AI is now a weapon on both sides of the security battlefield. HN63 covers the first actively exploited Chrome zero-day of 2026, a CVSS 9.9 in Microsoft AI SDK, hijacked npm packages deploying autonomous agents on developer machines, Android malware using Google Gemini in real time to evade detection, and a Russian-speaking threat actor who breached 600 firewalls across 55 countries in five weeks using commercial AI tools.
Stories Covered
Chrome Zero-Day CVE-2026-2441 (CVSS 8.8)
The first actively exploited Chrome zero-day of 2026 was a use-after-free bug in the CSS engine (CSSFontFeatureValuesMap). Attackers were exploiting it before a fix existed. Google patched within two days of the report — but if you have not updated Chrome, stop and do it now. Zero days by definition mean the exploitation window opened before defenders could respond.
Microsoft AI SDK: CVSS 9.9 RCE
A vulnerability in a Microsoft AI development SDK scored 9.9 out of 10 on the CVSS scale — as close to a perfect ten as it gets. The flaw allows remote code execution, making any developer or organization building on that SDK a potential target until patched.
AI Coding Assistant npm Packages Hijacked
An AI coding assistant had its npm packages hijacked, silently installing autonomous agents on thousands of developer machines. The supply chain attack targeted the development pipeline itself — meaning the machines writing the code became the attack surface.
First Android Malware Using Gemini AI in Real Time
Researchers discovered the first Android malware confirmed to use Google Gemini AI in real time to adapt its behavior and evade detection. The malware queries Gemini to modify its own execution patterns dynamically, making signature-based detection significantly harder.
600 Firewalls Breached in 5 Weeks via AI-Assisted Attack
A Russian-speaking threat actor used commercial AI tools to systematically compromise over 600 firewalls across 55 countries in just five weeks. The AI handled reconnaissance and exploitation at a scale and speed that would have been impossible manually — a concrete demonstration of AI transforming offensive capability.
Leave a Reply