In partnership with
⏱️ ≈ 7-minute read
Editor’s Note: This week is less about “another breach happened” and more about how trusted tools, identities, plugins, and privacy projects can become the blast radius. The common thread: security controls only work when the boring parts, patch validation, identity governance, extension hygiene, and access reviews, are actually done.
📬 This Week’s Clickables
📌 Big News - Microsoft Defender zero-days and GitHub’s poisoned VS Code extension problem
🚨 Can’t Miss - Cloud identity abuse, SonicWall MFA bypasses, criminal VPN takedowns, and Grafana’s ransom refusal
🤖 AI in Cyber - AI-assisted exploitation, battlefield malware, authoritarian tech cooperation, and financial privacy risk
🧪 Strange Cyber Story - GrapheneOS, Copperhead, and the privacy tool feud that went full Silicon Valley courtroom energy
🚨 Big News
🛡️ Microsoft warns of new Defender zero-days exploited in attacks
Intro
Microsoft patched two Defender vulnerabilities already being exploited in the wild, which is not ideal when the security tool is supposed to be holding the umbrella, not standing in the rain.
What Happened
CVE-2026-41091 is a privilege escalation flaw in the Microsoft Malware Protection Engine that could allow SYSTEM-level access. CVE-2026-45498 affects the Defender Antimalware Platform and could trigger denial-of-service conditions on unpatched Windows devices. Microsoft released updated engine and platform versions, and most customers should receive them automatically through default antimalware updates. CISA also added both bugs to its Known Exploited Vulnerabilities catalog and set a June 3 federal remediation deadline.
Why It’s Important
Defender is everywhere in enterprise Windows environments, so even a limited exploitation window matters. A privilege escalation bug inside a security engine can help attackers turn a small foothold into something much more painful. The bigger lesson: “automatic updates” only count if you can prove they happened.
The Other Side
This is not a “rip Defender out by Friday” story. Microsoft shipped fixes quickly, and default configurations should update automatically. The remaining risk sits with organizations that delay updates, disable services, rely on exceptions, or assume patching happened without checking.
Takeaway
Verify updated Defender engine and platform versions across endpoints, especially servers, legacy systems, and high-value Windows assets.
TL;DR
Microsoft patched two exploited Defender zero-days, including one that could grant SYSTEM privileges. The board-level question: can we prove every endpoint received the fix?
Further Reading
Turn AI into Your Income Engine
Ready to transform artificial intelligence from a buzzword into your personal revenue generator?
HubSpot’s groundbreaking guide "200+ AI-Powered Income Ideas" is your gateway to financial innovation in the digital age.
Inside you'll discover:
A curated collection of 200+ profitable opportunities spanning content creation, e-commerce, gaming, and emerging digital markets—each vetted for real-world potential
Step-by-step implementation guides designed for beginners, making AI accessible regardless of your technical background
Cutting-edge strategies aligned with current market trends, ensuring your ventures stay ahead of the curve
Download your guide today and unlock a future where artificial intelligence powers your success. Your next income stream is waiting.
🧩 GitHub confirms breach of 3,800 repos via malicious VS Code extension
Intro
GitHub confirmed that roughly 3,800 internal repositories were exposed after an employee installed a malicious VS Code extension. Developer tooling had another “trust me bro” moment, and this one came with source code exposure.
What Happened
GitHub said the incident involved a compromised employee device and a poisoned VS Code extension tied to the Nx Console and TanStack npm supply-chain activity. The company removed the malicious extension, isolated the endpoint, and began incident response. GitHub said the attacker’s claim of about 3,800 exposed internal repositories was directionally consistent with its investigation. It found no evidence that customer data stored outside those repositories was impacted.
Why It’s Important
This is a software supply-chain story disguised as a developer productivity problem. Extensions, packages, plugins, and build tools are now part of the attack surface. The lesson is not to ban every extension and retreat to a cave. It is to govern developer tooling with the same seriousness as SaaS apps and cloud identities.
The Other Side
GitHub moved quickly and said the breach was limited to internal repositories. That helps, but source code exposure still carries second-order risk. Internal code can reveal architecture, secrets hygiene, tooling patterns, and future exploit paths. The attacker may not have stolen the crown jewels, but they may have stolen the map to the vault.
Takeaway
Maintain allowlists for high-risk extensions, monitor installs, review repo access scopes, and assume poisoned developer tools are now a mainstream initial access path.
TL;DR
GitHub says about 3,800 internal repos were exposed after an employee installed a malicious VS Code extension. The modern software supply chain includes the tiny productivity plugins everyone forgot to govern.
Further Reading
The U.S. Department of Defense’s 1983 “Orange Book” helped define early trusted-computing standards, including security levels with names like C1, B2, and A1. Cybersecurity: making alphabet soup feel ominous since the Reagan years.Bring OOH Into the Modern Marketing Stack
AdQuick makes Out Of Home advertising approachable, measurable, and performance-focused. Designed for marketers at startups and large brands alike, it combines digital efficiency with real-world reach—so your campaigns always hit the mark.
🔥 Can’t Miss
🪪 How Storm-2949 turned a compromised identity into a cloud-wide breach
Microsoft detailed how Storm-2949 used social engineering and Self-Service Password Reset abuse to compromise a Microsoft Entra ID account, remove MFA methods, and register its own authenticator. From there, the actor expanded into Microsoft 365, Key Vault, Azure Storage, and SQL resources.
👉 Key takeaway: Identity compromise is cloud compromise. Review SSPR controls, MFA reset workflows, privileged roles, Key Vault access, and alerts for unusual management-plane changes.🔐 Hackers bypass SonicWall VPN MFA due to incomplete patching
Attackers exploited SonicWall Gen6 SSL-VPN appliances where organizations installed updated firmware but missed the required LDAP reconfiguration step. So yes, the patch was applied, but the vulnerability was still sitting there like a raccoon in a server room.
👉 Key takeaway: Patch completion must include post-patch configuration steps. For SonicWall Gen6, verify LDAP remediation, not just firmware version.🕳️ Europe dismantles VPN service used by cybercriminals to hide ransomware attacks
European authorities dismantled First VPN, a service investigators said was marketed to cybercriminals hiding ransomware, fraud, and other activity. Europol said investigators gained access to the service and obtained its user database, giving authorities leads on thousands of users.
👉 Key takeaway: Law enforcement keeps targeting cybercrime infrastructure, not just individual actors. Expect more disruption of bulletproof hosting, VPNs, proxy services, and criminal marketplaces.📊 Grafana refuses to pay ransom after codebase theft
Grafana Labs confirmed that an extortion group tried to blackmail the company after claiming to steal its codebase. Grafana refused to pay, citing FBI guidance that payment does not guarantee data will stay private or be destroyed.
👉 Key takeaway: Data theft extortion keeps moving beyond encryption. Organizations need playbooks for codebase exposure, communications, legal review, and customer trust before the ransom note arrives.
🤖 AI in Cyber
🧠 GTIG AI Threat Tracker: Adversaries leverage AI for vulnerability exploitation, augmented operations, and initial access
Google Threat Intelligence Group reported that adversaries are using AI for vulnerability research, exploit development, malware support, reconnaissance, social engineering, and information operations. AI is not replacing attackers. It is giving the competent ones a power tool and the mediocre ones a ladder.
👉 Key takeaway: Defenders should assume AI is already part of attacker workflows and prepare for faster exploit development, better recon, and more polished lures.🪖 Ukraine says Russia is deploying AI-powered malware on the battlefield
Ukraine warned that Russia’s AI use has expanded beyond propaganda into malware development and battlefield activity. The report describes AI-powered malware capable of generating malicious commands dynamically, alongside AI-assisted phishing, reconnaissance, and target analysis.
👉 Key takeaway: AI-enabled malware could make static detection less reliable. Emphasize behavior-based detection, command execution monitoring, and anomaly detection.🌐 Xi and Putin pledge closer cooperation on AI, cyberspace and satellite systems
China and Russia pledged deeper cooperation on AI, cybersecurity, internet governance, satellite internet, software development, and open-source initiatives. The statement fits a broader push to reduce dependence on Western technology and advance “internet sovereignty.”
👉 Key takeaway: Cyber risk is increasingly tied to geopolitical technology blocs. Track policy, software, cloud, telecom, and satellite dependencies through that lens.🏦 Experts warn of privacy risks as AI firms look to connect to financial accounts
The Record reported that OpenAI’s planned financial account connection features are raising privacy and cybersecurity concerns as AI platforms move closer to sensitive personal data. “Connect all your financial accounts to the chatbot” may be useful, but it deserves a full-body risk assessment.
👉 Key takeaway: AI personalization is becoming data concentration. Enterprises need rules for connecting work, financial, customer, or regulated data to AI assistants.
Your agent needs a database. Ghost gives it as many as it needs. Ephemeral, forkable, unlimited postgres, 1TB storage free. Try it at ghost.build.
🧟♂️ Strange Cyber📱 They Built a Legendary Privacy Tool. Now They’re Sworn Enemies
Intro
This week’s strange cyber story is not just “two founders had a falling out.” It is about a privacy-focused Android project where the feud involved deleted signing keys, online flame wars, lawyers, alleged subreddit lockouts, swatting, and a tool so private that even its own team can feel half-anonymous.
That is a lot of plot for a mobile operating system.
What Happened
CopperheadOS started as a hardened Android operating system built around serious mobile privacy and security. Daniel Micay handled much of the deep Android hardening work, while James Donaldson was the more public business figure trying to turn the project into a sustainable company.
Then things got weird. The project moved away from broad open-source access, Micay and Donaldson clashed over control and commercialization, and the fight eventually centered on CopperheadOS signing keys - the cryptographic keys needed to push trusted updates to devices. When the partnership collapsed, Micay reportedly destroyed the keys, saying he considered the company and infrastructure compromised.
Why It’s Important
That is the strange cyber part: this was not just a business breakup. Destroying signing keys meant CopperheadOS devices could no longer receive normal updates, leaving users stuck with a security tool that suddenly could not be securely maintained.
The story also spiraled beyond code. WIRED describes since-deleted tweets, forum battles, legal claims over whether Micay could even be fired, supporters picking sides, and Micay later being swatted multiple times. Privacy drama apparently does not come with a quiet mode.
The Other Side
There is no clean hero-and-villain version. One side emphasized open access, user freedom, and protecting the integrity of the code. The other emphasized sustainability, commercial viability, customer support, and keeping devices updated.
Both concerns are real. Free security tools need maintainers and funding, but privacy communities also run on trust. Once the fight became public, users were left watching the people behind a trusted privacy tool argue over who could control the castle keys.
Takeaway
Security leaders should treat open-source and privacy tools as strategic dependencies, not magic boxes maintained by invisible wizards. Governance, maintainer health, signing-key control, funding model, and community risk matter just as much as the technical feature list.
TL;DR
GrapheneOS grew out of the collapse of CopperheadOS after a fight over ownership, openness, money, and control of the signing keys. The weird part is that a privacy tool feud turned into destroyed update keys, public internet warfare, litigation, swatting, and eventually a stronger successor project with an origin story that reads like cyberpunk family court.
Further Reading
Enjoying Exzec Cyber? Forward this to one person who cares about staying ahead of attacks
Hate everything you see or have other feedback? Reply back to this email!