What’s up ?

CyberSecurity News Feeds

1. Companies Have Six Months to Prepare for Automated Attacks

“Our view is there’s going to be some level of parity, at least between the frontier models and the Chinese models over probably a six-month horizon, and so everyone is in a rapid race to evolve these capabilities,” he says, adding that, when facing human attackers, defenders had the advantage, but “in the future, the balance of power shifts to the offense, because the attacker can deliver effects at speed and scale that the traditional defenses can’t keep pace with.”

2. AI is ending the era of hidden vulnerabilities.

“Software vendors used to be able to get away with shipping buggy software with no real accountability for a very long time, but now they can’t really hide anymore, because AI doesn’t sleep and can [find vulnerabilities] at scale,”

3. A call for collective action on cyber defense
4. Limited window to strengthen cyber defenses
5. Critical infrastructure like hospitals, water treatement plants, infra providing internet etc are at huge risk.

Attacks / Cyber Security Incidents

1. Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without authentication.
2. A swarm of Autonomous Agents hijacked a German wiki and communicated over the wiki to share the information with each other, primarily to help them succeed at their task. They asked for answers, pooled results, and shared techniques for bypassing their restrictions. This allowed them to use the work of others to cheat on their task.

Spying Exposed

1. An investigation by Gamers Nexus found LG smart TVs sweep local networks to map phones and nearby devices. Tests also showed the sets can capture microphone audio with the screen off — they then upload data once reconnected to the internet. View here

Trends

1. Big companies hire external Penetration Testing teams and pay a ton of money.

Ideas

• Create and deploy app on github-pages with authentication as Github SSO that people can use.
• Everyday CVEs get published to the internet with dedicated IDs. However their exploit is unavailable. Leverage LLMs to create the exploits by reverse engineering the Patch pushed on the internet … Then exploit the unpatched softwares / tools / tech.
• Recently 12 year old postgreSQL vulnerability got exploited which enables database, server takeover. CVE-2026-6471 . This means vulnerabilities might exist in Legacy tools / tech, it’s just that they are left undiscovered.