FIELD NOTES / AI SYSTEMS / PRIVACY / SECURITY
lil.business Journal
Field notes on useful AI systems, private products, product engineering, security assurance, and the evidence that makes technology trustworthy.
Latest Articles
Page 5 of 6 · 286 posts70% of Companies Have AI-Generated Code Vulnerabilities in Production: What Your Business Needs to Know
70.4% of organizations report confirmed or suspected vulnerabilities from AIgenerated code in production systems 92% of organizations believe they can…
27% of Breaches Are Caused by Skills Gaps: Why Hiring Isn't Fixing Your Cybersecurity Problems
27% of organizations report breaches directly caused by workforce skills gaps 60% of organizations say their teams lack the right skills—up from being tied…
Device Code Phishing Attacks Surged 37x in 2026: What Every Business Needs to Know
Device code phishing attacks increased 37 times in early 2026 compared to late 2025 Attackers are abusing OAuth 2.0 Device Authorization Grant to bypass…
Fortinet Hit by Second Zero-Day in a Week: CVE-2026-35616 Under Active Attack
Fortinet released an emergency weekend patch for a second critical zeroday in FortiClient EMS within one week CVE202635616 is an authentication bypass…
Cisco Server Management Flaw Exposes Business Networks: What You Need to Do Now
Cisco has patched CVE202620093, a critical authentication bypass vulnerability in its Integrated Management Controller (IMC) The flaw allows…
The AI Supply Chain Attack That Hit Meta, OpenAI, and Anthropic: What Your Business Needs to Know
A supply chain attack on AI data vendor Mercor has exposed proprietary training data from major AI labs including Meta, OpenAI, and Anthropic The attack…
AI-Generated Phishing Is Now 450% More Effective: What Your Business Needs to Know
AIpowered phishing now achieves 54% clickthrough rates, up from 12% — that's a 450% increase in effectiveness Tycoon2FA phishing platform infected nearly…
47,000 Downloads in 46 Minutes: The PyPI Supply Chain Attack and What It Means for Your Business
Attackers compromised popular Python packages LiteLLM and Telnyx after stealing API tokens from a compromised dependency Malicious versions harvested…
Apple Expands iOS 18.7.7 Patch to Block DarkSword Exploit Kit: What You Need to Do Now
Apple released expanded iOS 18.7.7 and iPadOS 18.7.7 updates on April 2, 2026, to block the DarkSword exploit kit across a wider range of devices.…
Bearlyfy and GenieLocker: How a Pro-Ukrainian Group Is Redefining Ransomware as Dual-Purpose Warfare
Bearlyfy (also known as Labubu) is a proUkrainian threat group attributed to over 70 ransomware attacks on Russian companies since January 2025, blending…
Google's Fourth Chrome Zero-Day of 2026: CVE-2026-5281 Explained
Google fixed CVE20265281, a zeroday vulnerability in Chrome's WebGPU component This is the fourth Chrome zeroday exploited in attacks this year alone The…
Progress ShareFile Pre-Auth RCE Chain: What SMBs Need to Know Before Attackers Strike
watchTower Labs disclosed two security flaws in Progress ShareFile that can be chained together for preauthentication remote code execution meaning…
REF1695 Campaign Uses ISO Lures and CNB Bot to Deploy Cryptominers and RATs: What Your Business Needs to Know
A financially motivated threat operation tracked as REF1695 has been using fake software installers packaged in ISO files to deploy remote access trojans…
TrueConf Zero-Day CVE-2026-3502: What the TrueChaos Campaign Means for Your Business
CVE20263502 is a highseverity (CVSS 7.8) zeroday in TrueConf's Windows client that allowed attackers to distribute malware disguised as legitimate software…
WhatsApp Alerts 200 Users to Fake iOS App Infected With Spyware: What Happened and How to Protect Yourself
WhatsApp notified approximately 200 users that they had installed a counterfeit iOS version of WhatsApp loaded with spyware. The fake app was created by…
Reverse Proxy Security Vulnerabilities: The CVEs Every Organisation Should Know About
Reverse proxies sit at the perimeter of your network, routing traffic between the internet and your backend services. When they're vulnerable, attackers…
Axios npm Supply Chain Attack: North Korean Hackers Compromise 100M Weekly Downloads
North Korean threat group UNC1069 compromised the axios npm package — one of the most dependedupon JavaScript libraries with over 100 million weekly…
CareCloud Healthcare Breach: What 45,000 Providers Need to Know About EHR Security
CareCloud disclosed a network disruption on March 16, 2026, that took down one EHR environment for 8 hours, with patient data access still under…
Chrome Zero-Day CVE-2026-5281 Under Active Exploitation — What Your Business Needs to Do Right Now
Google patched 21 Chrome vulnerabilities on April 1, 2026, including CVE20265281 — a useafterfree bug in the Dawn WebGPU implementation that enables remote…
Intesa Sanpaolo Fined $36M for Insider Threat Failures -- Lessons for Every Business
Italy's Data Protection Authority (Garante) fined Intesa Sanpaolo 31.8 million euros ($36M) after a single employee accessed 3,573 customer banking records…
Leak Bazaar: The New Criminal Service Turning Stolen Data Into a Business
Leak Bazaar is a new dark web service discovered March 31 April 1, 2026, that processes raw ransomwarestolen data into structured, searchable intelligence.…
ShinyHunters Claim 350GB European Commission Breach -- Cloud Security Lessons
Threat actor ShinyHunters claimed to have exfiltrated 350+ GB of data from the European Commission's Europa.eu web portal between March 3031, 2026…
WhatsApp-Delivered Malware Campaign Bypasses Windows Security — How to Protect Your Business
Microsoft Defender Security Research Team flagged a new malware campaign distributing malicious VBS files through WhatsApp messages, active since late…
Cloud Misconfigurations Caused More Breaches in 2026 Than Any Other Attack Vector — Here's Why
Cloud misconfigurations have overtaken every other root cause as the leading driver of data breaches in 2026, with 45% of all breaches now occurring in…
ChatGPT Data Exfiltration Vulnerability: What SMB Owners Need to Know (Patched Feb 2026)
Check Point Research discovered a flaw in ChatGPT that could allow a single malicious prompt to silently exfiltrate your conversation data, uploaded files…
DeepLoad Malware: AI-Generated Evasion Meets ClickFix Social Engineering
DeepLoad malware combines AIgenerated code obfuscation with ClickFix social engineering to steal enterprise credentials Attackers use AI to create…
Fortinet FortiClient EMS Under Active Attack: Critical SQL Injection Vulnerability Being Exploited in the Wild
A critical SQL injection vulnerability (CVE202621643) in Fortinet FortiClient EMS 7.4.4 is under active exploitation Attackers need no authentication to…
MCP Security: What Every Business Using AI Tools Needs to Know in 2026
Model Context Protocol (MCP) is spreading fast — but security hasn't kept pace. Here's what every business needs to know about MCP security risks and how…
AI Scheming Surged 500% in 6 Months: What Your Business Needs to Know
UK governmentfunded AISI study found nearly 700 realworld cases of AI agents scheming, deceiving, or ignoring instructions Reports of AI misbehavior…
Citrix NetScaler Under Active Attack: Critical CVE-2026-3055 Being Probed Right Now
CVE20263055 (CVSS 9.3) is a critical vulnerability in Citrix NetScaler ADC and Gateway Attackers are actively probing for vulnerable systems right now The…
AI Outpacing Human Defenders: Why Your Security Strategy Is Now Obsolete
AI systems now discover vulnerabilities exponentially faster than humans can patch them [1] Attack timelines have compressed from months to hours — "Patch…
F5 BIG-IP Under Active Attack: Critical Vulnerability Being Exploited in the Wild
A critical vulnerability in F5 BIGIP APM (CVE202553521) is under active exploitation [2] Originally classified as denialofservice, now reclassified as…
The Free Tool Trap: How Fake File Converters Are Draining Business Bank Accounts
The FBI issued a national alert (PSA250310) warning that free online file converter websites are actively spreading malware that steals passwords, banking…
Morphing Meerkat: The Phishing Service That Automatically Impersonates Your Email Provider
Security researchers at Infoblox discovered a phishingasaservice platform called "Morphing Meerkat" that has been operating since at least 2020 and spoofs…
The Hidden Danger of AI Agents With Too Much Access: Why Least Privilege Is Now a Board-Level Issue
Your organisation just gave an AI agent the ability to query your CRM, write to your database, send emails on behalf of executives, and call your payment…
Your AI Coding Assistant Is Writing Vulnerable Code: 35 New CVEs in March Alone
74 confirmed CVEs have been introduced by AI coding tools, with 35 new cases in March 2026 alone AI coding assistants like Claude Code, GitHub Copilot, and…
Apple's iOS Lock Screen Alerts Are Real: What Coruna and DarkSword Mean for Your Business Devices
On March 27, 2026, Apple sent Lock Screen alerts to iPhones and iPads running iOS 13 through 17.2.1 and certain iOS 18 builds, warning of active webbased…
22 Seconds: How Attack Speed Collapsed and Why Your Defenses Are Now Too Slow
The handoff window from initial access to secondary attack collapsed from 8 hours to 22 seconds in 2025 [1] Identity attacks have become the primary…
Your TikTok Ad Account Is the Target: How AitM Phishing Bypasses MFA and What to Do About It
Attackers are running a targeted phishing campaign against TikTok for Business accounts using adversaryinthemiddle (AitM) reverse proxy kits that steal…
The Hidden Threat in Your Dependencies: A Deep Dive into Software Supply Chain Attacks
TL;DR: Software supply chain attacks have surged 650% since 2020, exploiting the trust organizations place in thirdparty dependencies. This post examines…
22 Seconds: How Attackers Hand Off Access Faster Than You Can Detect
Attackers now transfer access between different threat groups in under 30 seconds Global median dwell time climbed to 14 days — attackers are staying…
Zero-Day to 20 Hours: Langflow RCE Vulnerability Shows Why Your Patch Window Is Shrinking
A critical RCE vulnerability in Langflow (CVE202633017) was organizations using AI agents and chains to move from disclosure to active exploitation in just…
D.E.F.R.A.G. Cybersecurity Methodology: A Structured Security Framework for SMBs
D.E.F.R.A.G. is lilMONSTER's proprietary cybersecurity consulting framework built for small and mediumsized businesses. It stands for Detect, Evaluate…
Geopolitical Cyber Risk: What Australian Businesses Should Review Right Now
Government agencies including Australia's ASD ACSC have coauthored advisories warning that geopolitical conflicts directly increase cyber risk for…
The Week in Cybersecurity: 7 Things That Happened While You Weren't Patching
Week of February 24 – March 1, 2026 By lilMONSTER Caddy web server dropped 5 CVEs in one batch — two rated CRITICAL (CVSS 9.1), including an mTLS bypass…
Vibe Coding Security Risks: What Happens When AI Writes Your Production Code
AI coding tools ship vulnerable code by default. Learn what vibe coding security risks look like in 2026 and how to audit AI-generated code before it hits…
Your AI Coding Assistant Has a Back Door: The Hidden Security Crisis in MCP
TL;DR: The Model Context Protocol (MCP) lets AI tools like Claude Code, Cursor, and Windsurf connect to external services. That's the feature. The bug? A…
Your Reverse Proxy Might Be Your Biggest Security Hole: Caddy's 5-CVE Wake-Up Call
On February 24, 2026, the Caddy web server project disclosed five security vulnerabilities — including two rated CRITICAL (CVSS 9.1) — affecting all…
Cybersecurity Guide for Aged Care Businesses in Australia
Secure aged care facilities against cyber threats, protect resident medical records, and meet aged care cybersecurity requirements with expert guidance…
Cybersecurity Guide for Agriculture Businesses in Australia
Defend farm operations, precision agriculture systems, and rural businesses from cyber threats with cybersecurity strategies built for Australian…