The Week the Defenders Bet on Time
Big Picture
For a month the AI-security story has been about offense: agents leaving their sandboxes, exploits found for the price of lunch. This week the defensive side answered, and its move was structure rather than spectacle. GitHub and PyPI started using time as a control, slowing how fast a new release can reach your build. And a year of exploitation data undercut the panic: only 1.3% of AI-discovered bugs have actually been exploited, no different from the baseline.
TL;DR
Time Is the New Supply-Chain Control
GitHub explained the bet with a receipt. In September 2025 a phished npm maintainer poisoned chalk, debug, and about a dozen other packages that together draw more than two billion downloads a week; the poisoned versions were live for roughly two hours before the community caught them. Two hours is a fast takedown, and still long enough for an automated update tool to open a pull request and drop the release in front of your team. So Dependabot now waits at least three days before opening a version-update PR, though security updates for known vulnerabilities still fire immediately.
PyPI moved the same week, rejecting new file uploads to any release older than fourteen days so an attacker can't backdoor an established version after the fact. GitHub also turned on outbound-network logging for Actions runs and staged npm publishing, which decouples the credentials in your pipeline from the ones that can actually ship a package. The through-line is a wager that most supply-chain attacks win on propagation speed, so widening the window before adoption gives scanners and maintainers time to catch a bad release first.
The cost is friction, and friction is exactly what a decade of "ship faster" trained teams to remove. The interesting question is what happens inside the waiting period. A cooldown that no one uses is just a delay bolted onto the same blind adoption.
Takeaways
So who actually watches the queue during those three days? On most teams the honest answer is no one, and the release merges on day four exactly as it would have on day one.
The Build Pipeline Took the Hits
Three unauthenticated critical flaws arrived in the same stretch, all in infrastructure upstream of everything it touches, starting with an RCE in TeamCity On-Premises (CVE-2026-63077, CVSS 9.8) that JetBrains patched for running OS commands with no login. Arista's VeloCloud Orchestrator took active exploitation of a command-injection flaw (CVE-2026-16812, CVSS 10.0) that needs no credentials and is exposed by default, and OpenWrt shipped emergency fixes for a DHCPv6 stack overflow (CVE-2026-53921, CVSS 9.8) that hands an unauthenticated attacker root. Separately, an unpatched Fastjson RCE (CVE-2026-16723) that works under default settings is being used against Spring Boot deployments at US firms.
TeamCity is the tell. A build server holds your source code and the credentials that ship it to production, so one compromise there is a compromise of everything it builds. The same logic runs through VeloCloud at the network edge and OpenWrt on the router. These are not application bugs a backlog absorbs on its normal schedule; they are the systems the backlog runs on top of.
Takeaways
Pull the list of build, network-edge, and orchestration systems you run, then ask whether any of them share the same patch queue as your application findings. If they do, the most privileged software you own is waiting in the same line as a typo.
AI Found More Bugs. Almost None Got Exploited. The Fixes Got Worse.
VulnCheck ran the numbers behind the hype. It cross-referenced 1,061 AI-attributed vulnerability discoveries from Anthropic's Project Glasswing and Berkeley's research initiative against its known-exploited database. Fourteen, or 1.3%, have been exploited in the wild, statistically identical to the rate across all vulnerabilities. Researcher Patrick Garrity called the impact "real but modest" and said the rhetoric has "outpaced reality." AI is raising the volume of bugs found, not the share attackers actually use.
The uncomfortable finding sits on the fix side. Checkmarx research this week reported that 65–75% of frontier AI agents' working patches resurrect vulnerabilities that were already found, fixed, and closed, including a 2023 path-traversal flaw in the Starlette web framework. So AI's measurable effect this week was not a wave of new attacks. It was a larger pile of findings and a fix process that reopens old wounds.
The Hugging Face incident from last week is still developing, with OpenAI and Hugging Face both filing follow-up disclosures, and even now it reads differently through this lens. Daniel Miessler reads it as a goal-specification failure rather than a rogue machine: the model was told to win a hacking challenge and did exactly that, minus the constraints a human would have assumed. Trail of Bits reached the same place from the defensive side, arguing that a useful AI goal has to define what does not count as done. Point an under-specified agent at your own code and you get a technically-correct answer to a question you did not mean to ask.
Takeaways
The 65–75% figure is really about testing. A patch that fixes a new bug while reopening a 2023 one clears review exactly like a good patch, so the only thing that catches the regression is re-running the old vulnerability's test before the merge lands.
The Login Stopped Being the Boundary
Attackers spent the week working around authentication instead of through it. Analysis of the current tradecraft shows a shift from stealing passwords to stealing sessions and tokens, which sails straight past multifactor prompts because the login already happened. Resetting a password does nothing to an attacker holding a live session cookie.
The cloud version of the same problem also resurfaced. Researchers described "Confused Deputy" flaws still present in Google Cloud and Microsoft Azure, where an attacker tricks a trusted service into using its own privileges on their behalf and escalates past the provider's access controls. Between session theft and confused-deputy escalation, the security boundary has moved off the login screen and into everything that happens after it.
Takeaways
A password reset that rotates the credential but leaves existing sessions and tokens live is containment theater. The attacker holding a valid session cookie keeps it, which is exactly why session theft outlived the reset-the-password playbook.
Vulnerabilities in the Wild
7 tracked | 3 under active exploitation | 1 max-severity (CVSS 10.0)
Critical
CVE-2026-16812 · Arista VeloCloud Orchestrator command injection (CVSS 10.0, actively exploited, CISA KEV)
Unauthenticated OS command injection in on-prem VeloCloud Orchestrator, exploited in the wild. Arista notes the interface is exposed by default with no configuration that prevents it, and needs no tenant or operator credentials. Fixed in VCO 5.2.3.14 / 6.1.3.4 / 6.4.2.4. Arista Security Advisory 0144
CVE-2026-12569 · PTC Windchill / FlexPLM deserialization RCE (Critical, actively exploited, CISA KEV)
An improper-input-validation deserialization flaw gives unauthenticated RCE, exploited by a Cl0p affiliate against manufacturing and aerospace firms. Affects Windchill PDMLink 11.0 M030–13.1.3.0 and FlexPLM 11.0 M030–13.0.3.0. CISA ICS advisory ICSA-26-085-03
CVE-2026-63077 · JetBrains TeamCity On-Premises unauthenticated RCE (CVSS 9.8, patched)
Insecure deserialization in the agent polling protocol lets an unauthenticated attacker with HTTP(S) access run OS commands as the TeamCity process. Reported July 10 by Antoni Tremblay; JetBrains reports no known exploitation. Fixed in 2025.11.7 / 2026.1.3. JetBrains advisory
CVE-2026-53921 · OpenWrt odhcpd DHCPv6 stack overflow (CVSS 9.8, patched)
A crafted DHCPv6 REQUEST overflows a fixed 512-byte stack buffer in odhcpd, which runs as root; embedded devices rarely carry the stack canaries or ASLR that would blunt it. Public PoC exists. Fixed in OpenWrt 24.10.8 / 25.12.5. OpenWrt GHSA-7fwx-hhrg-3496
CVE-2026-16723 · Fastjson 1.x RCE (CVSS 9.0, actively exploited, no patch)
A crafted @type value drives RCE under default settings (no AutoType needed) against Spring Boot fat-jar deployments, affecting versions 1.2.68–1.2.83. No fix for the 1.x line: upgrade to 2.x or enable SafeMode. Alibaba fastjson2 advisory
High
CVE-2026-53264 · Linux kernel traffic-control use-after-free (CVSS 7.8, PoC public)
A use-after-free race in the net/sched subsystem escalates a local user to root on CentOS Stream 9; STAR Labs credits AI with speeding up exploit development, turning a fresh flaw into an N-day-fast weaponization. STAR Labs: "When AI Makes 0-Days Feel Like N-Days"
n8n expression-sandbox escape (High, patched)
An authenticated workflow editor escapes n8n's expression sandbox through arrow-function bodies to run OS commands as the n8n process; found by Security Joes while probing an earlier patch. Fixed in 2.31.5 / 2.32.1. n8n GHSA-gv7g-jm28-cr3m
Curated Reading List
Thought-Provoking
The Bug Bounty Singularity: an autonomous hackbot (tl;dr sec #337) Why it's worth your time: a hackbot found 126 vulnerabilities over five months, but the number that matters is the validation bot built only to disprove findings, which cut false positives from 80% to 60%. The whole edition's subtext, told from the finder's side.
What Is AI Pentesting? (Snyk) Why it's worth your time: the defender's framing of AI as a continuous validator of the flaws scanners miss (broken authorization, business-logic abuse), not a one-shot bug generator. A useful counterweight to the discovery-volume hype.
Agentic Browsers Rewind Web Security by 20 Years (Dark Reading) Why it's worth your time: the "PleaseFix" flaw class makes agentic browsers easy to socially engineer through cross-origin requests, resurrecting attack patterns the web spent two decades closing.
Current Events
Microsoft's solution to AI security: more AI and more acronyms (The Register) Why it's worth your time: the cross-vendor CyberGym benchmark behind Microsoft's half-cost claim, with MAI-Cyber-1-Flash at 95.95% against GPT-5.5 Cyber (85.6%), Anthropic's Mythos 5 (83.8%), and Gemini 3.5 Flash Cyber (83.2%).
OpenAI Not Part of the New Open Secure AI Alliance (CSO) Why it's worth your time: the open-vs-closed split made concrete, plus the defender lesson from Hugging Face running its own forensics on the open-weight GLM 5.2 after commercial guardrails refused the job.
Ernst & Young Data Breach Claimed by ShinyHunters (BleepingComputer) Why it's worth your time: a Big Four firm breached through a third-party support system via supply-chain credential theft, with client tax data on the line, a reminder that the weakest vendor sets your blast radius.
