Where do you draw the line between an AI-assisted pentest and what this crew did? Follow @PredictaLabOff for more cyber and OSINT news.

AI has industrialized the execution of intrusions, not the entry point. The way in is still unpatched edge devices and recycled passwords. The basics now buy you time against attackers moving at machine speed.

The twist: for all the AI, researchers say the main force multiplier was credential reuse. One reused password unlocked the VPN, servers, RMM, backups and the security console.

When a model refused a task, the operator did not switch tools. He reworded the request as an authorized red team assessment, and the model complied. The guardrail fell to a change of framing.

Phantom runs on OpenCode with OpenRouter-hosted commercial models: 18 skill modules for reconnaissance, EDR fingerprinting, exploit research, even steganography. A human writes one victim-specific prompt and approves each step. The AI does the rest.

SOCRadar found the exposed C2 of Russian-speaking affiliates working with INC and The Gentlemen. It held the Phantom framework's source code, AI session databases and a victim tracker covering an estimated 62 organizations, most of them in the US.

A ransomware crew ran its intrusions through commercial AI models and left the chat logs on an open server. 8,257 messages later, we can read exactly how a machine breaks into a company. ⬇️

Who in your threat model handles data that can move a stock by 20 percent: the lab, the journal, the conference, or the PR agency? Follow @PredictaLabOff for more cyber and OSINT news.

The takeaway: embargoed science is market-moving information with none of the protections of insider data. It flows through conference platforms, journals and partner portals, and every stop is a potential leak point.

With the numbers loose, Merck published the full dataset Thursday afternoon and the embargo was lifted. Trading in Moderna was briefly halted. The Madrid presentation became a formality.

The results were good: 42 percent lower risk of recurrence or death, 82.2 percent two-year survival versus about 70 for immunotherapy alone. But an earlier study had shown 49 percent, and the stock had tripled since August. Shares closed down 21 percent.

The Phase 3 data on the Moderna-Merck melanoma vaccine was scheduled for Saturday at the ESMO congress in Madrid. On Thursday morning the figures surfaced on a medical news site, then vanished minutes later. Screenshots were already circulating.

Moderna lost about 24 billion dollars in market value in a day. Not after a hack: after its own trial results appeared online two days before the embargo lifted. ⬇️

What broke first here: the code, the volunteer governance, or the embargo? Follow @PredictaLabOff for more cyber and OSINT news.

AI is now finding bugs in the web's foundations faster than coordinated disclosure can handle. 758,000 internet-facing PHP hosts run versions that will never get this patch. The long tail starts now.

Then the process collapsed. Details leaked on October 20, a proof-of-concept video slipped out, one vendor shipped fixed images early. Amazon honeypots had logged exploitation attempts on October 17, four days before disclosure.

The uncomfortable timeline: an external audit flagged one of the bugs in 2024. The volunteer security team, bound by consensus and afraid of breaking the ecosystem, stalled for two years. AI code reviews in August forced it to the top of the pile.

France pulled tax, weather and prefecture portals. The Netherlands took down DigiD and Overheid.nl. Denmark and Finland followed. Not breaches: precautions, while emergency patches rolled out.

PHP2Shell: CVE-2026-109618 and CVE-2026-109619, CVSS 9.2, in core components of the engine running roughly 70% of the web. Unauthenticated remote code execution and memory disclosure, proven against WordPress, Drupal and Joomla.

The NSA's advice to every org running PHP this week: install the emergency update now, or take your systems offline until you can. Four governments chose offline. ⬇️