Help Net Security's weekly roundup highlighted a broad range of threats. A 16-year-old researcher disclosed a flaw in Titan, Microsoft's internal analytics service, that could have allowed access to employee records and Bing search analytics. The service holds 17 trillion rows of data, according to the report.
Zero-day exploits were a recurring theme. Citrix patched eight NetScaler vulnerabilities, two of which had been exploited in the wild to plant webshells; Mandiant said suspected state-sponsored actors were likely behind the initial targeted intrusions. Apple also fixed an actively exploited Core Graphics zero-day, Cisco disclosed a fifth SD-WAN zero-day this year, and Fortinet warned of a FortiMail zero-day.
AI security was another thread. An agentic AI attack exploited two Zammad zero-days to breach the Dutch Institute for Vulnerability Disclosure, while Glow Labs found AI coding agents had leaked internal screenshots to public GitHub repos. On the defensive side, BH Consulting launched a service where AI assists human consultants, and Cloudflare released EmDash 1.0 with sandboxed plugins.