In partnership with
⏱️ ≈ 7-minute read
Editor’s Note: This week’s theme: patch faster, trust less, and maybe don’t let AI run unattended. From Fortinet firewalls under active attack to Russian-linked energy sector intrusions, plus AI that can out-hack humans and scam its way through HR, cyber stayed busy.
📬 This Week’s Clickables
📌 Big News
Fortinet flaws exploited in the wild; Russian-linked hackers escalate energy sector attacks🚨 Can’t Miss
Massive PII breach, Linux backdoors, KEV alerts, Apple zero-days, and ransomware déjà vu🤖 AI in Cyber
AI that outperforms human hackers, autonomous “vibe crime,” and where the industry is headed🧪 Strange Cyber Story
When your new remote IT hire is actually an AI-powered scam
🚨 Big Stories
⚡ Suspected Russian Hackers Step Up Attacks on U.S. Energy Firms
Intro: Russian-linked threat actors appear to be shifting gears, though not with flashy zero-days, but with quieter, more efficient targeting.
What Happened: Research indicates GRU-associated groups have increased attacks against U.S. and Western energy companies, relying heavily on common misconfigurations, exposed services, and unpatched systems to gain persistent access and harvest credentials.
Why It’s Important: Energy infrastructure remains a prime geopolitical target, and these campaigns show attackers don’t need cutting-edge exploits to cause serious strategic risk or long-term disruption.
The Other Side: Many of the abused weaknesses were already documented, reinforcing that baseline cyber hygiene like patching, segmentation, and monitoring is still the strongest defense.
👉 Takeaway: Nation-state attackers are winning with simplicity while defenders need to close the basics faster.
TL;DR: Russian-linked hackers are scaling energy-sector attacks using old flaws and poor configurations and it’s working.
Further Reading: Wall Street Journal
Over 60% of breaches exploit known vulnerabilities with patches already available. (Verizon DBIR)🔓 Fortinet FortiGate Under Active Attack via SAML SSO Bypass
Intro: It didn’t take long for attackers to move from disclosure to real-world abuse.
What Happened: Two critical authentication bypass vulnerabilities in Fortinet FortiGate appliances are now being actively exploited, allowing attackers to bypass SAML-based single sign-on controls and potentially gain unauthorized network access.
Why It’s Important: FortiGate devices sit at the heart of enterprise networks and compromise here can provide broad visibility, lateral movement opportunities, and a fast path to full domain takeover.
The Other Side: Fortinet has issued patches and guidance, but thousands of exposed devices remain unpatched, leaving organizations vulnerable.
👉 Takeaway: Identity-layer flaws on perimeter devices are catastrophic if left unpatched.
TL;DR: Critical Fortinet SSO vulnerabilities are under active exploitation — patch now or assume exposure.
Further Reading: The Hacker News
This newsletter you couldn’t wait to open? It runs on beehiiv — the absolute best platform for email newsletters.
Our editor makes your content look like Picasso in the inbox. Your website? Beautiful and ready to capture subscribers on day one.
And when it’s time to monetize, you don’t need to duct-tape a dozen tools together. Paid subscriptions, referrals, and a (super easy-to-use) global ad network — it’s all built in.
beehiiv isn’t just the best choice. It’s the only choice that makes sense.
🔥 Can’t Miss
🗂️ 700Credit Data Breach Impacts 5.8 Million Individuals
The identity verification firm disclosed a breach exposing names, Social Security numbers, and dates of birth tied to nearly 5.8 million individuals. The compromised data significantly increases long-term identity theft and fraud risks, particularly given the sensitivity of SSNs.
👉 Key takeaway: PII breaches have long tails with victims paying the price for years.🐧 React2Shell Exploits Used to Deploy Linux Backdoors
Threat actors are actively exploiting the React2Shell vulnerability to deploy persistent Linux backdoors, including malware families like KSwapDoor and ZnDoor. Researchers note the exploitation is highly automated, enabling attackers to compromise large numbers of exposed servers quickly.
👉 Key takeaway: Server-side flaws + automation = rapid mass compromise.📡 CISA Flags Sierra Router Vulnerability as Actively Exploited
CISA added a critical Sierra Wireless router vulnerability to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. Affected devices are commonly used in telecom, transportation, and industrial environments, raising concerns about operational disruption.
👉 Key takeaway: KEV listings aren’t suggestions, they’re warnings.🍎 Apple Patches Two Actively Exploited Zero-Days
Apple released emergency security updates to address two WebKit zero-day vulnerabilities already being exploited in the wild. The flaws appear to be part of a broader exploit chain, reinforcing the need for rapid patching across Apple ecosystems.
👉 Key takeaway: If you haven’t updated yet, you’re behind.💣 Russian Cybercriminals Return with VolkLocker Ransomware
A known Russian cybercrime group resurfaced with a new ransomware strain called VolkLocker, attempting to reestablish its presence in the ransomware ecosystem. However, a flaw in the malware’s encryption implementation allows victims to recover files without paying a ransom.
👉 Key takeaway: Not all ransomware comebacks are successful.
Want to get the most out of ChatGPT?
ChatGPT is a superpower if you know how to use it correctly.
Discover how HubSpot's guide to AI can elevate both your productivity and creativity to get more things done.
Learn to automate tasks, enhance decision-making, and foster innovation with the power of AI.
🤖 AI in Cyber
🧠 AI Agent Outperforms Human Hackers in Stanford Test
A Stanford study found an autonomous AI agent outperformed professional human pentesters in a live network challenge, finding more vulnerabilities at a fraction of the cost. The AI used parallel sub-agents to explore attack paths simultaneously.
👉 Key takeaway: Offensive AI is scaling faster than human talent.🤖 Trend Micro Warns of “Vibe Crime” — Autonomous AI Attacks
Trend Micro reports a rise in “vibe crime,” where agentic AI systems independently conduct phishing, fraud, and intrusion campaigns with minimal human input.
👉 Key takeaway: Fully autonomous cybercrime is no longer theoretical.🚨 OpenAI Warns New Models Pose ‘High’ Cybersecurity Risk
OpenAI warned that upcoming advanced models could significantly lower the barrier to developing zero-day exploits, malware, and automated intrusion workflows, while acknowledging the need for stronger safeguards.
👉 Key takeaway: AI capability gains are outpacing safety guardrails.🌍 Militant Groups Are Experimenting With AI, Report Warns
Security researchers warn that extremist and militant groups are increasingly using AI tools for propaganda, deepfakes, and influence operations, with expectations that misuse will expand into cyber operations.
👉 Key takeaway: AI misuse is becoming a national security concern.📊 Forbes: Cybersecurity Trends to Watch in 2026
Industry leaders highlight AI-driven attacks, quantum-readiness gaps, and regulatory pressure as defining security challenges heading into 2026.
👉 Key takeaway: Strategic planning matters as much as tooling.
🧟♂️ Strange Cyber
🎭 AI-Powered Remote IT Worker Scams
Intro: Turns out your new remote sysadmin might not be human, or even exist for that matter.
What Happened: Criminal groups are using AI tools to impersonate remote IT workers during hiring processes, leveraging deepfake video interviews, scripted technical responses, and stolen resumes to pass screenings. In some cases, the goal is direct financial fraud; in others, it’s long-term network access.
Why It’s Important: Hiring pipelines have quietly become a new attack surface, blending social engineering, AI automation, and insider risk — especially as remote-first hiring accelerates.
The Other Side: Strong identity verification, live technical challenges, and structured onboarding controls could stop many of these schemes before access is granted.
👉 Takeaway: Zero trust shouldn’t stop at the firewall — it applies to HR too.
TL;DR: AI-powered fake IT workers are exploiting remote hiring processes to scam organizations and gain access.
Further Reading: World Economic Forum
Enjoying Exzec Cyber? Forward this to one person who cares about staying ahead of attacks.
Hate everything you see or have other feedback? Reply back to this email!