exposure that surfaces in a risk assessment and the kind of question a virtual or fractional CISO is there to ask before a disruption forces it. It also belongs in your continuity and incident response planning: if a core tool goes dark on a Friday evening, your team should already know the play.

Lesson Two: The Security Reality Did Not Change

Pulling one public model does not un-invent the capability behind it. Project Glasswing’s roughly 200 partner organizations still have access to Claude Mythos Preview, the model the directive did not name, and the Financial Times reports Mythos is being used by the NSA for offensive operations. The jailbreak itself proved the offensive capability can be pried out of a model marketed as safe, and the genie is not going back in the bottle because one public interface went dark.

The underlying constraint is also unchanged, and it is the most useful thing to take from this saga. By Anthropic’s own Project Glasswing update, partners have used Mythos to surface more than 10,000 high- or critical-severity vulnerabilities, and the company states plainly that progress is no longer limited by how fast bugs can be found, but by how fast they can be verified, disclosed, and patched. The evidence outside Glasswing agrees: an autonomous agent recently found 21 zero-days in FFmpeg for about $1,000. Discovery is cheap and abundant. Remediation is the bottleneck.

That gap is the whole game, and it is where a risk-based vulnerability management program and penetration testing that validates what is genuinely exploitable do their work. Regulators have reached the same conclusion. On June 10, CISA issued Binding Operational Directive 26-04, which requires a three-day fix for any flaw that is internet-exposed, fully automatable, capable of full takeover, and actively exploited. The directive exists because AI is shrinking the window from discovery to weaponization, and because, per Verizon’s 2026 Data Breach Investigations Report, only 26% of known exploited vulnerabilities were fully remediated last year. The defensive playbook is being rewritten around remediation speed, whether or not any single AI model is online this week.

The Bigger Picture: This Goes Well Beyond One Vendor

It is worth stepping back, because the Fable 5 fight can make this read like an Anthropic story. It is not. The same capability is showing up across models and vendors, and it was reshaping security work well before this month. Mozilla is the clearest case. With Anthropic’s publicly available Opus 4.6, the Firefox team found and fixed 22 bugs in two weeks, 14 high-severity, before the stronger model even arrived. A run with an early version of Mythos then surfaced 271 vulnerabilities in one pass, 180 high-severity, all shipped in Firefox 150, on one of the best-tested open-source codebases anywhere. And the FFmpeg zero-days above came from a different agent entirely. The firehose is real, reproducible, and not the property of any one company.

AI cuts the other way too. The same cheap generation that finds real flaws also produces a flood of plausible junk. In January, the curl project shut down its six-year bug-bounty program after AI-generated “slop” reports buried its small team in unverifiable noise. Organizations are shifting posture in response: in May, NHS England moved its public code repositories private by default, citing the risk that frontier models could ingest and reason over exposed code at scale. The shift hits both sides of the ledger at once, regardless of which model is in the headlines this week.

Takeaways

The first public Mythos-class model lasted three days before the government forced it offline, but the capability behind it is still running for governments and corporate partners, still reproducible with cheaper tools, and still advancing. Two things follow for the organizations we work with: treat access to any frontier model as a dependency that can vanish overnight and plan for it, and keep acting on the fundamentals, because discovery is now commoditized and remediation is the constraint. The model went dark on a Friday. The bugs, and the need to fix them faster than ever, did not.

TWiC: Alarming Zero-Days: Microsoft, Adobe & OT Security

Recent zero-day activity across enterprise software and critical infrastructure spotlights a clear trend: attackers are moving faster than traditional defenses can respond. From actively exploited Microsoft Defender vulnerabilities to long-running Adobe Reader exploitation and renewed guidance on Zero Trust in operational technology (OT) from CISA, organizations continue to face a widening gap between exposure and mitigation.

These incidents reinforce a critical reality: modern attackers are chaining privilege escalation, endpoint evasion, and trusted application abuse to gain and maintain access.

Microsoft Defender Zero-Days: Privilege Escalation and Defense Evasion

Security researchers have identified multiple zero-day vulnerabilities in Microsoft Defender actively exploited in the wild, including CVE-2026-33825 (“BlueHammer”).

These flaws allow attackers to:

  • Escalate privileges from low-level access to SYSTEM-level control
  • Extract credential data, including NTLM password hashes
  • Disable or interfere with Defender protections and updates

Notably, attackers have been observed chaining multiple techniques—BlueHammer, RedSun, and UnDefend—to achieve persistence and evade detection.

The exploitation pattern is particularly concerning:

Core Insights & Recommendations: Modern attacks are shrinking timelines as public exploits are enabling attackers to escalate evade defenses, and control faster than organizations can respond.

Adobe Reader Zero-Day: Months of Undetected Exploitation

Adobe recently patched CVE-2026-34621, a zero-day in Acrobat and Reader that had been actively exploited for months before detection.

The vulnerability:

  • Allowed arbitrary code execution
  • Was delivered through malicious PDF files
  • Likely involved multi-stage exploit chains, including potential sandbox escape

Researchers identified that exploitation began as early as November 2025, demonstrating how attackers can operate undetected for extended periods.

This reinforces a key risk area:

  • Trusted file formats (like PDFs) remain a highly effective delivery mechanism
  • Traditional detection tools may fail to identify low-signal, targeted attacks

Core Insights & Recommendations: Trusted file formats remain a reliable attack vector, allowing threat actors to operate quietly and evade detection for extended periods.

  • Monitor Post-Exploitation Behavior: Focus on privilege escalation, credential access, and abnormal system activity
  • Strengthen Threat Detection: Ensure visibility into EDR activity, file execution, and system changes

Zero Trust in Operational Technology: A Necessary Shift

In parallel with these zero-day threats, CISA and U.S. government partners have released new guidance to accelerate Zero Trust (ZT) adoption in operational technology (OT) environments as of April 29.

Key Guidance:

  • Traditional perimeter-based security models are no longer sufficient
  • OT environments must assume compromise is inevitable
  • Security must be enforced through identity, segmentation, and continuous verification

This is especially critical because:

  • OT systems are often difficult to patch
  • Many operate in legacy or uptime-sensitive environments
  • Attackers increasingly target OT for operational disruption, not just data theft

Core Insights & Recommendations: OT security must pivot from prevention to containment. Assuming compromise and limiting impact is now the only sustainable strategy.

  • Test IR Preparedness: Test your team’s procedures by simulating evolving threats, polishing rapid response, and debriefing through lessons learned.
  • Evaluate & Tune Program: Dive deep into your organization’s policy with gap and/or risk assessments, centered on Zero Trust principles and CIS / NIST frameworks to establish a realistic roadmap.

Why This Matters

Across all three cases, a consistent pattern emerges:

  • Privilege escalation is the primary objective
  • Trusted systems and applications are being weaponized
  • Detection is delayed, while exploitation is immediate

These are not isolated incidents, as they represent a broader evolution in attacker approach:

  • Gain initial access (phishing, credentials, or exposed services)
  • Escalate privileges rapidly
  • Disable or evade defenses
  • Maintain persistence using legitimate tools or trusted workflows

Wrap

Recent zero-days make one thing clear: Attackers don’t need sophisticated exploits; they need speed, access, and trust.

Whether it’s Microsoft Defender, Adobe Reader, or OT systems, the common thread is the same:

  • Trusted platforms are being leveraged against organizations
  • Privilege escalation is the gateway to full compromise
  • Delayed detection amplifies impact

Organizations must shift from reactive patching to proactive posture management, where identity, endpoint visibility, and Zero Trust principles form the foundation of defense.

Claude Mythos and Project Glasswing: What Your Security Team Needs to Know

On April 7, Anthropic announced Claude Mythos Preview, an AI model it claims is so effective at autonomously discovering and exploiting software vulnerabilities that the company decided it was too dangerous to release to the public. Access has been restricted to roughly 50 organizations, including Microsoft, Apple, AWS, and CrowdStrike, through a defensive consortium called Project Glasswing.

This isn’t science fiction, and it isn’t just marketing hype. Independent researchers have validated that AI-driven vulnerability discovery is advancing rapidly. For organizations that rely on periodic security assessments and structured patch cycles, understanding how this shift affects your risk profile starts now.

What Claude Mythos Can Actually Do

The numbers are striking. During pre-launch testing, Mythos identified thousands of zero-day vulnerabilities across every major operating system and web browser. Among the publicly disclosed findings:

  • A 27-year-old bug in OpenBSD’s TCP SACK implementation, present since 1998 and missed by decades of code review, enabling remote crash of any OpenBSD host over TCP. Anthropic reports the entire discovery campaign cost under $50 for the successful run.
  • A 16-year-old flaw in FFmpeg’s H.264 codec that had been hit five million times by automated fuzzers without detection.
  • When tested against Firefox 147 JavaScript engine vulnerabilities, Anthropic’s previous flagship model produced working exploits twice out of several hundred attempts. Mythos produced 181 working exploits.
  • CVE-2026-4747, a 17-year-old remote root vulnerability in FreeBSD’s NFS implementation, is the first confirmed CVE directly attributed to Glasswing-assisted discovery.

The UK’s AI Safety Institute independently evaluated Mythos and confirmed it solves 73% of expert-level capture-the-flag challenges. No model before April 2025 solved any. AISI estimates frontier AI cyber capability is now doubling roughly every four months.

Context Matters: Separating Capability from Hype

Before the panic sets in, context matters.

Anthropic’s most dramatic claims carry asterisks that most headlines strip away. The “thousands” of critical findings extrapolate from a 198-report human validation sample with 89% severity agreement. That’s impressive, but incomplete. The Firefox exploitation numbers were achieved against a content-process harness without the browser’s sandbox or other defense-in-depth. And security researcher Bruce Schneier has noted that without knowing Mythos’s false positive rate, it’s impossible to tell whether these showcased results are representative or cherry-picked.

A security startup called Aisle demonstrated that smaller, publicly available AI models can already reproduce much of the vulnerability detection work once the code is scoped. Their conclusion: detection is commoditizing faster than exploitation. Finding bugs and weaponizing bugs remain different tiers of capability, for now.

The honest assessment: Mythos is a real capability step, but it’s an accelerant, not a revolution. The trajectory matters more than the single model. Mythos is restricted today, but similar AI capabilities are expected to become freely available through open-source projects within 12 to 18 months. When that happens, the same class of tooling that Anthropic deemed too dangerous to release will be accessible to anyone, including threat actors.

The Glasswing Gap: Why Your Software Probably Isn’t Covered

This is where the conversation shifts from industry news to something that directly affects mid-market and enterprise organizations that build, run, or depend on their own software and systems.

Project Glasswing’s roughly 50 member organizations are overwhelmingly the vendors of widely used open-source and commercial software, the systems that Mythos was trained on and performs best against. That’s sensible: let the biggest vendors patch first.

But as Schneier wrote in The Globe and Mail, the inverse is also true. Software outside the training distribution, including industrial control systems, medical device firmware, bespoke financial infrastructure, and older embedded systems, is exactly where Mythos is least likely to help defenders. A motivated attacker with domain expertise could still use AI as a force multiplier against these systems. As Schneier and co-author David Lie, a professor of computer science at the University of Toronto, wrote: ‘The danger is not that Mythos fails in those domains; it is that Mythos may succeed for whoever brings the expertise.

For nGuard’s customers, this is the critical takeaway. Project Glasswing covers roughly 50 of the world’s largest software vendors and open-source foundations. If your organization develops, customizes, or depends on any application or system built outside of that circle, Mythos doesn’t change your need for application testing, penetration testing, and ongoing vulnerability management. If anything, it reinforces it. The same AI capabilities being used to find decades-old bugs in major platforms will eventually be available to threat actors probing your environment. The question is whether you’ve found your vulnerabilities before they do.

What Organizations Should Do Now

  1. Compress Your Patch Cadence: Mandiant’s M-Trends 2026 report finds median time-to-exploit has hit negative seven days, meaning exploitation now routinely precedes patch availability. Thirty-day patch SLAs were designed for a different threat landscape. Evaluate whether your vulnerability management program can absorb the pace that AI-accelerated discovery will impose.
  2. Increase Your Penetration Testing Frequency: Annual penetration testing was designed for a threat landscape where vulnerability discovery moved at a human pace. As AI accelerates that timeline, organizations should evaluate whether their current testing cadence still matches their risk profile. For environments with high exposure, such as internet-facing applications, remote access infrastructure, and systems handling regulated data, more frequent testing and ongoing vulnerability management work together to close the gap between discovery and remediation.
  3. Inventory Your Unmapped Assets: The systems most at risk are the ones nobody is scanning, including legacy applications, embedded devices, OT environments, and custom-built platforms that don’t appear in any vendor’s Glasswing coverage. You can’t patch what you don’t know about, and you can’t defend what you haven’t tested.
  4. Assess Your Incident Response Readiness: AI-accelerated exploitation compresses the window between initial access and impact. Run a tabletop exercise that assumes your perimeter has already been breached through a previously unknown vulnerability. Does your team know the playbook?
  5. Strengthen Your Compliance Posture: Regulators are already moving. The UK’s Bank of England is briefing regulated entities on Mythos implications, US Treasury Secretary Bessent convened major bank CEOs on April 7, and AI-driven vulnerability discovery will almost certainly inform upcoming updates to HIPAA, PCI DSS, and CMMC audit expectations.

Takeaways

Claude Mythos Preview confirms what the security community has anticipated for years: AI has crossed the threshold where it can find and exploit vulnerabilities that survived decades of human review. The capability is real, it’s getting cheaper, and it will proliferate. The organizations best positioned to weather this shift will not be the ones waiting for a Glasswing invitation. They’ll be the ones who already know what’s running in their environment, how fast they can patch it, and what happens when a vulnerability is exploited before a patch exists., verify your exposure, and don’t assume yesterday’s triage decisions still hold.

Chat Icon Chat Close

Learn how nGuard can secure your data

Ready to take the next step? Speak to an nGuard expert and get your questions answered today.

Chat Popup

No thanks, maybe later