Today’s Highlights
This week, defenders face new zero-day exploitation in the wild, rapid operations by state-linked actors, active exploitation of open-source AI platforms, and a new privilege escalation vector targeting high-end GPUs. Policy developments affecting encryption and enterprise tooling for AI security also shape operational risk. The major themes include: high-velocity attacks by advanced actors, urgent patching for exposed AI systems, hardware-based escalation through GPU flaws, evolving regulations undermining data privacy, and the growing need for prompt-injection controls in enterprise AI.
Top Stories
China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware
Source: The Hacker News | Risk: Critical | Impacted: Internet-facing servers, VPN concentrators, Firewalls with management interfaces exposed, Remote access gateways
A China-based threat actor known for deploying Medusa ransomware has been linked to the weaponization of a combination of zero-day and N-day vulnerabilities to orchestrate “high-velocity” attacks and break into susceptible internet-facing systems. “The threat actor’s high operational tempo and proficiency in identifying exposed perimeter assets have proven successful, with recent”
Why it matters: A China-based threat actor known for deploying Medusa ransomware has been linked to the weaponization of a combination of zero-day and N-day vulnerabilities to orchestrate “high-velocity” attacks and break into susceptible internet-facing systems. “The threat actor’s high”
Practitioner Perspective
Storm-1175 is actively combining zero-day and N-day vulnerabilities to breach internet-facing assets, deploying ransomware with high speed and precision. The operational tempo and targeting indicate a need for defenders to reduce their lag between disclosure and mitigation for perimeter devices. This group exemplifies the trend of state-linked actors exploiting unpatched infrastructure faster than many organizations can respond, with ransom operations following swiftly. If your patch management is slow or incomplete for perimeter assets, your risk posture is fundamentally outdated. The focus must be on closing the gap between vulnerability disclosure, asset discovery, and remediation.
Recommended Actions
- Immediately inventory and patch all internet-facing systems.
- Hunt for exploitation evidence targeting recent zero and N-day vulnerabilities.
- Review external attack surface with services like Shodan or Censys.
- Implement rapid vulnerability notification and triage workflows.
- Lock down management interfaces so they are not accessible externally.
Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12,000+ Instances Exposed
Source: The Hacker News | Risk: Critical | Impacted: Open-source AI deployments, Development and test environments, Organizations with Flowise on public IPs, AI/ML ops teams
Threat actors are exploiting a maximum-severity security flaw in Flowise, an open-source artificial intelligence (AI) platform, according to new findings from VulnCheck. The vulnerability in question is CVE-2025-59528 (CVSS score: 10.0), a code injection vulnerability that could result in remote code execution. “The CustomMCP node allows users to input configuration settings for connecting”
Why it matters: Threat actors are exploiting a maximum-severity security flaw in Flowise, an open-source artificial intelligence (AI) platform, according to new findings from VulnCheck. The vulnerability in question is CVE-2025-59528 (CVSS score: 10.0), a code injection vulnerability that
Practitioner Perspective
Unpatched Flowise AI instances are being actively exploited via a critical RCE, with over 12,000 exposed. This is a real-world failure scenario for organizations deploying open-source AI backends without strong security practices. When threat actors exploit a CVSS 10.0 bug in an application that processes user-supplied configuration code, compromise is often immediate and total. If your environment includes Flowise, assume hostile code execution and assess for lateral movement. The essential priority is to patch or remove public-facing instances without delay.
Recommended Actions
- Search for and immediately patch or isolate Flowise instances.
- Review logs for evidence of exploitation or rogue processes.
- Hunt for persistence or privilege escalation post-exploitation.
- Block external access to AI admin/config APIs.
- Update deployment processes to include ongoing patch management.
Emerging Signals
New GPUBreach Attack Enables Full CPU Privilege Escalation via GDDR6 Bit-Flips
Source: The Hacker News | Risk: High | Impacted: Workstations with high-end GPUs, Virtualized/cloud GPU workloads, Shared GPU compute environments, Research/HPC infrastructure
New academic research has identified multiple RowHammer attacks against high-performance graphics processing units (GPUs) that could be exploited to escalate privileges and, in some cases, even take full control of a host. The efforts have been codenamed GPUBreach, GDDRHammer, and GeForge. GPUBreach goes a step further than GPUHammer, demonstrating for the first time that
Why it matters: New academic research has identified multiple RowHammer attacks against high-performance graphics processing units (GPUs) that could be exploited to escalate privileges and, in some cases, even take full control of a host. The efforts have been codenamed
Practitioner Perspective
GPUBreach shows that high-performance GPUs are now an escalation vector via RowHammer-like attacks, allowing privilege escalation that crosses previously accepted trust boundaries. This matters for environments running shared workloads or those with physical access threats, as GPU memory corruption could potentially give attackers host-level control. Such attacks move privilege escalation risk away from only CPU DRAM and open new avenues in GPU-equipped environments. Teams need to reassess GPU usage within security architecture decisions, particularly for workstation, virtualization, and cloud offerings where GPUs are shared or accessible by untrusted users. The most urgent question is: does your threat modeling now need to include GPU-assisted privilege escalations?
Recommended Actions
- Identify systems with affected GPUs and assess use by untrusted processes.
- Review GPU driver and firmware update guidance for mitigations.
- Monitor for abnormal GPU memory access patterns via EDR/telemetry.
- Update security baselines to consider non-CPU memory corruption impacts.
- Segregate high-risk workloads from GPU-enabled hosts where possible.
Hong Kong Police Can Force You to Reveal Your Encryption Keys
Source: Schneier on Security | Risk: Medium | Impacted: Employees traveling to Hong Kong, Corporate users with encrypted devices, Multinational legal/compliance teams, Traveling journalists and activists
According to a new law, the Hong Kong police can demand that you reveal the encryption keys protecting your computer, phone, hard drives, etc., even if you are just transiting the airport. In a security alert dated March 26, the U.S. Consulate General said that, on March 23, 2026, Hong Kong authorities changed the rules governing enforcement of the National Security
Why it matters: According to a new law, the Hong Kong police can demand that you reveal the encryption keys protecting your computer, phone, hard drives, etc., even if you are just transiting the airport. In a security alert
Practitioner Perspective
The new Hong Kong law forcing disclosure of encryption keys is a stark reminder that legal access requirements can fundamentally alter your data security assumptions. This particularly impacts travelers, expats, and multinational organizations transiting or operating in Hong Kong, who must plan for compelled access to encrypted data at borders. In the broader context, defenders should track similar legislative trends globally that erode technical assurances for confidentiality and privacy. Operational security protocols, including guidance for employees and contractors, need to reflect this reality. The question is whether your data-at-rest encryption is now subject to compelled disclosure, and how your incident response plans account for this.
Recommended Actions
- Update travel security policies for staff transiting Hong Kong.
- Review business data storage and device encryption practices.
- Consider the use of minimal or clean devices for international travel.
- Engage legal and compliance on compelled access scenarios.
Exploits & CVEs
China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware
Source: The Hacker News | Risk: Critical | Impacted: Internet-facing servers, VPN concentrators, Firewalls with management interfaces exposed, Remote access gateways
A China-based threat actor known for deploying Medusa ransomware has been linked to the weaponization of a combination of zero-day and N-day vulnerabilities to orchestrate “high-velocity” attacks and break into susceptible internet-facing systems. “The threat actor’s high operational tempo and proficiency in identifying exposed perimeter assets have proven successful, with recent”
Why it matters: A China-based threat actor known for deploying Medusa ransomware has been linked to the weaponization of a combination of zero-day and N-day vulnerabilities to orchestrate “high-velocity” attacks and break into susceptible internet-facing systems. “The threat actor’s high”
Practitioner Perspective
Storm-1175 is actively combining zero-day and N-day vulnerabilities to breach internet-facing assets, deploying ransomware with high speed and precision. The operational tempo and targeting indicate a need for defenders to reduce their lag between disclosure and mitigation for perimeter devices. This group exemplifies the trend of state-linked actors exploiting unpatched infrastructure faster than many organizations can respond, with ransom operations following swiftly. If your patch management is slow or incomplete for perimeter assets, your risk posture is fundamentally outdated. The focus must be on closing the gap between vulnerability disclosure, asset discovery, and remediation.
Recommended Actions
- Immediately inventory and patch all internet-facing systems.
- Hunt for exploitation evidence targeting recent zero and N-day vulnerabilities.
- Review external attack surface with services like Shodan or Censys.
- Implement rapid vulnerability notification and triage workflows.
- Lock down management interfaces so they are not accessible externally.
Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12,000+ Instances Exposed
Source: The Hacker News | Risk: Critical | Impacted: Open-source AI deployments, Development and test environments, Organizations with Flowise on public IPs, AI/ML ops teams
Threat actors are exploiting a maximum-severity security flaw in Flowise, an open-source artificial intelligence (AI) platform, according to new findings from VulnCheck. The vulnerability in question is CVE-2025-59528 (CVSS score: 10.0), a code injection vulnerability that could result in remote code execution. “The CustomMCP node allows users to input configuration settings for connecting”
Why it matters: Threat actors are exploiting a maximum-severity security flaw in Flowise, an open-source artificial intelligence (AI) platform, according to new findings from VulnCheck. The vulnerability in question is CVE-2025-59528 (CVSS score: 10.0), a code injection vulnerability that
Practitioner Perspective
Unpatched Flowise AI instances are being actively exploited via a critical RCE, with over 12,000 exposed. This is a real-world failure scenario for organizations deploying open-source AI backends without strong security practices. When threat actors exploit a CVSS 10.0 bug in an application that processes user-supplied configuration code, compromise is often immediate and total. If your environment includes Flowise, assume hostile code execution and assess for lateral movement. The essential priority is to patch or remove public-facing instances without delay.
Recommended Actions
- Search for and immediately patch or isolate Flowise instances.
- Review logs for evidence of exploitation or rogue processes.
- Hunt for persistence or privilege escalation post-exploitation.
- Block external access to AI admin/config APIs.
- Update deployment processes to include ongoing patch management.
AI Security
The Download: AI’s impact on jobs, and data centres in space
Source: MIT Tech Review AI | Risk: Low | Impacted: IT and security risk managers, Organizations investing in AI-driven tech, Enterprise architects, Compliance/governance teams
This is today’s edition of The Download, our weekday newsletter that provides a daily dose of what’s going on in the world of technology. The one piece of data that could actually shed light on your job and AI. Within Silicon Valley’s orbit, an AI-fueled jobs apocalypse is spoken about as a given. Now even economists who have…
Why it matters: This is today’s edition of The Download, our weekday newsletter that provides a daily dose of what’s going on in the world of technology. The one piece of data that could actually shed light on your job
Practitioner Perspective
The piece contextualizes the ongoing debate about AI’s impact on jobs, with increased scrutiny on sectoral risk and real-world data to clarify actual exposure. While not an urgent threat vector, defenders responsible for workforce and technology planning should note that AI-driven changes to infrastructure, including the rise of large-scale or geographically distinct data centers, may introduce new attack surfaces or compliance challenges. As AI reshapes both the workforce and supporting technology architecture, security teams must anticipate changes in both insider risk modeling and operational dependencies. The most relevant question is: are the security implications of a shifting technology base being factored into your long-term risk strategies?
Recommended Actions
- Incorporate AI-driven infrastructure shifts into risk assessments.
- Monitor for new attack surfaces in emerging data center models.
- Assess changes in insider risk as workforce roles evolve.
- Update training and awareness for tech/AI-related staff.
Lockdown Mode
Source: OpenAI Help Center | Risk: Medium | Impacted: ChatGPT Enterprise administrators, Organizations with regulated data, High-risk user populations, Privacy/compliance teams
OpenAI documents Lockdown Mode as an admin-configurable setting that deterministically reduces prompt-injection-driven data exfiltration risk by disabling many network-enabled tools and capabilities for higher-risk users.
Why it matters: Operationally relevant control for enterprise ChatGPT deployments handling sensitive data or high-risk users exposed to prompt-injection exfiltration.
Practitioner Perspective
Lockdown Mode for ChatGPT Enterprise reflects growing recognition of prompt-injection as a serious enterprise data exfiltration risk. By disabling network-enabled tools for higher-risk users, admins gain a concrete lever to limit data exposure vectors in sensitive contexts. Security teams managing enterprise AI adoption should leverage such controls as part of a layered defense, particularly when internal users handle regulated or proprietary data in chat-driven workflows. The focus now should be on operationalizing these features and treating prompt-injection as a live threat, not a theoretical risk. The core takeaway is that prompt-injection defenses need to be configurable, mandatory, and auditable.
Recommended Actions
- Enable Lockdown Mode for sensitive users/workflows.
- Conduct a review of AI tool usage and exposure to prompt-injection.
- Update acceptable use policies to restrict risky workflows.
- Audit admin controls on AI-enabled platforms for coverage and logging.
Defensive Actions
- Immediately inventory and patch all internet-facing systems.
- Hunt for exploitation evidence targeting recent zero and N-day vulnerabilities.
- Search for and patch or isolate Flowise AI instances.
- Review logs for evidence of AI platform exploitation or rogue processes.
- Identify systems with affected GPUs and reconsider trust boundaries for GPU usage.
- Review GPU driver and firmware update guidance for mitigations.
- Update travel and device security policies for staff transiting jurisdictions with compelled decryption laws.
- Enable Lockdown Mode or equivalent controls for high-risk AI users and workflows.
- Audit external attack surfaces and restrict access to management interfaces and AI config APIs.
- Update deployment workflows for continuous patch management and monitoring of high-value systems.
What We’re Watching
- The speed at which state-linked threat actors weaponize and deploy new exploits against exposed services.
- The operational risk posed by hardware-level escalation vectors like GPUBreach in GPU-equipped infrastructure.
- Open-source AI platform vulnerabilities becoming widespread vectors for compromise if not managed vigilantly.
- Global legal trends requiring encryption key disclosure, impacting travel and cross-border business security.
- Expansion of enterprise admin controls to counter prompt-injection risk in AI-enabled workflows.
Categories: Artificial Intelligence, Cybersecurity Blog
Leave a Reply