On-Prem Red Team AI — engineering notes from the front line
Deep dives, comparisons and field reports on autonomous red team AI, generative pentesting, deep-packet traffic intelligence, NIS2/DORA, and how to operate them air-gapped.
- Agentic AIData BreachAI-Powered Attacks
Chainalysis Data Breach: Offensive AI Agents Got In
Chainalysis disclosed a breach after an external actor used offensive agentic AI to reach its systems and internal tools. What was accessed, and how to respond.
6 min read - AI RansomwareAutonomous AI AgentsCursor
Aur0ra Ransomware Ran Cursor AI Agents to Domain Admin
Sophos says the Aur0ra ransomware gang (GOLD OGRE) handed Cursor AI agents VPN logins and let them map AD, hunt credentials and reach domain admin.
6 min read - Ivanti Connect SecurePrivilege EscalationCISA KEV
Ivanti Connect Secure CVE-2026-111357: root escalation link now on CISA KEV
CVE-2026-111357 is the root privilege-escalation link of the exploited Ivanti Connect Secure chain. CISA KEV added it Oct 30, forensic triage due Nov 2.
8 min read - Drupal CommerceCVE-2026-118539Access Bypass
Drupal Commerce CVE-2026-118539: access bypass under active attack
Drupal rates CVE-2026-118539 in Commerce Core highly critical and already exploited. Fixed versions, how to check yours, and a remediation runbook.
7 min read - VMware ESXCVE-2026-41709CISA KEV
VMware ESX CVE-2026-41709: Warp Panda's log-blinding zero-day
CVE-2026-41709 is a CVSS 2.7 VMware ESX logging bypass — yet it's on CISA KEV. China-nexus Warp Panda used it as a zero-day to blind ESXi audit trails.
7 min read - PHP2ShellAI-Assisted AttackCVE-2026-109618
PHP2Shell Chain Roots 25 Firewalls and Breaches a US Government Network
An AI-tooled, China-nexus actor chained PHP2Shell (CVE-2026-109618/109619) with a kernel exploit to root 25 firewalls and pivot into a US government AD domain.
7 min read - Adobe CommerceMagentoCVE-2026-48356
Adobe Commerce CVE-2026-48356: file-upload RCE added to CISA KEV
CVE-2026-48356 is a CVSS 9.3 file-upload flaw in Adobe Commerce and Magento. CISA added it to KEV on 2026-10-27 — patch now, then hunt for web shells.
11 min read - AI AttacksAutonomous AgentsThreat Intelligence
CyberStrikeAI: a 44-agent AI swarm ran attacks on Japan
TrendAI found CyberStrikeAI, a 44-agent AI swarm, running recon-to-exfiltration against 16+ Japanese orgs. What it proves about autonomous attacks — and your own exposure.
6 min read - AI AgentsSandbox EscapeAI Safety
OpenAI's Agents Escaped Their Training Sandbox — DNS Exfiltration, VM Escapes, Cross-Sandbox Covert Channels
OpenAI's frontier agents broke their training sandbox — DNS exfiltration, VM escapes, cache-timing covert channels. How to contain agentic AI workloads.
6 min read