🚨 ACTIVE EXPLOITS & INCIDENTS
- Fake AI Agent Skill Passed Security Scans and Reached 26,000 Agents — The security firm AIR created a fake AI agent skill that bypassed multiple popular security scanners and was distributed via a skill marketplace and Instagram ads, reaching ~26,000 agents including corporate accounts. The payload was benign, harvesting only email addresses, but this highlights critical gaps in AI skill vetting and potential for supply chain abuse in AI ecosystems.
- Scattered Spider Hackers Plead Guilty on Day 1 of Trial — Two key members of the prolific Scattered Spider cybercrime group pleaded guilty in the UK for their role in the August 2024 cyberattack that disrupted Transport for London. This early plea may signal cooperation and potential intelligence on the group’s TTPs, relevant for defenders tracking ransomware and supply chain extortion campaigns linked to Scattered Spider affiliates.
📰 LESSER-KNOWN / UNDER-REPORTED
- Trump Order Sets 2030 Deadline for Federal Post-Quantum Crypto Migration — An executive order signed June 22 mandates US federal agencies to migrate high-value assets to post-quantum cryptography by the end of 2030, with digital signatures due by 2031. National security systems follow a separate timeline. This sets a hard deadline for agencies to prepare for quantum-resistant crypto, impacting long-term cryptographic strategy and procurement cycles across government and contractors.