This week had a very clear theme.
Attackers didn’t need to break through the front door.
Too many systems simply left it open.
We watched authentication bypasses turn enterprise software into public attack surfaces. We watched exposed servers remain online after patches were released. We watched ransomware move from encryption into data theft and extortion. And, once again, AI infrastructure proved that giving a server access to models, cloud credentials and powerful automation tools without securing the server underneath is a spectacularly bad idea.
The vulnerabilities were different.
The technologies were different.
The pattern was not.
Too many systems trusted requests they should have rejected.
The Week’s Biggest Problem Wasn’t AI
AI got plenty of attention.
And for good reason.
Bugstoday covered attacks against AI infrastructure, AI coding agents running attacker-controlled code, AI systems being targeted for cloud credentials and API keys, and the increasingly uncomfortable reality that AI can help attackers speed up research and operations.
But AI wasn’t actually the biggest security problem of the week.
The same old failures were.
Authentication.
Authorization.
Exposure.
Patching.
Asset management.
The boring stuff.
An AI server with a stolen API key is still just a compromised server.
An AI coding agent executing attacker-controlled code is still a supply-chain problem with a smarter victim.
And a management platform that can be reached without proper authentication is still doing exactly what insecure software has done for decades.
It is giving attackers a shortcut.
The technology changes.
The mistakes survive.
The Internet Is Still Full of Things That Shouldn’t Be There
This week also delivered a familiar reminder.
A patch does not remove a vulnerability from the Internet.
Administrators do.
Nearly 22,000 Microsoft Exchange servers were still exposed while public exploit material was available. PaperCut vulnerabilities moved beyond scanning into real intrusion activity and data theft. Attackers continued to hunt enterprise infrastructure that had already been identified as vulnerable.
That gap between “a patch exists” and “the system is patched” remains one of the most reliable attack surfaces on the Internet.
Security vendors can publish an advisory.
Researchers can publish technical details.
CISA can add a vulnerability to KEV.
None of it matters to the machine sitting online with the old version.
The exploit doesn’t need to beat the patch.
It just needs to find the organization that hasn’t installed it yet.
The Management Layer Is Becoming an Attack Multiplier
This week’s newest CVEs pushed another uncomfortable lesson to the surface.
Attackers increasingly don’t need to compromise every machine.
They just need to compromise the machine that manages the machines.
ASUS Control Center Enterprise demonstrated how ugly that can get.
Unauthenticated access.
SSRF.
Key exposure.
SSH.
Hardcoded credentials.
Root.
IBM Operational Decision Manager showed another version of the same story: an SQL injection that can move beyond the database and end with a web shell.
These are not ordinary bugs with limited blast radius.
These systems sit in places where they make decisions, manage infrastructure or connect important parts of an organization.
Compromise one control point.
Get closer to everything behind it.
That’s the part defenders should be thinking about.
The next major breach may not start with malware on an employee laptop.
It may start with the server that was supposed to manage the laptops.
AI Infrastructure Is Still Running With Too Much Trust
We also spent the week writing about AI infrastructure.
Again.
Not because AI vulnerabilities are magically different.
Because the consequences are becoming more interesting.
AI systems increasingly have access to:
- cloud accounts;
- API keys;
- internal documents;
- databases;
- automation tools;
- source code;
- production infrastructure.
Attackers noticed.
They are not trying to “hack the AI” for philosophical reasons.
They’re trying to steal whatever the AI server can reach.
Langflow exploitation showed attackers looking for credentials and cloud access.
AI infrastructure attacks showed servers being abused for shells and crypto mining.
GitSpawn demonstrated how a malicious repository could potentially turn an AI coding agent into the thing executing attacker-controlled code.
And Aim reminded everyone that an ML tracking server is still a network service that needs authentication.
The model might be intelligent.
The deployment around it often isn’t.
Data Is Becoming the Ransom
Ransomware is changing its sales pitch.
Encryption still hurts.
But stolen data creates a different kind of pressure.
This week brought stories involving court records, driver’s license scans, healthcare information and threats against organizations facing extortion deadlines.
The uncomfortable reality is that many modern attacks don’t need to destroy a system to create a crisis.
Copy the data.
Prove you have it.
Wait.
The victim now has a problem that backups can’t solve.
That changes how organizations need to think about incident response.
“Can we restore the files?” is no longer enough.
The more important question may be:
What did the attacker take before we noticed they were there?
The Thomson Reuters C-Track incident made that painfully clear. A third-party platform became the point of compromise for highly sensitive court-related data, showing once again that an organization’s security boundary extends wherever its data is stored or processed.
Supply Chains Are Still Doing the Attackers’ Work
One of the oldest lessons in security keeps returning because we keep ignoring it.
You don’t always need to attack the target directly.
Attack something it trusts.
This week brought more poisoned packages, malicious repositories, compromised dependencies and software ecosystems that turned trust into an attack vector.
The supply chain is attractive because defenders tend to trust it by default.
A package comes from a repository.
A dependency comes from a familiar ecosystem.
An update comes from a vendor.
A repository looks legitimate.
An AI agent sees code and starts working with it.
Trust moves faster than verification.
Attackers know that.
So What Was the Biggest Story of the Week?
Not one CVE.
Not one ransomware gang.
Not one AI model.
The biggest story was the collapse of the old assumption that attackers need to break in.
More and more often, they don’t.
They find:
an exposed service.
an authentication bypass.
a forgotten server.
a public exploit.
a poisoned dependency.
a stolen session.
a management platform with too much power.
an AI server full of credentials.
And then they walk through the gap.
Bugstoday Opinion
The cybersecurity industry loves complicated stories.
Nation-state hackers.
AI-powered attacks.
Zero-days.
Advanced persistent threats.
And yes, those stories matter.
But this week once again showed that the Internet’s most reliable vulnerability remains painfully ordinary.
We keep building powerful systems and trusting them too much.
We trust that the management server is internal.
We trust that someone installed the patch.
We trust that the dependency is safe.
We trust that the AI tool only sees friendly code.
We trust that authentication exists because the interface has a login page.
Attackers don’t share that trust.
They test it.
And when the system fails the test, they don’t need a Hollywood hacking montage.
Sometimes they just send the request.
Sometimes they just run the public exploit.
Sometimes they just log in with credentials somebody hardcoded years ago.
This week wasn’t about one catastrophic vulnerability.
It was about hundreds of small decisions that created the same outcome.
The attack surface is getting bigger.
AI is making research faster.
Infrastructure is getting more connected.
Supply chains are getting deeper.
And the window between disclosure and exploitation keeps shrinking.
Defenders don’t need to predict every attacker.
They need to stop making the attacker’s first step so easy.
Because this week, more than anything else, proved one thing:
The attackers stopped knocking.
They discovered the door was already open.
Today’s Bugs. Tomorrow’s Breaches.
