Double free vulnerability in Microsoft Internet Key Exchange Service Extensions. Added to CISA KEV August 18, 2026. Observed being exploited by Chinese-speaking threat actor conducting AI-enabled autonomous hacking campaign using DeepSeek alongside manual exploitation. Indicates AI-augmented exploitation campaigns now operational in wild.
Deploy patches immediately. Implement behavioral analytics to detect AI-augmented attack patterns including automated reconnaissance and exploitation sequences. Monitor for DeepSeek or similar AI tool indicators in network traffic. Review IKE service logs for exploitation attempts.
Source: CISA • Published: 2026-08-18
University of Illinois research demonstrates GPT-4 autonomously exploited 87% of disclosed one-day vulnerabilities when provided CVE description versus 0% for GPT-3.5 and open-source LLMs. Real-world attack on May 10, 2026 used LLM agent to exploit CVE-2026-39987, steal credentials from environment, use AWS keys to access Secrets Manager for SSH key, launch 8 parallel SSH sessions, and exfiltrate PostgreSQL database in one hour end-to-end.
Compress patch deployment timelines to within hours of CVE publication to degrade AI exploitation efficacy. Implement behavioral monitoring for autonomous reconnaissance patterns including rapid sequential vulnerability scanning. Deploy deception technologies to detect AI-driven lateral movement. Monitor for parallel session anomalies and credential harvesting patterns indicative of LLM-driven attacks.
Source: GTIG • Published: 2026-05-10
Phoenix Security corpus covering June 2024-June 2026 shows dramatic acceleration: full year 2025 produced 14 campaigns and 111 malicious packages while first half 2026 alone produced 37 campaigns and 497 packages—2.6x campaign count and 4.5x package volume. Indicates AI-accelerated supply chain attack production.
Implement automated scanning for malicious packages in npm, PyPI, and VSCode extension registries using tools like Socket, Phylum, or Checkmarx Supply Chain Security. Deploy Software Bill of Materials (SBOM) generation and verification for all dependencies. Monitor for typosquatted AI library names. Implement dependency pinning and hash verification. Review CI/CD pipelines for dependency confusion vulnerabilities.
Source: GTIG • Published: 2026-06-30
Black Kite tracked 7,551 publicly disclosed ransomware victims April 2025-March 2026, 24.9% increase over prior period marking fourth consecutive annual record. Growth accelerated 60% in second half with March 2026 hitting 861 victims (highest single month recorded). Active threat actor groups grew to 127 by period close and 146 by June 2026. The Gentlemen group expanded from 35 victims Q4 2025 to 182 Q1 2026, becoming second most active group.
Prioritize offline backup verification with regular restore testing. Deploy ransomware-specific detection for The Gentlemen, Qilin, and Akira groups using YARA rules and behavioral analytics. Review third-party risk assessment processes for supply chain ransomware exposure. Implement network segmentation to contain lateral movement. Deploy endpoint detection with ransomware-specific behavioral rules.
Source: BleepingComputer • Published: 2026-03-31
CVE-2026-33824: Double free vulnerability in Microsoft Internet Key Exchange Service Extensions. Added to CISA KEV August 18, 2026. Observed being exploited by Chinese-speaking threat actor conducting AI-enabled autonomous hacking campaign using DeepSeek alongside manual exploitation. Indicates AI-augmented exploitation campaigns now operational in wild.