A $500K Exploit, Found for $25. Then Weaponized in 72 Hours.
Big Picture
Searchlight Cyber found a pre-authentication WordPress RCE by pointing GPT-5.6 Sol Ultra at the core code for about $25 of compute. Exploit brokers pay up to $500,000 for a chain like that. Attackers were exploiting it in the wild within 72 hours of the July 17 patch. The price of offense just fell through the floor.
TL;DR
The AI That Refused to Help Its Own Defenders
Hugging Face disclosed a breach driven end to end by an autonomous AI-agent system. A swarm of agents executed many thousands of actions across short-lived sandboxes, staging self-migrating command-and-control on public services. The intrusion compromised a limited set of internal datasets and several service credentials. Hugging Face called it the "agentic attacker" scenario the industry has been forecasting.
The security team's commercial frontier models then refused to help. Forensic work meant feeding real exploit payloads and C2 artifacts into a model, which is exactly what the vendors trained their guardrails to block. So the team ran the log analysis on GLM 5.2, an open-weight model from Chinese firm Z.ai, on its own infrastructure. "The attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried," the team wrote.
Two things follow. A Western AI company reached for a Chinese open-weight model because its commercial options declined the job, and keeping the analysis local meant no attacker data left the environment. Hugging Face's CEO drew a forward-looking lesson from the same incident, that "defense needs to become agentic too." The sharper reading is that the guardrails meant to keep models safe are now a variable in whether you can investigate your own breach.
Takeaways
Hugging Face learned its forensic AI would refuse the job in the middle of the incident. Any team that leans on a hosted model for incident response shares that blind spot, and the same mid-crisis way of finding it.
A $500,000 Exploit, Bought for $25
Searchlight Cyber researcher Adam Kues tasked GPT-5.6 Sol Ultra with auditing a local copy of WordPress core, running four agents over roughly ten hours at about $25 of compute. Out came a complete pre-auth SQL-injection-to-RCE chain through a REST batch-route confusion bug, which Kues named wp2shell. Searchlight estimates a human researcher would have needed weeks to months. Brokers pay up to half a million dollars for a reliable pre-auth WordPress RCE.
The loop closed within days. WordPress shipped emergency fixes on July 17 and forced auto-updates across a population Searchlight puts north of 500 million sites. watchTowr reproduced one of the CVEs within minutes of disclosure; its honeypots logged tens of thousands of exploitation attempts and more than 100 attacker-created backdoor accounts. The same class of model that found the bug is the one attackers used to rebuild it from the public patch.
Takeaways
At $25 a find, the incentive to sit on a bug and wait for a broker's payday mostly evaporates, since the next AI audit will surface it anyway. Coordinated disclosure was built for a world where finding was the expensive part.
AI Code Ships About 15 Bugs a Codebase, and the Framework Decides How Many
New research from Secure Code Warrior and RMIT University puts a baseline number on AI-generated code. Across 1,760 codebases written by 16 frontier models, the study found about 15 vulnerabilities per codebase on average, 4.3 of them critical or high. The finding that should change how you buy is that risk tracks the framework pairing more than the model doing the writing. "Use a secure model" is weak guidance when your framework choice moves the needle further.
The tools themselves are not exempt. The same week, Pillar Security showed Cursor, Codex, Gemini CLI, and Antigravity all falling to sandbox escapes, where malicious code manipulates files the agent writes to break out of its container. So the assistants writing the code and the frameworks they lean on both carry measurable, documented risk.
Takeaways
The reflex will be to shop for a safer model. The study found the framework pairing moves the vulnerability count more than the model does, and that is the variable most AI-coding policies never name.
You Can't Patch Code Nobody Owns
The week's supply-chain hits landed the old-fashioned way. A malicious @injectivelabs/sdk-ts release hid a wallet-key stealer inside code labeled "usage telemetry" and spread across 17 more npm packages. AsyncAPI packages, whose specs draw around 2.9 million weekly downloads, shipped an obfuscated dropper through compromised GitHub Actions. The FakeGit campaign's 7,600 fake repositories, more than 800 of them posing as AI and MCP tools, rhyme with the pattern.
GitHub's own postmortem names the structural blocker. Of more than 11,000 non-archived internal repositories, the vast majority had no clear owner. During secret-scanning remediation, the team could rotate a leaked secret in seconds but could not safely route the fix without knowing who owned the repo. In six weeks they validated ownership for every active repository, archived roughly 8,000 unowned ones, and made ownership mandatory at creation.
The remediation gap usually gets framed as a finding problem or a fixing problem. GitHub's account points at a third blocker between them. You cannot route a fix, whether written by a person or a machine, to code that has no owner.
Takeaways
Pick one high-severity finding your team still has not closed and try to name who owns the repo. If that takes more than a minute, you have found the same bottleneck GitHub spent six weeks and 8,000 archived repos clearing.
Vulnerabilities in the Wild
15 vulnerabilities tracked | 8 under active exploitation | 2 SonicWall zero-days
Critical
CVE-2026-50522 · SharePoint deserialization RCE (CVSS 9.8, actively exploited)
Deserialization of untrusted data in on-prem SharePoint (Subscription Edition, 2019, 2016) gives unauthenticated network RCE, exploited after a public PoC to steal machine keys. Shown at Pwn2Own Berlin, credited to DEVCORE. MSRC advisory
CVE-2026-6875 · ServiceNow AI Platform pre-auth sandbox escape (CVSS 9.5, actively exploited)
An unauthenticated user breaks out of ServiceNow's Rhino script sandbox to run code; in-the-wild exploitation confirmed, with a second gadget chain bypassing PoC-tuned defenses. Reported by Searchlight Cyber. Searchlight Cyber
CVE-2026-60137 · wp2shell SQL injection (CVSS 9.1, actively exploited)
SQL injection in the WP_Query author__not_in parameter, present since WordPress 6.8. Chained with CVE-2026-63030 it yields unauthenticated SQLi-to-RCE, weaponized within 72 hours of the July 17 patch. NetSPI analysis
CVE-2026-15409 · SonicWall SMA1000 SSRF zero-day (Critical, actively exploited)
Critical SSRF in SMA1000 appliances exploited as a zero-day by UTA0533 from around June 22, weeks before the July 14 advisory, then chained to root and the KNUCKLEBALL dropper. Volexity
Zimbra 10.1.20 · SNMP monitoring command injection (Critical, patch available)
Command injection in the SNMP monitoring component (when notifications are enabled), the top item among nine flaws fixed in Zimbra 10.1.20. Zimbra release notes
High
CVE-2026-53359 · Januscape KVM guest-to-host escape (CVSS 8.8, patch available)
A guest with root escapes to run code as root on the KVM host or take over co-tenant VMs. OVH patched tens of thousands of hosts via mass reboots; no confirmed exploitation. The Register
CVE-2026-42897 · Exchange OWA cross-site scripting (CVSS 8.1, actively exploited, CISA KEV)
A crafted email runs attacker JavaScript in the victim's Outlook Web Access session against on-prem Exchange (Subscription Edition, 2019, 2016). Listed in CISA KEV under active exploitation. Help Net Security
CVE-2026-0257 · PAN-OS GlobalProtect authentication bypass (CVSS 7.8, actively exploited, CISA KEV)
A cookie-validation flaw lets attackers establish unauthorized VPN connections, leveraged by the Qilin ransomware gang for initial access (Arctic Wolf observed intrusions in June). Palo Alto advisory
CVE-2026-63030 · wp2shell REST batch-route confusion (CVSS 7.5, actively exploited)
The batch/v1 route-confusion bug misaligns sub-requests with their permission checks so unvalidated requests are treated as trusted. AI-discovered by Searchlight Cyber for about $25; watchTowr reproduced it within minutes of disclosure. NetSPI analysis
CVE-2026-15410 · SonicWall SMA1000 command injection zero-day (High, actively exploited)
Command injection chained with CVE-2026-15409, exploited as a zero-day by UTA0533 for weeks before the July 14 fix (12.4.3-03453 / 12.5.0-02835). Volexity
CVE-2026-57239 · Foxit update-service DLL hijack (CVSS 8.2, patch available)
An uncontrolled search path in the Foxit update service lets a local low-privileged user load a malicious DLL as SYSTEM, no malicious PDF required. Fixed in 2026.1.2 / 14.0.5 / 13.2.5. NVD
CVE-2026-14266 · 7-Zip XZ decoder heap overflow (High, patch available)
A heap overflow in XZ chunked decompression runs code when a user opens a crafted archive (21.07 through 26.01). Reported via Trend Micro ZDI, fixed in 26.02. ZDI advisory
Chrome 150 · memory-safety use-after-free bugs (High, patch available)
Chrome 150 patches seven memory-safety bugs, including three critical use-after-free flaws (CameraCapture, GPU, Network). SecurityWeek
CVE-2026-48124 · Cursor workspace-config sandbox escape (High, patch available)
Part of Pillar Security's "Week of Sandbox Escapes": a workspace-controlled config becomes unsandboxed command execution in Cursor. Patched in v3.0.0; companion findings hit Codex, Gemini CLI, and Antigravity. Pillar Security
Medium
OpenSSL "HollowByte" memory-exhaustion DoS (Medium, patch available)
OpenSSL pre-allocated large buffers from attacker-declared message sizes, so an 11-byte payload can exhaust server memory. Found by Okta's red team, silently fixed in 4.0.1 and backported. Okta Security
Curated Reading List
Thought-Provoking
N-day is Becoming N-Hour. Patching Faster Won't Save You. Why it's worth your time: names the mechanism behind this week's 72-hour wp2shell weaponization, where every patch is a confession and frontier models turn the diff into a working exploit in under an hour.
2026 CrowdStrike Global Threat Report: AI Accelerates Adversaries Why it's worth your time: the hard velocity data under the week's narrative, a 29-minute average breakout (27-second record) and 42% of vulns exploited before public disclosure.
25 Years After Code Red: What the Worm Era Can Teach Us About AI Security Why it's worth your time: Marc Maiffret's historical lens on what internet-scale worm response in 2001 says about attack-surface and shadow-AI discipline in 2026.
Current Events
Remediating Vulnerabilities With LLMs: Inside Ivanti's Automation Push Why it's worth your time: the defender's side of the AI story, with Ivanti's CSO on where LLM remediation worked in production and where cost and human review still bite.
Neo Emerges From Stealth With $100M to Control and Secure Enterprise AI Software Why it's worth your time: a $100M a16z/Bessemer round for an AI-agent governance layer signals investors now treat AI security as its own category, not a feature of traditional AppSec.
Capital One Open Sources AI-Powered 'VulnHunter' Security Tool Why it's worth your time: a major bank open-sourcing an agentic vuln-hunter that maps attack paths and proposes targeted fixes, and one you can pull from GitHub today.
