This was the week AI stopped being a story about attackers and started being a story about discovery. Microsoft's MDASH found 16 of this month's Windows bugs, four critical. Palo Alto pointed frontier models — including Anthropic's gated Mythos — at its own codebase and surfaced 75 flaws across 26 CVEs in a single scan. An autonomous AI spent six hours on NGINX and found a remote code execution bug that survived 18 years of human review. Germany's top cybersecurity official told lawmakers China is close to building an "AI superhacker" in secret. The capability to find and write vulnerabilities at machine speed is no longer theoretical.

Everything else this week sits in the shadow of that shift. Cisco shipped a CVSS 10.0 SD-WAN auth bypass under active exploitation by an actor that has been in this code since 2023. Mini Shai-Hulud reached two OpenAI employee laptops, forcing OpenAI to rotate every code-signing certificate it has — macOS users have until June 12. Comcast wrote a $117.5 million Citrix Bleed check, the first major bill for a vulnerability the victim didn't write.

Let's get into it.

Pipelines, backfills, sync lag, data drift… that's the cost of splitting your stack. Tiger Cloud extends Postgres, fully managed, so analytics run on live data. No second system. Stay on Postgres. Scale on Postgres.Try Tiger Cloud free.

Try Tiger Cloud free

AI Security

Three announcements in 48 hours marked the shift. Microsoft confirmed its MDASH agent found 16 vulnerabilities in May's Patch Tuesday, four critical. Palo Alto disclosed that scanning its codebase with frontier models — including Anthropic's gated Mythos system — surfaced 75 flaws across 26 CVEs in a single pass. An autonomous AI pointed at NGINX source code found an 18-year-old RCE in six hours, plus three more CVEs in the same session. These are production vendor disclosures crediting AI as the discoverer of record. Germany's top cybersecurity official simultaneously warned lawmakers that China is close to building an AI model with superhacking capabilities, developed in secret — landing a month after Anthropic gated Mythos.

Why it matters: The vulnerability economy is about to change shape. Defenders gain a powerful new tool — but every legacy codebase is now a target for the same scan. Expect a spike in CVEs against software that hasn't been seriously audited in a decade.

→ Read the full story

Vulnerabilities

CVE-2026-20182 is a maximum-severity authentication bypass in Cisco Catalyst SD-WAN, actively exploited as a zero-day by UAT-8616. The detail that matters: UAT-8616 is the same actor that has targeted this service since 2023. Three years of presence in a CVSS 10.0 path. CISA added the CVE to KEV the day Cisco shipped the advisory. There are no workarounds — the only remediation is the patch.

Why it matters: Three years of access to a critical edge service before public disclosure is the dwell-time story. If you run Catalyst SD-WAN, treat the environment as potentially compromised and audit accordingly, not just patch.

→ Read the full story

Cyber Attacks

OpenAI confirmed two employee devices were compromised in the Mini Shai-Hulud supply chain attack and that code-signing certificates for its apps were exposed. The response is the headline: OpenAI is rotating every code-signing certificate it holds, and macOS users must update OpenAI applications before June 12, 2026, or they will stop functioning. The supply chain campaign that started with TanStack has now reached a flagship AI vendor's signing infrastructure.

Why it matters: Code-signing certificates from a major AI vendor in attacker hands are a high-value asset for downstream malware operations. The June 12 deadline is hard — enterprises running OpenAI macOS apps need this in change management now.

→ Read the full story

Application Security

Three published versions of node-ipc — 822,000 weekly downloads — hid an obfuscated stealer backdoor that exfiltrated 90 categories of developer and cloud secrets over DNS. The novel access vector: the attacker took over a lapsed maintainer domain to claim the npm account and publish the malicious versions. DNS exfiltration sidesteps most outbound traffic monitoring; the categories span SSH keys, cloud provider credentials, GitHub tokens, package manager credentials, and crypto wallets.

Why it matters: Lapsed maintainer domains are a category of supply chain risk most organizations don't track. Audit your top dependencies for maintainers whose contact domains have expired, and enforce DNS egress controls on developer workstations — not just outbound HTTP.

→ Read the full story

Policy & Government

Comcast agreed to a $117.5 million settlement covering 35.9 million Xfinity customers whose data was exposed via the 2023 Citrix Bleed vulnerability — a flaw Comcast did not author. Roughly $10,000 per affected customer in aggregate. It is the first major shared customer-vendor liability ruling on a vulnerability outside the victim's control, and the precedent reaches every organization running third-party infrastructure with privileged session tokens.

Why it matters: Liability for vendor vulnerabilities is becoming priceable. Your contract language with critical infrastructure vendors — and your insurance carrier's view of session token exposure — both just shifted.

→ Read the full story

Threat Intelligence

CSO Online's framing this week — the "Developer Credential Economy" — captured a pattern three unrelated threat actors reached independently in March and April. The developer workstation has emerged as the highest-ROI initial access vector: it sits inside the perimeter, holds credentials for cloud, source control, CI/CD, and production, and is rarely instrumented with the same rigor as endpoint workstations. node-ipc, the OpenAI laptop compromise, the RubyGems signup shutdown, and three separate APT campaigns all hit this surface in 90 days.

Why it matters: If your endpoint program treats developer workstations like every other endpoint, it's under-investing in the access vector adversaries have now converged on. EDR coverage, credential vaulting, DNS egress controls, and dependency audit cadence all need a developer-specific tier.

→ Read the full story

You know the pain. Your AI builder ships something functional. Technically a website. But your customers can tell.

Readdy.ai generates designs that actually convert, with clean layouts, professional copy, real visual hierarchy, and distinct custom designs that don't look like AI.

Get a site that's as special as your business. Live in under 5 minutes.

Agency quality. DIY price.

Build your site for free.

There is a number worth sitting with from this week: 18.

That is how many years the NGINX rewrite-module remote code execution vulnerability sat in production code before an autonomous AI found it in six hours. NGINX runs roughly a third of the internet's top sites. The bug was not subtle in the way long-lived CVEs usually are — it was discoverable. It was just never discovered, because the cost of looking exceeded the value of finding, and that calculation depended on humans doing the looking. That calculation changed this week.

Microsoft's MDASH found 16 vulnerabilities in May's Patch Tuesday, four critical. Palo Alto pointed frontier models at its own codebase and surfaced 75 flaws across 26 CVEs in one pass. These are production vendor disclosures crediting AI as the discoverer of record. Two days later, Germany's top cybersecurity official told lawmakers China is close to building an AI model with superhacking capabilities, developed in secret. The same week, Kaspersky found a Kimsuky backdoor with comments that read as if written by an LLM.

The vulnerability economy has two sides, and both sides just got the same tool. The defender's AI scan and the adversary's AI scan are the same scan. Whichever side runs it first owns the finding. Every legacy codebase in production is now reachable in a way it was not last month — every third-party library, every internal tool nobody has touched in five years, every legacy authentication path that "works fine, leave it alone."

The accountability column moved in parallel. Comcast wrote a $117.5 million check over a Citrix Bleed vulnerability it did not author. The Cisco Catalyst SD-WAN actor has been in the code since 2023 — three years of dwell time across customer environments that did not know to look. The cost of a vulnerability you did not write, in a vendor environment you do not control, is being priced into settlement law in real time.

The question worth asking before next week's briefing: which dependencies in your environment have not been seriously audited in five or more years, and what is your plan for when an AI scan finds something in them — either yours or somebody else's?

Until next time,

Stay sharp. Stay ahead.

📩 Share this briefing with a colleague who needs to stay ahead.

📰 Full coverage at thecybersignal.com

☀️ Daily briefing at daily.thecybersignal.com