Check Point: DeepSeek-Generated Malware Bridges Theory to Working Ransomware

Unpatched Argo CD repo-server RCE enables full Kubernetes cluster takeover. Synacktiv disclosed an unauthenticated remote-code-execution flaw in Argo CD’s repo-server: its internal gRPC service has no authentication, so anyone who can reach the port can send a crafted GenerateManifest request that abuses kustomize’s –helm-command option to run an attacker-supplied script instead of Helm. There is no fix and no CVE — Synacktiv says it reported the bug in January 2025 and published roughly 18 months later to warn users. The common Helm install leaves Kubernetes network policies off by default, so a single compromised pod can reach the repo-server and trigger it. The mitigation is to enable Kubernetes network policies now.

So what: The exposure story keeps returning to the same discipline question, sharpened here by Argo CD: a GitOps control plane with no CVE, no patch, and an 18-month-old warning means you can’t wait for a fix or a KEV entry to act — you have to know where it runs and segment it now. Kemp crossing into active exploitation and Adobe’s seven maximum-severity flaws reinforce that the gating variable is inventory and edge/network segmentation, not the availability of a patch.

Progress Kemp LoadMaster (CVE-2026-8037) moves to active exploitation. eSentire’s Threat Response Unit reports in-the-wild exploitation attempts against the pre-auth OS-command-injection flaw in LoadMaster’s API, with activity beginning June 29 — a shift from the prior day’s ‘no known exploitation’ status. The bug sits in an escape_quotes() routine that fails to sanitize input before it reaches a shell. A patch has been available since early June, and watchTowr published a full exploit-chain walk-through the previous week. If the API is enabled on an internet-facing appliance, patch now.

So what: The exposure story keeps returning to the same discipline question, sharpened here by Argo CD: a GitOps control plane with no CVE, no patch, and an 18-month-old warning means you can’t wait for a fix or a KEV entry to act — you have to know where it runs and segment it now. Kemp crossing into active exploitation and Adobe’s seven maximum-severity flaws reinforce that the gating variable is inventory and edge/network segmentation, not the availability of a patch.

Adobe patches seven CVSS 10.0 flaws in ColdFusion and Campaign Classic. Adobe’s out-of-band update fixes maximum-severity unrestricted-file-upload, improper-input-validation, and path-traversal bugs that can lead to arbitrary code execution, privilege escalation, and arbitrary file read. No public exploitation has been reported yet, but ColdFusion has historically been an exploitation magnet once details are out.

So what: The exposure story keeps returning to the same discipline question, sharpened here by Argo CD: a GitOps control plane with no CVE, no patch, and an 18-month-old warning means you can’t wait for a fix or a KEV entry to act — you have to know where it runs and segment it now. Kemp crossing into active exploitation and Adobe’s seven maximum-severity flaws reinforce that the gating variable is inventory and edge/network segmentation, not the availability of a patch.

SEO-poisoned software sites abuse ScreenConnect to deploy AsyncRAT. Kaspersky detailed a massive, multi-domain, multi-language campaign: more than 90 domains, localized across 10 languages, host fake installers for OBS Studio, DNS Jumper, DS4Windows, Bandicam, and others. The archives bundle a legitimate signed Microsoft install.exe with a rogue DLL side-loaded to deploy ScreenConnect as a covert access channel, then pull down AsyncRAT.

So what: The exposure story keeps returning to the same discipline question, sharpened here by Argo CD: a GitOps control plane with no CVE, no patch, and an 18-month-old warning means you can’t wait for a fix or a KEV entry to act — you have to know where it runs and segment it now. Kemp crossing into active exploitation and Adobe’s seven maximum-severity flaws reinforce that the gating variable is inventory and edge/network segmentation, not the availability of a patch.

VEIL#DROP delivers PureLogs stealer via Blogger; Ousaban trojan hits Iberian banks. Securonix flagged a multi-stage chain — spear-phish or drive-by download leading to a transcript.pdf.js lure and PowerShell staged off a Blogger page — delivering the PureLogs infostealer. Separately, Fortinet’s FortiGuard identified Ousaban, a Brazilian banking trojan geofenced to Spain and Portugal that hides its payload in an image and watches for sessions with more than two dozen banks, including Santander, BBVA, CaixaBank, and Bankinter, to hijack them live.

So what: The exposure story keeps returning to the same discipline question, sharpened here by Argo CD: a GitOps control plane with no CVE, no patch, and an 18-month-old warning means you can’t wait for a fix or a KEV entry to act — you have to know where it runs and segment it now. Kemp crossing into active exploitation and Adobe’s seven maximum-severity flaws reinforce that the gating variable is inventory and edge/network segmentation, not the availability of a patch.

19-year-old Scattered Spider suspect extradited to the US. The Department of Justice announced on July 1 that Peter Stokes, 19, a dual U.S./Estonian citizen tied to the handle ‘Bouquet,’ was extradited from Finland to face conspiracy, computer-intrusion, and fraud charges spanning at least four intrusions since he was 16, including a 2025 jewelry-retailer breach with an approximately $8 million cryptocurrency ransom demand. It’s the latest in a run of arrests against the crew behind casino, retail, and airline breaches.

So what: The exposure story keeps returning to the same discipline question, sharpened here by Argo CD: a GitOps control plane with no CVE, no patch, and an 18-month-old warning means you can’t wait for a fix or a KEV entry to act — you have to know where it runs and segment it now. Kemp crossing into active exploitation and Adobe’s seven maximum-severity flaws reinforce that the gating variable is inventory and edge/network segmentation, not the availability of a patch.

AI-generated browser ransomware bridges theory to a working attack. A DeepSeek-generated Python/Flask sample abused a real Chromium capability to build browser-only ransomware working on both Windows and Android — the first documented case of a frontier model independently producing a novel attack path that had previously been dismissed as unfeasible.

So what: Three items, one arc: AI is now on the attacker’s side of the keyboard, not just the target. DeepSeek invents the attack, Cursor shows AI-assisted development tooling is itself a pre-auth RCE surface, and Phantom Squatting weaponizes the trust already extended to model output. Governing this can’t happen at the model layer alone — it requires behavioral visibility across the tools, agents, and outputs AI touches, because a novel attack path won’t match any known signature.

‘DuneSlide’ — zero-click prompt injection escapes Cursor’s sandbox to RCE (CVE-2026-50548 / -50549, CVSS 9.8). Cato AI Labs found a pair of flaws letting attacker-controlled content an agent reads — via an MCP-connected service or a web-search result — escape Cursor’s default terminal sandbox and run arbitrary commands with no click and no approval required. CVE-2026-50548 abuses the working_directory parameter to widen the allowed-write list; CVE-2026-50549 abuses a symlink-resolution fallback. The flaws are patched in Cursor 3.0, released April 2; every prior version is affected, and Cursor’s maker says over half the Fortune 500 use it.

So what: Three items, one arc: AI is now on the attacker’s side of the keyboard, not just the target. DeepSeek invents the attack, Cursor shows AI-assisted development tooling is itself a pre-auth RCE surface, and Phantom Squatting weaponizes the trust already extended to model output. Governing this can’t happen at the model layer alone — it requires behavioral visibility across the tools, agents, and outputs AI touches, because a novel attack path won’t match any known signature.

‘Phantom Squatting’ — attackers register AI-hallucinated domains for phishing. Palo Alto’s Unit 42 asked two AI models 685,339 questions about 913 brands; the models produced 2.1 million links, 13,229 of which threat intelligence already flags as malicious. Attackers pre-register the non-existent domains the models invent, inheriting the misplaced trust that developers and assistants extend to model output — no phishing email or malicious ad required.

So what: Three items, one arc: AI is now on the attacker’s side of the keyboard, not just the target. DeepSeek invents the attack, Cursor shows AI-assisted development tooling is itself a pre-auth RCE surface, and Phantom Squatting weaponizes the trust already extended to model output. Governing this can’t happen at the model layer alone — it requires behavioral visibility across the tools, agents, and outputs AI touches, because a novel attack path won’t match any known signature.

US lifts jailbreak-linked export controls on frontier AI models. Anthropic restored Claude Fable 5 worldwide on July 1 after the Commerce Department lifted export controls on June 30 that it had imposed roughly two and a half weeks earlier. The June 12 order — triggered by an Amazon-discovered jailbreak that got a model to flag software flaws and, in one case, write exploit-demonstrating code — had required cutting off the model for any foreign national, forcing a full shutdown.

So what: This is a live precedent for AI as a controlled dual-use technology — a model’s offensive-security capability triggered an export-control action in weeks, not years. For federal and regulated buyers, frontier-model availability is now a governance and supply-continuity variable, not just a procurement one; build for model portability and don’t single-thread critical workflows on one provider’s uninterrupted access.