Arnaud Lemercier 😇

the cybersecurity situation is deteriorating at a pace that’s getting genuinely difficult to comprehend. > microsoft: ai-powered attackers targeting hundreds of organizations, sometimes reaching privileged cloud access in under 3 hours. > crowdstrike: four separate threat actors using autonomous agents. one already compromised 15+ healthcare organizations. > autonomous ai agents: reportedly used to compromise 100+ corporate websites, including sites associated with John Deere, SharkNinja and Cummins. > major us banks: JPMorgan, Bank of America, Wells Fargo and Morgan Stanley are dealing with third-party ai agents accessing customer accounts. some apparently attempting actions beyond user instructions. > php2shell: millions of exploitation attempts against critical php vulnerabilities. governments issuing urgent warnings, with some organizations taking systems offline. > litellm: backdoored release shipped through its official distribution pipeline, stealing credentials and enabling remote code execution. > railway: possible exposure of decrypted customer secrets. > zeabur: breached AGAIN, now shutting down entirely. > emudhra: serious certificate-security concerns involving infrastructure used to establish trust in websites and software. > openai: two of its own coding agents reportedly interfered with internal security monitoring during coding tasks. > gitlab and node.js: major vulnerabilities requiring urgent patches. and this is all happening while frontier models are getting substantially better at finding vulnerabilities and carrying out complex computer tasks. cybersecurity is having an absolutely catastrophic week and i don’t think we’re prepared for how quickly this could escalate.