Five stories this week, one thread: the friction between attackers and access keeps shrinking. Here's what stood out from the operator chair.

When every version is vulnerable, speed beats targeting.
WatchTowr disclosed a cPanel/WHM auth bypass affecting every version in the wild: tens of millions of domains, no credentials required. From the operator chair, you don't bother fingerprinting: if it has a pulse, it's in scope. The real adversary inside an unpatched panel won't be you; it'll be whoever got there an hour earlier (the MongoDB ransom-on-ransom era is the playbook). For end-of-life systems where patching isn't possible, segment from the internet and assume the race has started.

AI writes plausible code, not secure code.
Researchers are finding high vulnerability rates in AI-generated code (like unsafe input handling, weak auth) reaching production through devs who don't know what to look for. The deeper issue is statistical: model outputs reflect the average of their training data, and as that corpus gets noisier, "plausible" drifts further from "secure." Banning AI from the SDLC process is a losing strategy; your engineers are already and will continue to use it. Track it, review it, treat its output like a junior dev's first commit.

Mediocre operators are using AI to scale, not to learn.
A North Korean campaign used AI to write malware, build phishing sites, stand up fake companies, and run victim interactions, pulling in millions despite operators who weren't elite. It's not a tradecraft story; it's a volume story. With AI, the technical floor dropped, but the volume ceiling didn't. The targeted recruiter infiltration into engineering roles is the part defenders should sit with.

Patching the firewall doesn't evict the attacker on it.
New malware on Cisco Firepower devices survives patches; eviction requires offline reset. The real lesson is upstream of the CVE: stop treating edge devices as your source of truth for what's normal on the network. They need golden-image drift detection and change control like any other asset, and your endpoint visibility should flag traffic the firewall claims isn't there.

Custom exfil tools mean your signatures are lying to you.
Trigona operators ditched off-the-shelf tools like Rclone for a custom utility that splits transfers, rotates connections, and skips media files to stay quiet. The pattern they're leaning into is what makes this dangerous: a public exploit handles the front door, but everything after that runs on tooling your defenses have never seen. Patching the CVE feels like closure — the headline vulnerability is gone — but it does nothing about the operator already inside, moving with utilities you can't fingerprint. Signature-based detection won't catch that second half. Anomaly and traffic-flow analysis is the bar.

Security Headlines: 

• cPanel & WHM Authentication Bypass CVE-2026-41940, WatchTowr
• Anthropic’s Claude Is Pumping Out Vulnerable Code, Cyber Experts Warn, Forbes
• AI Tools Are Helping Mediocre North Korean Hackers Steal Millions, WIRED
• New Cisco firewall malware can only be killed by pulling the plug, HelpNetSecurity
• China-linked hackers using everyday devices to hide attacks, cyber agencies warn, Reuters
• Trigona ransomware attackers use novel tool for data exfiltration, SC Media