AI showed up on all three sides of the board this week, and that is the story worth sitting with. Microsoft credited an in-house AI vulnerability-discovery system for the largest Patch Tuesday on record, 570 flaws in one release; a Langflow authorization bug (CVE-2026-55255) became the internet-facing door attackers walked through; and JADEPUFFER, an autonomous LLM agent, ran an extortion operation end to end, from break-in to database drop, with a human only provisioning infrastructure. The machine is now the auditor, the target, and the operator at once. The non-obvious connection defenders keep missing: the SharePoint zero-day (CVE-2026-56164) and the ToolShell fingerprint behind it prove that patching does not evict an attacker who already stole your IIS machine keys, and the same "the artifact survives the patch" logic applies to any secret an agent can read from a compromised AI workflow host. So this week, do two things you probably deferred: rotate SharePoint ASP.NET machine keys after patching (not instead of it), and put your Langflow, MCP servers, and any internet-reachable agent tooling on the same asset inventory and CISA-KEV clock as your VPNs and firewalls. The experiment you spun up in Q1 is now production attack surface, and adversaries are enumerating it faster than your change board can.

A missing-authentication flaw in on-premises SharePoint Server that lets an unauthenticated network attacker escalate privileges with no user interaction. It was exploited as a zero-day before Microsoft's July 14 patch and added to CISA KEV. CISA describes attackers chaining it with previously disclosed flaws CVE-2026-32201 and CVE-2026-45659 to steal IIS machine keys, establish persistence, and deploy malware. The critical operational point: machine-key theft survives patching, so remediation requires key rotation, not just the update. Affects SharePoint Subscription Edition, 2019, and 2016. The Register, Resecurity

A SharePoint Server remote code execution zero-day affecting on-premises installations, added to the CISA KEV catalog on July 16, 2026 after evidence of active exploitation. It is part of the same cluster of SharePoint flaws (alongside CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164) that CISA flagged as actively exploited against on-premises servers. The Hacker News, CISA

An actively exploited AD FS elevation-of-privilege vulnerability. A successful exploit lets an attacker gain administrator privileges, a high-value outcome against a federation and single-sign-on control plane. Exploited as a zero-day before the July 14 patch and added to KEV. Forbes, Cybernews

An Insecure Direct Object Reference flaw (CVSS 6.1) that lets an authenticated attacker execute any flow belonging to another user by supplying the victim's flow_id (UUID) to the /api/v1/responses endpoint, exposing data processed by those flows and consuming their resources. It was weaponized alongside RCE flaw CVE-2026-33017 in a sustained June 22 to 25, 2026 campaign, and CISA added it to KEV under Binding Operational Directive 26-04. Do not let the modest CVSS score mislead: this is AI-workflow infrastructure exposed to the internet, and KEV placement means it is being used now. NVD, SC Media

A memory-overread vulnerability that lets unauthenticated attackers read sensitive information from system memory, enabling session hijacking and further compromise, an echo of the original CitrixBleed pattern. It was exploited within 24 hours of its June 30 disclosure. Any organization running NetScaler ADC or Gateway should assume session tokens may be exposed and force re-authentication after patching. Carthage Electronics

Two CVSS 9.8 remote code execution vulnerabilities in Fortinet's FortiSandbox product under active exploitation, part of a batch of seven flaws Fortinet patched across FortiOS, FortiProxy, FortiPAM, and FortiSandbox. Network security appliances remain a top-tier initial-access target. Cybersecurity News, Greenbone

Server-Side Request Forgery (CVE-2026-15409) and code injection (CVE-2026-15410) vulnerabilities in SonicWall SMA1000 appliances, both added to CISA KEV on July 14 following evidence of active exploitation. Remote-access appliances again sit at the top of the exploited-in-the-wild list. CISA

An Adobe ColdFusion path traversal vulnerability added to CISA KEV on July 7 based on evidence of active exploitation. ColdFusion continues its long history as a reliable target for opportunistic web-server compromise. SC Media

A cluster of Joomla-extension flaws added to KEV across July 7 and July 10: SP Page Builder unrestricted file upload (CVE-2026-48908), Joomlack Page Builder improper access control (CVE-2026-56290), iCagenda unrestricted file upload (CVE-2026-48939), and Balbooa Forms unrestricted file upload (CVE-2026-56291). Attackers are systematically hunting third-party CMS plugins for webshell-drop primitives. CISA

This week is the clearest signal yet that AI systems have crossed from "emerging risk" to operational attack surface and, for the first time, operational attacker. Three developments define the shift.

Langflow is the new initial-access frontier. CVE-2026-55255 is an authorization bypass in a widely deployed low-code AI-agent-builder platform, and its placement in CISA KEV under BOD 26-04 confirms in-the-wild use. It was chained with RCE flaw CVE-2026-33017 during a June 22 to 25 campaign that ran application and auth reconnaissance, flow enumeration, the IDOR, and then a sustained RCE loop with outbound connections. The takeaway for defenders: the AI-agent orchestration tools your teams stood up are now enumerated and exploited exactly like any other internet-facing app, and they frequently hold API keys, model credentials, and data-source secrets. The Hacker News, SecurityWeek

JADEPUFFER: the attacker is now the agent. Sysdig documented the first known end-to-end agentic ransomware operation. A human operator deployed an LLM agent and the infrastructure around it, then let the agent run the entire extortion chain: it broke into an internet-facing Langflow instance via CVE-2025-3248, swept the host for secrets, pivoted to the target, forced its way into a Nacos configuration service, encrypted 1,342 configuration items, deleted the originals, and dropped production databases. The Cloud Security Alliance and NSFOCUS have published parallel analyses. This is the "machine-speed adversary" made concrete: the loop from foothold to encryption compresses to whatever the agent's token budget allows, collapsing the human response window. Sysdig, Cloud Security Alliance, NSFOCUS

Prompt injection remains the structural weakness under all of it. Prompt injection has held the number-one slot on OWASP's LLM Top 10 across every edition, with a reported 340% year-over-year rise in attacks, and it still drives most agentic-AI security failures in production. The mechanism is unchanged and hard to patch away: an AI agent is compromised through the very content it is designed to process, a single sentence in a retrieved document, webpage, or code comment can redirect behavior, exfiltrate data, or trigger unauthorized actions. Once an agent holds email, database, shell, or deployment access, a successful injection lets an attacker act through the system rather than merely produce a wrong answer, the lethal trifecta of private data, untrusted content, and external communication. A 2026 enterprise survey found 88% of organizations reported confirmed or suspected AI-agent security incidents in the past year. Help Net Security, Airia

MCP and the agent supply chain. As agents proliferate, Model Context Protocol (MCP) servers become a fresh trust boundary: a malicious or compromised MCP tool is untrusted content with a direct line to the agent's privileges. Treat every MCP server, tool definition, and connector as part of your attack surface and subject them to the same agentic red teaming you would apply to any privileged integration. TechStoriess

Defensive posture for AI systems this week: enforce least privilege on every agent and tool, separate trusted instructions from untrusted data, validate outputs before they trigger actions, keep a human in the loop for irreversible operations, inventory internet-facing AI infrastructure (Langflow, MCP servers, orchestration UIs), and monitor agent action logs at machine speed because the adversary now operates at machine speed. ecorpit

The through-line: appliance and application compromise (SharePoint, Fortinet, Langflow) is still the dominant path to ransomware, and 2026's attackers increasingly automate the pivot from foothold to encryption. The manufacturing and automotive sectors again feature prominently, consistent with the broader 2026 pattern of ransomware crews targeting operationally sensitive industries. TechCrunch