SEC536: Adversarial AI - Penetration Testing AI Systems
SEC536Offensive Operations, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
Update WordPress Now to Fix Actively Exploited wp2shell Vulnerabilities
WordPress is urging users to update to WordPress 7.0.2 as soon as possible to address two actively exploited vulnerabilities affecting WordPress Core. Together they are known as wp2shell, and they can be chained to achieve unauthenticated remote code execution: a moderate-severity facilitated SQL injection vulnerability in the `author__not_in` parameter of `WP_Query` (CVE-2026-60137), and a critical REST API batch-route confusion and SQL injection issue leading to remote code execution (CVE-2026-63030). WordPress notes that "due to the severity, the WordPress.org team have enabled forced updates via the auto-update system for sites running affected versions." WordPress has also backported updates for older versions. WordPress 6.9 and the beta version of WordPress 7.1 are both affected by wp2shell, but the issues have been fixed in WordPress 6.9.5 and WordPress 7.1 beta2. WordPress 6.8 is affected only by CVE-2026-60137, and the issue has been addressed in WordPress 6.8.6. WordPress versions older than 6.8 are not affected. The vulnerabilities were detected by researchers at Searchlight Cyber.
Editor's Notes
- Slide 1 of 4
This is not another WordPress extension issue. A minimum WordPress default install is vulnerable by default. You MUST fix this problem now, and you MUST assume compromise if you patched on Monday or later. We do see attackers deploying webshells via this exploit and adding additional administrative users to maintain persistent access, even after you have applied patches.
- Slide 2 of 4
There are still a significant number of sites on the internet running WordPress. If you have not updated, you should check. Automatic (the company behind WordPress) has enabled forced Automatic Updates, but I recommend checking anyway. If you are behind a properly configured WAF, you may have some protection, but patching is still recommended. It may also be a good time to consider changing your strategy. For many “Static” sites that have a CMS to help marketing, I have always recommended that you create a system where the marketing team can use the WordPress backend to make site changes, but some type of process converts it into a Static HTML + JavaScript site that eliminates the need for an entire application stack to manage websites that may be just static.
- Slide 3 of 4
You need to get to WordPress 7.0.2. WordPress has enabled forced updates to 7.0.2, or you can use the "Update Now" option on your WP dashboard. The good news is that the fixes have been backported to 6.9.5, 6.8.7 and even the beta, but as this is being targeted, you really don't want to keep track of where it is and isn't fixed. Just move forward.
- Slide 4 of 4
Most recent WordPress vulnerabilities have stemmed from third-party plugins, but this core flaw leaves no workaround other than updating. WordPress enabling auto-updates is a great protective measure, but duty of care dictates that teams still manually confirm the patch completed successfully.
Slide 1 of 0- Slide 1 of 4
Hugging Face Discloses Breach, Recommends Defenders Prepare Forensic AI
Hugging Face, a US-based platform for machine learning development and resources, has published a blog post disclosing a cyber intrusion into its production infrastructure that the company believes was carried out using autonomous agentic AI. Hugging Face's AI-assisted detection observed the anomalous signs of compromise, and further LLM log analysis determined that the attacker had "unauthorized access to a limited set of internal datasets and to several credentials." Investigation revealed that the attacker abused dataset processing code execution paths to cause a processing worker to run code from a malicious dataset, and then escalated to node-level access, stole credentials, and moved laterally into internal clusters. The attack involved "executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services," which suggests to Hugging Face that it was performed by an autonomous agent framework "built on an agentic security-research harness." The company responded by closing the vulnerable execution paths, removing the attacker's persistence and rebuilding compromised nodes, and rotating credentials and tokens, and augmenting security with improved guardrails, admission controls, and detection and alerting. Users should rotate their access tokens and check for unusual account activity. The blog post also notes that the guardrails on commercial AI models prohibited forensic investigation of the attack commands, payloads, and C2 artifacts, so Hugging Face used an open-weight model to conduct log analysis; the company recommends that defenders "have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment."
Editor's Notes
- Slide 1 of 5
Very interesting story. If you read only one piece in this issue of NewsBites in detail, let it be this one. It’s a glimpse of what many organizations will soon face: vulnerabilities exploited via data set processing for AI systems, lateral movement through cloud and cluster, all orchestrated by AI utilizing a swarm of agentic attack systems with command-and-control dynamically migrating through various public services. Yeah… Go ahead and read that sentence again. People have been predicting this for some time, but it’s arrived and it’s worth notice. It’s also noteworthy that Hugging Face had to use open-weight models to help handle the incident when they got refusals from the frontier models, which refused to help because they falsely thought ill-intent from the incident handlers. I am sure many AI-enabled cybersecurity tools and playbooks would break if fickle frontier models start giving errant refusals like this. This attack is a game changer on so many levels.
- Slide 2 of 5
With AI assisting attacks, you're going to be leveraging AI to forensicate them. Drill down on the preparation needed for forensics without guardrail lockout. You want to make sure that your AI used for forensics is on your own infrastructure so it doesn't let any of the attack commands, credentials, or other data leave your environment, and that you're using a model which will actually allow the needed analysis to be done. You want that all in place and tested now, ahead of the incident.
- Slide 3 of 5
The AI aspect of this one gets clicks and points out critical near-term future needs, while the "…unauthorized access to a limited set of internal datasets and to several credentials" indicates essential security hygiene improvements to be done immediately. Note the first step for Hugging Face was "closing the vulnerable execution paths." On the AI side, use this one to make sure security-AI-trained cybersecurity staff are part of AI projects early on.
- Slide 4 of 5
It looks like the defenders are working hard to use AI to forensically find the attackers faster. If you have not seen the Protocol SIFT project by SANS, I highly recommend you keep an eye on it. It is also fascinating to see that the team was hindered by the frontier model to do forensics, so they switched to an Open Weight model (GLM-5.2).
- Slide 5 of 5
So-called guardrails are at best post hoc attempts to add security on to already fragile systems. History suggests that this is not likely to be very effective.
Slide 1 of 0- Slide 1 of 5
Browsers: Firefox and Chrome Will Move to Two-week Update Cycles in September
Earlier this month, Firefox announced that it will move to a two-week update cadence starting in September 2026. The experimental arrangement is intended to make completed fixes available sooner while providing a predictable release process. Firefox currently releases scheduled updates every four weeks. The Firefox Release Calendar indicates that Firefox 153 is scheduled for release on July 21, Firefox 154 on August 18, and Firefox 155 on September 1. Earlier this year, Chrome also announced that it plans to move to a two-week update cadence starting in September 2026. Last week, Google released an unscheduled update to the Chrome stable channel for desktop. Versions 150.0.7871.128/.129 for Windows and Mac and 150.0.7871.128 for Linux address seven security issues: three critical use-after-free vulnerabilities, three high-severity use-after-free vulnerabilities, and one high-severity out of bounds read vulnerability.
Editor's Notes
- Slide 1 of 6
This is a good experiment. Some people predict a massive increase in vulnerabilities, which, in theory, would not be remediated by merely a 2x increase in patching cadence by the vendor. Let's revisit this in 90 days and see how well Firefox is managing and whether discovery of their issues, their exploitation, and resulting damage has increased ... or not.
- Slide 2 of 6
Make it a habit to restart your browser once a day, and if your browser isn’t centrally managed, check for updates once a week. Browsers are pretty good at auto-updating, but a restart may be required for the update to take effect.
- Slide 3 of 6
You should already be in at least a weekly update mindset for browsers. Restarting browsers Monday morning, while the coffee is brewing, before you get rolling for the day, isn't a bad habit to cultivate. While you're reading this, go check your browser to see if it needs an update. Firefox is a bit more subtle on needed updates, so it's easy for users to overlook.
- Slide 4 of 6
Faster Patches for browsers make a lot of sense as we are seeing other vendors start to talk about semi-monthly patch releases, at least for the time being. It would be interesting to see how quickly large companies can adapt. I would argue that smaller companies can patch their systems more quickly because they have fewer systems and less complexity. Larger organizations will be where I look at how they handle it.
- Slide 5 of 6
The cloud-based apps accessed by those browsers are often updated more frequently than the browsers have been. Moving to biweekly (or even weekly) after VM-based testing should be low risk by now.
- Slide 6 of 6
Whether this is a case of 'keeping up with the Joneses' or simply taking the opportunity to reduce feature debt, any release that packs in security updates is a clear win, especially since updating the application is straightforward for users.
Slide 1 of 0- Slide 1 of 6
The Rest of the Week's News
FortiSandbox Critical Flaws Added to CISA KEV
On July 16, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added two critical flaws in Fortinet FortiSandbox to its Known Exploited Vulnerabilities (KEV) catalog, with a three-day remediation deadline for Federal Civilian Executive Branch (FCEB) agencies. The flaws allow an attacker to execute unauthorized code or commands through OS command injection using crafted HTTP requests, and both carry CVSS score 9.8. CVE-2026-39808 affects Fortinet FortiSandbox 4.4.0 through 4.4.8, and CVE-2026-25089 affects FortiSandbox 5.0.0 through 5.0.5, 4.4.0 through 4.4.8, all versions of 4.2, FortiSandbox Cloud 5.0.4 through 5.0.5, and FortiSandbox PaaS 5.0.4 through 5.0.5. Fortinet released fixes for the former flaw on April 14, and for the latter on June 9. In mid-June, security provider Defused reported via social media that it had observed exploitation of these two flaws and CVE-2026-39813, a CVSS 9.8 FortiSandbox path traversal flaw that has not been added to the KEV. Fortinet has not commented on the exploitation.
Editor's Notes
- Slide 1 of 3
Ouch! Another bad week for Fortinet, this time in a sandbox product no less. A CVSS of 9.8 is no small matter. I am really hoping that Fortinet cleans up their code via exhaustive use of AI source code analysis quickly. There’s a lot of attack surface there and major vulnerabilities.
- Slide 2 of 3
Its inclusion in the KEV catalog is vital, but given that fixes were released 2 to 4 months ago, waiting for a formal directive underscores a failure to meet basic duty-of-care expectations by affected FCEB agencies.
- Slide 3 of 3
Insufficient input sanitization raises its ugly head again. These attacks can be carried out remotely without authentication. While you could get caught up in the argument of the exploits being active or not, this is a malware evaluation sandbox, which could be leveraged to better understand attacks you're analyzing or to become a pivot point into your network. The fixes were released in mid-June, so this should be a been-there, updated-that conversation when you ask.
Slide 1 of 0- Slide 1 of 3
Abbott Labs Subsidiary Breached
On July 16, 2026, Fortune 500 healthcare company Abbott Laboratories disclosed a cyber incident in which a threat actor accessed legacy internal systems belonging to Exact Sciences, a cancer diagnostics business Abbott acquired in March. The company engaged third-party cybersecurity experts and contacted law enforcement after learning of the intrusion, and is continuing to investigate. Abbot states that there is no impact to its services, nor to "business operations, product or product availability, [or] manufacturing or lab operations," and that the impacted systems are separate from Abbott's own systems. Abbott does not believe that the breach will have a material impact on business or finances, and the company did not mention the incident in its 8-K filing the same day. When BleepingComputer contacted Abbott about a separate alleged breach involving the LabCentral customer portal, the company confirmed its awareness of a "potential" incident, but stated that the platform "houses publicly available technical product reference documents, including operating manuals, troubleshooting checklists and product specifications, and does not contain proprietary/sensitive customer or business information."
Editor's Notes
- Slide 1 of 2
Healthcare continues to be a (successful) target for attackers, and we need to help change that. The ShinyHunters gang is taking credit for the Abbott labs breach. While healthcare providers are getting better at response, remediation, and containment, they are still not able to offset the determined attackers wishing to leverage their sensitive or confidential data. Supply chain (third-party) and BEC top the list of successful attack vectors, meaning that you can't stop at technical measures needed to secure the supply chain; you have to continue to the soft squishy human side of phishing awareness/prevention.
- Slide 2 of 2
Abbott’s response essentially boils down to “move along, nothing to see here.” Downplaying the event aside, this incident highlights a critical lesson: Cybersecurity due diligence must be a standard component of any M&A strategy. Without it, acquiring companies inherit unmitigated risks and the significant financial liabilities of post-incident response.
Slide 1 of 0- Slide 1 of 2
Patient Data Stolen in Partnered Health Breach
Australian healthcare provider Partnered health has acknowledged a breach that resulted in the theft of patient data from more than 20 clinics across the country. In a statement on its website, Partnered Health writes that it became aware of the incident on June 23, 2026. An investigation has determined that the stolen data include names, addresses, contact information, Medicare numbers, private health insurance or Veteran Card (DVA) numbers, concession card numbers, medical information, and treatment details, including consultation notes, referral letters, and pathology or diagnostic results. partnered Health has notified individuals affected by the breach. The investigation is ongoing. The breach occurred just a week after a June 18 announcement that UK healthcare and insurance company Bupa is acquiring Partnered Health.
Editor's Notes
- Slide 1 of 2
Nice breach disclosure notice from Partnered Health, including good advice we all could leverage to protect personal information. Save that notice as template just in case. While it's not clear if this will derail the planned merger/acquisition by Bupa, it does signal a need for a comprehensive cybersecurity strategy to protect sensitive patient information and maintain patient trust.
- Slide 2 of 2
While there is extensive media coverage of this breach, it all appears to have come from Partnered Health's release, and is silent on how the breach took place. My bet is on passwords.
Slide 1 of 0- Slide 1 of 2
Ernst & Young Notifies Clients of Data Theft Following Breach of Third-Party IT Ticketing System
Auditing and professional services provider Ernst & Young (EY) has begun notifying clients about a cybersecurity incident that resulted in the compromise of the clients' personal and financial information. The breach occurred on the system of a third-party information technology service management platform, and support tickets submitted through that platform may contain documents that include EY client tax information. EY detected anomalous activity on the platform on April 23, 2026. The company brought in an external cybersecurity firm to help with an investigation, which determined that an unauthorized party had access to the system between March 28, 2026 and April 12, 2026 and downloaded EY client documents containing data used to prepare tax filings. The investigation has also confirmed that "the unauthorized access has been stopped and [EY] systems are now secure."
Editor's Notes
This is an excellent opportunity for a lessons learned story we can all leverage. Not throwing E&Y under the bus here — it shows a third-party compromise can happen to any of us, but they are well positioned to talk about what did and didn't work and provide guidance we can all learn from, if they are willing to share. In the meantime, check for new third-party integrations, particularly AI-related ones, to ensure your security controls are in place, to include monitoring, incident response, strong (phishing-resistant) authentication, and adequate data protection. Keep in mind not only prevention of lateral movement/interconnected system access, but also what can be done solely with your information in that system.
Romania's Land Registry is in the Process of Restoring Services Following Cyberattack
Romania's National Agency for Cadastre and Land Registration (ANCPI) has disclosed that a cyberattack took down its e-Terra cadastre and land registry app. "The outage disrupted online land registry services, official email systems, and applications used by notaries, lawyers, cadastral specialists, and ANCPI employees, preventing authorities from registering new property transactions or processing existing requests." The incident has disrupted real estate transactions in the country for nearly a week. ANCPI notes that the incident did not compromise its technical and legal databases, which store information about property boundaries and legal ownership. The agency is migrating its applications to the Government Cloud, a process that is expected to be complete by Wednesday, July 22. At that time, "the applications and data will be verified by the authorized institutions, which will prepare a report on the status of the systems and any additional measures required. Depending on the conclusions of this report, ANCPI will be able to communicate the estimated deadline for the resumption of the operation of the applications. Their re-operation will be carried out in stages, depending on operational priorities."
Editor's Notes
- Slide 1 of 3
This feels a lot like less secure legacy applications slated to be migrated to new more secure services being tipped before that happened, resulting in an accelerated migration. Let's get real: in a large/bureaucratic environment, getting the go-ahead for such a migration can be difficult without a really good reason to accept the risks. This compromise is one of those really good reasons. If you're still not making headway, downshift into increased protections, WAF, monitoring, segmentation, phishing resistant authentication, etc.
- Slide 2 of 3
Despite sparse details on the breach, two facts are telling: the attack relied on unpatched, publicly warned vulnerabilities, and required minimal technical complexity. The Land Registry appears to have fallen short on baseline cyber hygiene and duty of care, reinforcing why moving the application to the Government Cloud is the right risk mitigation strategy.
- Slide 3 of 3
Consider plans, programs, and processes to restore mission critical system in hours to days.
Slide 1 of 0- Slide 1 of 3
Cyber Incidents Reported to Regulators: Craneware and Fairlife
UK-based Craneware plc has filed a statement with the London Stock Exchange disclosing "that it has identified and is responding to a cyber security incident involving unauthorised access to a subset of its data environment." Craneware says intruders accessed and exfiltrated "a significant volume of file names ... as well as a subset of customer and partner records." According to Craneware, the attackers no longer have access to company systems, and investigation is ongoing. The incident has been reported to the UK Information Commissioner’s Office and to the US Federal Bureau of Investigation (FBI). Craneware provides healthcare billing software that is used in thousands of US hospitals. In a July 16 filing with the US Securities and Exchange Commission (SEC), the Coca-Cola company disclosed that its Fairlife dairy subsidiary experienced a ransomware attack that affected Fairlife's production-related systems. The incident has prompted Fairlife to temporarily suspend production operations in the US, but Fairlife's Canadian facilities are not affected. Fairlife has launched an investigation with the assistance of third-party advisers and cybersecurity experts.
Editor's Notes
If you're wondering how UK-based Craneware could impact US hospitals, clinics, and pharmacies, it's because they provide billing, pharmacy, and accounting software. In addition, when they acquired Florida-based Sentry (which makes pharmacy software) in 2021, that included 147 million patient records. They have about 2,000 US Hospitals as customers, and on the order of 10,000 clinics and pharmacies. As yet, nobody is taking credit for the attack, and there is not a lot you can do here except to ensure your ID/credit monitoring is cutting the mustard.