Today’s digest is a reminder that the attack surface keeps growing in directions defenders don’t fully control yet — an AI agent framework doing the exploitation, a pharma giant’s third-party cloud vendor, a hypervisor’s management plane, and a shared ad script running on thousands of sites you don’t operate. Here’s what changed since yesterday’s digest.
AI threat watch: a China-based actor wires DeepSeek into an open-source agent framework to run exploitation autonomously
Unit 42 (Palo Alto Networks) published research on a threat actor tracked as knaithe/KnYuan, assessed to be operating out of Zhuhai, China, who connected the DeepSeek model to the open-source Hermes Agent framework to build a functional scan-research-exploit pipeline. Once the operator sent a single command over Telegram, the agent largely ran unattended — scanning, researching applicable exploits, and attempting compromise on its own. The campaign targeted more than 460 systems across seven exploit tracks spanning eight CVEs, including a chain of CVE-2026-21858 and CVE-2025-68613, plus standalone exploitation attempts against Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), and the Windows IKE VPN stack (CVE-2026-33824). Unit 42 confirmed only three successful compromises out of roughly 460 attempts — memory exfiltration from Citrix NetScaler devices and a suspected session-hijacking attempt against a Malaysian government entity. Unit 42 · The Hacker News · BleepingComputer
The 3-in-460 success rate is the real headline: autonomous exploitation pipelines are cheap to run at scale but still fail against patched, monitored targets — which makes patch cadence on internet-facing Citrix, Tomcat, and VPN gateways more valuable than ever, not less.
Breach watch: Amgen discloses a material cloud breach exposing patient PHI and proprietary data
Amgen disclosed on July 31 that it detected unauthorized activity in July 2026 across multiple cloud environments operated by third-party service providers, and determined on July 29 that the incident was a material cybersecurity event under SEC rules. Threat actors exfiltrated proprietary company data along with patients’ protected health information. Amgen activated its incident response plan, engaged independent forensic investigators, and says it has found no impact to its products, manufacturing operations, or financial reporting systems so far. The investigation into scope and whether the intrusion is linked to ShinyHunters — the group behind a wave of cloud-tenant breaches this year — is ongoing. BleepingComputer
Once again, the breach didn’t touch the primary application — it hit a third-party cloud environment holding a copy of the data. If you’re a covered entity or handle PHI, your vendor risk register needs the same monitoring rigor as your own ClickHouse or S3 buckets, not a once-a-year questionnaire.
Vulnerability watch: Broadcom patches three critical VMware flaws, including a 9.8-CVSS vCenter auth bypass
Broadcom shipped patches on July 29 for three critical vulnerabilities across VMware ESXi, vCenter, Workstation, and Fusion. CVE-2026-59309 is an authentication bypass in vCenter’s VMware Directory Service, rated 9.8 on CVSS — the most severe of the three. CVE-2026-59310 allows an attacker with network access to vCenter to execute arbitrary code. CVE-2026-47876 is an out-of-bounds write in ESXi’s VMXNET3 virtual network adapter (CVSS 9.3) that lets an attacker with local admin on a guest VM escape to code execution on the host. Fixes landed in vCenter 9.1.0.0300, 9.0.2.0100, and 8.0 Update 3k, and in ESXi 9.1.0.0200, 9.0.2.0100, and 8.0 Update 3k. BleepingComputer · The Hacker News
vCenter auth bypass plus a VM-escape bug in the same release is a bad combination for anyone running multi-tenant virtualization — patch vCenter first given the 9.8 score and direct network exposure, then roll ESXi hosts. If you can’t patch immediately, restrict vCenter management network access to a jump host as a stopgap.
Supply chain watch: a poisoned Adform ad script hijacks cryptocurrency addresses on every site that embeds it
Security researcher Kevin Beaumont identified malicious code injected into trackpoint-async.js, a JavaScript tracking script served by ad-tech firm Adform from s2.adform.net and embedded on thousands of customer websites. The trojanized script polls the victim’s clipboard every three seconds; when it detects a Bitcoin, Ethereum, or TRON wallet address, it silently replaces it with an attacker-controlled address, so the malware keeps working even if a victim notices the swap and re-copies the original. The script also logs visitor IP addresses, the originating site, and URL path back to the attacker. Adform’s own notice identifies July 27 as the affected date; Beaumont said he observed the malicious activity for roughly a week before disclosure. The Hacker News · BleepingComputer
This is a client-side supply chain attack with no server-side signal to catch it — if any of your properties embed third-party ad or analytics tags, add clipboard-write and clipboard-read monitoring to your CSP/web telemetry, and treat every ad-tech script tag as untrusted third-party code that needs subresource integrity or sandboxing wherever the platform supports it.
Final thought
Three of today’s four stories share a root cause: a system built to be trusted by default — a third-party cloud environment, a hypervisor’s management API, a shared ad script — got compromised, and the blast radius ran straight through that trust relationship to everyone downstream. The fourth shows attackers are now automating the discovery of the next one. If you want help mapping which of your own vendor and third-party dependencies carry that kind of downstream exposure, see our how-to guides or book a discovery call.