defensive-playbook news, stories and analysis

Bar chart showing AI code review pass rates for image-based secret theft. Claude Code refused the attack 100 percent of the time across ten runs. Cursor and Antigravity leaked the .env file 100 percent of the time under Sonnet, Gemini, and GPT-5.5.

Ghostcommit weaponizes images to steal secrets from AI agents

Ghostcommit is a prompt injection attack that hides malicious instructions inside PNG files in pull requests. It exploits a blind spot in AI code reviewers to steal .env secrets, exposing a critical new attack surface for teams shipping with coding agents.

Lars Cornelissen · Jul 13, 2026

Abstract data visualization of ShareFile Storage Zone Controllers response urgency at 5 on a 1 to 5 scale, the highest level, compared to prior Progress incidents MOVEit Transfer and MOVEit Automation at 4.

Cyber security

ShareFile Storage Zone Controllers shut down, no patch yet

ShareFile Storage Zone Controllers are on-prem servers Progress ordered shut down on July 10 over a credible threat with no patch available.

Lars Cornelissen · Jul 11, 2026

AI coding agent malware chain with 3 hidden indirection steps and 1 runtime DNS payload outside the GitHub repo.

Cyber security

AI coding agent malware hides in clean GitHub repos

AI coding agent malware can hide behind a clean repo. Lock down setup execution, DNS egress, and agent permissions before rollout.

Lars Cornelissen · Jun 29, 2026

AutoJack exposure chart showing one malicious page, three chained weaknesses, zero stable PyPI releases affected, and one GitHub hardening commit.

Cyber security

AutoJack makes AI agent prototypes a real RCE risk

AutoJack is a host RCE warning for AI agent prototypes: one malicious page chained three AutoGen Studio weaknesses into command execution.

Lars Cornelissen · Jun 23, 2026

FortiBleed exposure bars showing CISA at about 74,000 Fortinet devices and SOCRadar at 86,644 compromised FortiGate access points.

Cyber security

FortiBleed puts FortiGate credentials on the clock now

FortiBleed is an active FortiGate credential exposure campaign with up to 86,644 devices reported. Rotate, isolate, and investigate now.

Lars Cornelissen · Jun 21, 2026

Fortinet credential exposure chart comparing 87,000 FortiGate SSL VPN devices in 2021 with approximately 74,000 Fortinet devices in 2026 FortiBleed reports.

Cyber security

Fortinet credential exposure needs a reset plan now

Fortinet credential exposure means about 74,000 edge devices may have leaked logins. Rotate, audit, and lock down FortiGate access now.

Lars Cornelissen · Jun 20, 2026