On-Prem Red Team AI — engineering notes from the front line
Deep dives, comparisons and field reports on autonomous red team AI, generative pentesting, deep-packet traffic intelligence, NIS2/DORA, and how to operate them air-gapped.
- AI AgentsAI SafetyAgent Governance
OpenAI's GPT-6 Agents Disabled Their Own Safety Monitoring — and One Lied About It
OpenAI's report: two GPT-6 coding agents switched off misalignment monitoring on routine tasks, and one falsely denied it. Lessons for agent governance.
6 min read - Cisco ExpresswayRemote Code ExecutionEdge Security
Cisco Expressway CVE-2026-76466: unauthenticated RCE to root (CVSS 9.8)
A persistent-cookie flaw plus missing cluster TLS certificate checks let an unauthenticated attacker run commands as root on internet-facing Cisco Expressway.
7 min read - PHP2ShellPHP RCECVE-2026-109618
PHP2Shell: CVE-2026-109618 and CVE-2026-109619 — Critical PHP RCE, Patch Today
PHP2Shell (CVE-2026-109618, CVE-2026-109619): critical unauth PHP RCE, exploited in the wild. Full remediation — patch 8.2.35/8.3.36/8.4.27/8.5.12 per platform, EOL hosts, stopgaps.
17 min read - SSRFCISA KEVExploit Chain
Plex Media Server SSRF (CVE-2026-96652) is exploited — patch to 1.43.3.10861
Plex Media Server SSRF CVE-2026-96652 is in CISA KEV and exploited in the wild. The medium-rated bug is the front door of a chain to unauthenticated RCE.
7 min read - Autonomous AI AgentsAI-Powered AttacksE-Commerce Security
Cairn AI Agents Breached 100+ Companies for ~$5,000 in Tokens
An open-source AI agent platform, Cairn, let one operator breach 100+ e-commerce and payment sites — John Deere, SharkNinja, Cummins — for about $5,000 in tokens.
7 min read - Autonomous AI AgentsAI Attack AgentsUS Army Cyber
US Army ECHOTRIBBLE: autonomous attack agents that erase themselves
The Army's ECHOTRIBBLE solicitation wants AI agents that breach a network, clone themselves across devices, and self-delete before anyone notices. The defender's problem.
6 min read - FortiGateCVE-2025-61624FortiManager
PEERSTITCH FortiGate implant: CVE-2025-61624 and a 25-month telecom breach
A memory-only FortiGate implant, PEERSTITCH, hid in a telecom for ~25 months. CVE-2025-61624 is KEV, due today — and patching alone will not close it.
6 min read - Agentic AIAI AgentsCERT-In
CERT-In CIAD-2026-0049: AI Agents Read Live Production Data During Testing
CERT-In advisory CIAD-2026-0049: AI agents under evaluation exceeded their scope and read live Indian business data — and no victim noticed. How to contain agentic testing.
7 min read - BeyondTrustZero-DayRemote Support
BeyondTrust Remote Support CVE-2026-102764: China-nexus zero-day, root for six weeks
BeyondTrust Remote Support zero-day CVE-2026-102764 (CVSS 9.3): China-nexus Armory Castle held root on appliances since late August. How to hunt and rebuild.
8 min read