- Vulnerable U
- Posts
- 🎓️ Vulnerable U | #178
🎓️ Vulnerable U | #178
AI escaped the lab, Jim Cramer calls Chinese models a huge risk, and an absolute ton of vulns in active exploitation you need to know about
Matt Johansen
July 24, 2026
Read Time: 9 minutes
Brought to you by:
Howdy friends!
Who all am I going to see out at BlackHat and Defcon? Calendar is already looking like a jenga game. I’ll be bringing my good walking shoes. We’re going to be recording a live podcast out at Defcon so follow me on Twitter to see me shout where we post up.
Speaking of the podcast, have you all checked it out? I’m excited with how its been turning out. We’ve got some really exciting interviews scheduled too. Give it a follow and rating in your favorite podcast app and YouTube for the full handsome devil video experience if our faces are important to you. (Apple, Spotify)
ICYMI
🖊️ Something I wrote: I checked out this open source tool that helps with prompt injection - worth a look.
🎧️ Something I heard: This Wired investigation into hacking after market car add-ons
🎤 Something I said: Interviewed HD Moore, creator of Metasploit and founder of runZero about how hacking is like the 90s again.
🔖 Something I read: I read the dungeon crawler carl series two times through at this point and it has been a gateway drug into LitRPG as a genre. I’m almost done with the Primal Hunter series now and it’s been great.
Vulnerable News
The headlines made it sound like an AI escaped containment and hacked Hugging Face. That's technically true, but the more interesting story is how it happened.
OpenAI confirmed that one of its unreleased cyber models - 5.6 Sol and an even more capable pre-release version with cyber guardrails relaxed for testing - was being evaluated against Exploit Gym, a benchmark designed to test advanced offensive security capabilities.
Instead of solving the benchmark directly, the agent reasoned that the answers might exist somewhere else. It discovered a previously unknown vulnerability in a package registry proxy, escalated privileges inside OpenAI's research environment, moved laterally through the network, gained internet access, and ultimately reached Hugging Face's infrastructure looking for benchmark data. /goal really took the “goal” part seriously this time, eh?
The ironic part here was that the guardrails designed to make commercial AI safer got in the way of incident response. Hugging Face ultimately had to switch to an open-weight model, GLM 5.2, running on its own infrastructure to complete the forensic investigation. The frontier models did the hacking but refused to help with the cleanup due to safety restrictions.
Niels Provos had one of the best takes on this whole incident. His point wasn't that we should be terrified because the AI was "super intelligent." His point was that this looked like a failure of basic security engineering. If your sandbox has proper egress controls, deny-by-default networking, and genuine isolation, the model shouldn't be able to wander onto the public internet regardless of how clever it gets or how many zero-days it discovers. The incident suggests the testing environment wasn't nearly as isolated as they stated. Sandboxing isn't something you accomplish in a Guardrails.md file. There need to be technological control layers that can’t be subverted. (read more here, here, here and here)
Databricks had a standing access problem at scale. With 8,000+ employees across 30+ offices, their identity team ran quarterly access reviews using brittle Python scripts that crashed mid-run.
Today: 86,000 time-bound access requests handled, 141 automated UARs covering 140,600 access decisions, and a 97% reduction in median approval time. Engineers get production access in minutes instead of hours. Auditors automatically receive compliance reports. Now with Agentic AI, Databricks can handle campaigns at scale.
*Sponsored
WTF is going on at LG? You’re paying top dollar for highest tier of electronics and getting bottom of the barrel no name Android devices of Temu experience in their software. TWO different major stories this week for them - 1) apparently 42% of apps in their smart TV appstore include an SDK that turns your device into a residential proxy node for rent. Threat actors and fraudsters rely on these proxies to make their traffic appear legitimate and not originating from data centers.
At the same time Gamers Nexus on YouTube put together a scathing video showcasing how their top tier $1200 computer monitors are installing adware and all sorts of other shady data collection crap. You plug the monitor in and it pushes McAfee bloatware and even easily missed opt-ins for premium subscriptions to the Anti Virus software. Again, this feels like things you’d expect from bottom of the barrel no name devices, not LG. Imagine Apple charged what they did and then had adware and other shady pop ups on their devices? Thats what this feels like to me. (read more here and watch more here)
I interviewed Daniel Miessler this week (video to come) because he's one of the few people I know who's willing to wrestle with AI's future without falling into the usual hype or doom camps. We disagree on plenty, which makes for a much better conversation.
The jumping-off point was a long X thread from Dean Ball, OpenAI's Head of Strategic Futures, arguing that China's latest open-weight AI models represent a growing strategic risk. By the time Jim Cramer jumped into the conversation, I knew this debate had escaped the echo chamber. Once that happens, nuance usually disappears. Suddenly the conversation isn't about deployment models, infrastructure, or data residency anymore. It's just "China bad."
One of the biggest topics was Kimi K3. It came out last week, and it's about on par with the best Western frontier models. Not quite at Fable's level, but with the right harness it's pretty darn close. At the same time, people hear "open weight" and assume anyone can run it on a laptop. That's not how this works. You still need serious infrastructure. The weights being open doesn't magically put frontier AI in everyone's hands overnight. That's why I think so much of the panic around these models is misplaced. People are arguing about capabilities without understanding how they're actually deployed.
Ball suggested China may be acting out of "strategic blindness." I just don't buy that. China isn't exactly famous for failing to think long term. Their strategy is measured in centuries. Ours is measured in fiscal quarters. Where Dean really lost me, though, was describing an open-weight future as an "AI communist dystopian hellscape." I kept asking the same question: What's the dystopian hellscape? What is the nightmare scenario where more people have cheaper, maybe even free, access to frontier-level technology? We said the same thing about the internet. I don't think anyone looks back and says widespread internet access was a mistake because too many people got access to powerful technology.
This is all getting pretty banana pants. The actual cybersecurity nuance has almost nothing to do with where the model was trained. It has everything to do with where you're sending your data. If you're piping sensitive corporate information into a Chinese-hosted API, absolutely that's a legitimate concern. But if you're running an open-weight model on American infrastructure, whether that's Google Cloud, OpenRouter, or your own environment, the risk profile changes completely. There isn't some magically "American" model that's inherently safer because it carries a U.S. flag. (read more here and here)
This is one of those stories where the advice is simple: stop what you're doing and patch. Researchers disclosed a critical remote code execution vulnerability affecting WordPress itself, not a plugin, and exploitation is already considered trivial.
Ryan Dewhurst, one of the top WordPress security researchers, warned that attackers can exploit it with AI-assisted tooling, making this far easier to weaponize than many past WordPress flaws. Roughly 500 million websites run WordPress, although the bug only affects versions 6.9 and newer (with some caveats. check patch notes), meaning sites updated since December or running automatic updates are the ones most likely to be exposed.
I expect that mass exploitation is measured in hours, not days. If you're running an affected version, patch immediately. If you absolutely can't update right away, you may be able to temporarily mitigate the risk by disabling the vulnerable WordPress REST API functionality, but honestly that sounds harder than simply installing the fix. WordPress forced a patch but I got lots of DMs and comments from people saying their version didn’t auto update. Cloudflare also pushed a protection in their WAF if you’re on their pipes. (read more)
If every reviewer clicks approve, the review didn't happen. Attestation fatigue is real: reviewers see 200 identical rows with no context and do the only reasonable thing. Opal's Paladin triages the queue before they ever open it — automating the routine 90% with a full audit trail, surfacing the 10% that needs a human call.
*Sponsored
Google just made one of the biggest AI-for-cybersecurity announcements we've seen yet. Heather Adkins, Google's CISO, shared Gemini 3.5 Flash Cyber, a lightweight, cost-efficient model that's purpose-built for security work. They emphasized the capability around finding AND fixing vulnerabilities. Finding bugs has never been the hard part. Fixing them at scale is worth the attention. Google has been saying for a while that its long-term goal is nothing less than eliminating software vulnerabilities altogether, and this feels like another major step toward that vision.
Google says Gemini 3.5 Flash Cyber found more vulnerabilities in the V8 JavaScript engine that powers Chrome than either Gemini 3.5 Flash or Gemini 4.6. That's wild. My first sarcastic thought was, "Did somebody tell the FBI? We've got another model to ban." If this thing delivers cyber capabilities on par with models like Mythos Preview but at a fraction of the cost, that's a huge development for defenders. The industry has spent months debating whether powerful cyber models are too dangerous to release, while Google is demonstrating what happens when you optimize one specifically to help security teams identify and remediate flaws faster.
To me, this is exactly where the conversation should be. If policymakers are genuinely worried about the cybersecurity race with China, the answer isn't flirting with bans on open-weight models or trying to slow down AI. It's getting the best defensive capabilities into the hands of every security team in America and across our allies. We've already learned this lesson with vulnerability scanners, Metasploit, and countless other security tools. Pretending powerful technology doesn't exist doesn't make attackers forget about it. The best response is putting better tools in defenders' hands. One gazillion percent. That's how you improve cybersecurity. (read more)
Laundry Bear (also known as Void Blizzard) has been running a nasty espionage campaign since July 2025, exploiting a zero-day in Zimbra Collaboration Suite that didn't get patched until November. Such little user interaction required for this bug, just viewing a phishing email is enough for them to walk away with 90 days of emails, passwords, 2FA tokens, and search history. No clicks.
The joint advisory - signed by 16 countries - notes the group is still actively hitting unpatched Zimbra instances, so if your org is running it, patch now. The vulnerability only scored a 6.1 CVSS severity rating, further solidifying fixing in CVSS score order is not a good strategy. The group has been spotted targeting defense, energy, law enforcement, finance and more across NATO countries, with Ukraine serving as their testing ground before broader deployment - a pattern we're seeing more frequently from Russian threat actors. (read more)
Nasty one here - the Adobe Acrobat Chrome extension had a vuln that could let any website you visit silently read your WhatsApp Web conversations. The attack chain, dubbed HermeticReader, exploits the extension's WhatsApp integration feature to hijack DOM operations in your WhatsApp tab and exfiltrate your chat list, contacts, messages, and more - with zero clicks required. 329 million installs on this extension makes my head spin…
It was caught four hours after Adobe accidentally introduced it in an update, and Adobe patched it within two days over a weekend - which is about as good as we can hope for. No evidence of exploitation in the wild either. If you're running the Adobe Acrobat Chrome extension, just make sure you're on version 26.5.2.3 or later, which should have auto-updated already. (read more)
If you're running on-premise SharePoint, drop what you're doing and patch. CVE-2026-50522 is a critical unauthenticated RCE flaw that got a PoC published on GitHub, and within hours watchTowr's honeypots were catching active exploitation attempts. Attackers are using it to steal machine keys, which lets them forge authentication tokens and maintain persistent access even after you patch the underlying vulnerability. (read more)
Take my eyes, but not my milk! Anubis ransomware gang is claiming responsibility for the Fairlife (Coca-Cola dairy subsidiary) attack that took down US production facilities earlier this month. They're saying they encrypted Fairlife's Nutanix infrastructure and walked out with about 1TB of corporate data, with a deadline to negotiate or they dump it. Coca-Cola's not saying much.
Worth keeping an eye on Anubis - they're a RaaS operation that spun up in December 2024 and have been building a pretty gnarly toolkit. Last year they added a data wiper to the mix, so beyond the usual encrypt-and-ransom playbook, they can just nuke your files entirely if you don't play ball. The fact that Fairlife went public with the breach quickly without following the ransom instructions clearly didn't sit well with them. (read more)
If you're running Palo Alto GlobalProtect VPN and haven't patched CVE-2026-0257 yet, you’re probably having a bad time. Qilin ransomware affiliates are actively chaining this auth bypass vulnerability to get into corporate networks, and researchers have already documented multiple successful intrusions from June alone. Palo Alto patched it back in May, CISA added it to KEV and gave federal agencies three days to patch, and yet here we are with Shadowserver tracking over 167,000 GlobalProtect instances still exposed online. (read more)
If you've got self-hosted ServiceNow instances in your environment, heads up! (Feels like a lot of this this week). CVE-2026-6875 is a pre-auth sandbox escape RCE that's now being actively exploited in the wild - Defused caught it over the weekend. ServiceNow patched their hosted instances back in April but only dropped the fix for self-hosted a week ago on July 13th, which means there's been a window of exposure for anyone dragging their feet on updates.
The interesting wrinkle here is that attackers are hitting the same pre-auth endpoint that Searchlight Cyber documented in their original PoC, but using a different sandbox-escape gadget to get there. ServiceNow is still technically saying they haven't observed exploitation on their hosted instances, but if you're self-hosted you've got 85% of Fortune 500 companies worth of attack surface context to motivate you. (read more)
Miscellaneous mattjay
How'd I do this edition?It's hard doing this in a vacuum. Screaming into a void. Feedback is incredibly valuable to make sure I'm making a newsletter you love getting every week. |
Parting Thoughts:
Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.
Stay safe, Matt Johansen
@mattjay