Stories This Week
- Top Story — TeamPCP Returns — "Mini Shai-Hulud" Hits Two Ecosystems Simultaneously: After a 26-day pause, TeamPCP is back.
- CVE-2026-31431 "Copy Fail" — Linux kernel privilege escalation.: A logic flaw in `algif_aead` (the AF_ALG crypto interface) lets any unprivileged local user corrupt the page cache of setuid binaries to gain root.
- CVE-2026-42208 — LiteLLM pre-auth SQL injection (CVSS 9.3).: LiteLLM Proxy takes the Bearer token from the Authorization header and injects it directly into a SQL query with no sanitization.
- CVE-2026-25874 — HuggingFace LeRobot unauthenticated RCE.: The LeRobot robotics platform uses Python's `pickle` deserialization over unauthenticated gRPC in its async inference pipeline.
- Microsoft — Agent 365 reached General Availability (May 1).: The platform treats every AI agent as a managed identity with its own Entra Agent ID, least-privilege conditional access, and lifecycle management.
- Palo Alto Networks to acquire Portkey (reportedly $120–140M).: Portkey becomes the AI Gateway for Prisma AIRS, processing trillions of tokens per month with runtime inspection and identity-based controls.
- OpenAI launches GPT-5.5-Cyber, gated behind a velvet rope.: Restricted to the "Trusted Access for Cyber" (TAC) program: only vetted government defenders, critical infrastructure operators, and select security vendors.
- Frontier Model Forum launches threat-intel sharing against model distillation.: OpenAI, Anthropic, and Google agreed to share real-time threat intelligence about unauthorized model extraction.
- "Agentic AI as a Cybersecurity Attack Surface" (arXiv:2602.19555).: Comprehensive categorization of runtime supply chain threats in agent systems.
- UK AISI Frontier AI Capability Report.: AI models' success rate on apprentice-level cyber tasks rose from roughly 10% in early 2024 to 50% by 2025.
Curator's Corner
The angle that stuck with me this week isn't about any single vulnerability. It's about what connects them.
TeamPCP's Mini Shai-Hulud compromised real packages from real publisher accounts. The package came from a legitimate source. There was no typosquat to catch, no misspelled name to flag. The green checkmark was genuine, and it was the weapon. Organizations that auto-update from trusted sources were exposed first, precisely because their trust was the most complete.
Copy Fail corrupts the page cache in memory while leaving the disk untouched. Your file integrity monitor reports clean. The verification mechanism itself is the blind spot. The more you trust your integrity tooling, the more invisible this attack becomes.
LiteLLM has now been hit twice in six weeks. In March, TeamPCP's supply chain worm compromised it. In May, a pre-auth SQL injection (CVE-2026-42208) exposed the stored API keys to unauthenticated attackers. Different vulnerability classes, same infrastructure, same outcome. LiteLLM is the "AI keyring" that enterprises trust to centralize model access. That centralization of trust is exactly what makes it a high-value target.