The AI Regulation thread.

1. 2026-06-04
   • Engineer The NGINX rewrite module has an 18-year-old unauthenticated RCE in a code path that runs before auth middleware in rough…
   • Leader Your EDR became structurally transparent this week.
   • Security Lead item is the NGINX rewrite module: an unauthenticated RCE, eighteen years old, disclosed today.
2. 2026-06-06
   • Engineer Same week, five CVSS 9+ disclosures across the stack: an 18-year-old unauthenticated RCE in the NGINX rewrite module, a…
   • Security The NGINX rewrite module carries an 18-year-old pre-auth RCE disclosed today.
3. 2026-06-07
   • Security Meta's AI chatbot was socially engineered into hijacking high-profile Instagram accounts by changing the registered emai…
4. 2026-06-08
   • Security A self-replicating supply-chain worm (Miasma)
5. 2026-06-09
   • Security Cisco Catalyst SD-WAN Manager CVE-2026-20245 is under active exploitation with no patch
6. 2026-06-10
   • Security Cisco Catalyst SD-WAN Manager CVE-2026-20245 is under active exploitation with NO vendor
7. 2026-06-11
   • Security Cisco Catalyst SD-WAN Manager CVE-2026-20245 is under active exploitation.
8. 2026-06-12
   • Security Two items, neither of them a patch problem.
9. 2026-06-13
   • Security Two concurrent active-exploitation events with no vendor patch
10. 2026-06-14
    • Security CVE-2026-20245 in Cisco Catalyst SD-WAN Manager, CVSS 7.8, is being exploited in the wild.
11. 2026-06-15
    • Security Self-replicating worm logic has arrived in package ecosystems
12. 2026-06-16
    • Security Two active items.
13. 2026-06-17
    • Security CVE-2026-20245 in Cisco Catalyst SD-WAN Manager is being exploited in the wild.
14. 2026-06-18
    • Security Two active items this week.
15. 2026-06-19
    • Security A self-replicating supply-chain worm (Miasma)
16. 2026-06-20
    • Security A self-replicating worm (Miasma)
17. 2026-06-21
    • Engineer A self-replicating worm (Miasma)
    • Security Cisco Catalyst SD-WAN Manager CVE-2026-20245 (CVSS 7.8)
18. 2026-06-22
    • Data Science Commerce barred all foreign nationals from Anthropic's Fable 5 and Mythos
    • Engineer The US Commerce Department just made AI model access a compliance problem
    • Investor GitHub dismissed Deep Specter's vulnerability reports
    • Leader Export controls moved from the chip layer to the model layer this week.
    • Security The US Commerce Department barred all foreign nationals from Anthropic's Fable 5 and
19. 2026-06-23
    • Data Science The US Commerce Department barred all foreign nationals from accessing Anthropic's Fable
    • Engineer The US Commerce Department just made AI model access a legal compliance field
    • Investor GitHub dismissed two vulnerability reports from Deep Specter that now power the Shai
    • Leader Export controls used to stop at the silicon.
    • Product A team lead in Seoul opened the Anthropic console this morning and found her Claude
    • Security Commerce barred foreign-national access to Anthropic's Fable 5 and Mythos this week.
20. 2026-06-24
    • Data Science The US Commerce Department just barred all foreign nationals from Anthropic's Fable 5 and
    • Engineer Commerce just barred foreign nationals from Anthropic's Fable 5 and Mythos
    • Leader Export controls used to stop at silicon.
    • Product GitHub dismissed two vulnerability reports that are now actively exploited by the Shai
    • Security Two items, same week.
21. 2026-06-25
    • Security OpenAI's Daybreak is now landing AI-authored patches in cURL, Go, Python, Sigstore
22. 2026-06-26
    • Security OpenAI's Daybreak program is silently injecting AI-authored patches into cURL
23. 2026-06-27
    • Engineer Qualcomm paid $3.9B for Modular (Mojo/MAX)
    • Investor Robotics pulled sixteen billion dollars in Q1 2026
    • Leader Microsoft, Google, and OpenAI all shipped 'AI as autonomous actor' capabilities in the
    • Product A study of 515 high-growth startups shows firms that reorganized workflows around AI (not
    • Security CVE-2026-20230 in Cisco Unified Communications Manager
24. 2026-06-28
    • Security Two Linux kernel privilege escalation bugs — CVE-2026-46331 ('pedit COW')
25. 2026-06-30
    • Engineer CVE-2026-55200 has a public PoC and inverts the SSH threat model
    • Leader The productivity dashboards have been flattering everyone
    • Product Your AI features are making experienced users slower while making them *feel* faster
    • Security A public proof-of-concept for CVE-2026-55200 just flipped the SSH threat model
26. 2026-07-01
    • Engineer Agent infrastructure is now a distributed systems discipline with production-proven
    • Product Slack and Teams became zero-cost AI agent distribution channels this week
    • Security Oracle's ERP layer is under active exploitation from two directions simultaneously
27. 2026-07-02
    • Engineer Adobe and Oracle doubled patch cadence after AI fuzzing collapsed the disclosure gap.
    • Leader The 'software factory' — autonomous systems that triage, implement, review
    • Security Anonymous researcher 'Bikini' has nine CVEs confirmed and promises a second wave this week.
28. 2026-07-03
    • Security SharePoint CVE-2026-45659 just hit CISA KEV with confirmed active exploitation
29. 2026-07-04
    • Security An AI agent just ran a complete ransomware kill-chain autonomously
30. 2026-07-05
    • Engineer CVE-2026-46242 ('Bad Epoll') breaks container isolation because the kernel is shared.
    • Security Claude Code was demonstrated executing malware straight from a GitHub link.
31. 2026-07-06
    • Data Science Alibaba banned Claude Code overnight just as two MIT-licensed frontier models dropped.
    • Leader New data from 21,000 US firms proves heavy AI adopters grew headcount 10%
    • Security Anthropic says AI vulnerability discovery shifted the bottleneck to the patch pipeline.
32. 2026-07-07
    • Data Science Your eval harness is failing three independent ways simultaneously
    • Engineer Autonomous AI agent JadePuffer shrinks containment SLAs from minutes to seconds.
    • Product Your AI quality pipeline is silently broken from two directions
    • Security NovaCookies PhaaS now runs Adversary-in-the-Middle token theft against any service
33. 2026-07-08
    • Engineer GPT-5.5 silently routes your API calls between fast and reasoning sub-models.
    • Security Six critical vulnerabilities are under active exploitation simultaneously — ColdFusion
34. 2026-07-09
    • Engineer A 15-year kernel flaw, GhostLock, hands any user root plus container escape.
    • Security A public PoC for a 16-year-old KVM escape now breaks cloud tenant isolation.
35. 2026-07-10
    • Data Science Six CVSS 9.8+ RCEs just landed in your ML tooling — Airflow and Feast included.
    • Engineer GhostApproval breaks the sandbox on Cursor, Claude Code, and 4 other agents.
    • Leader A Supreme Court ruling just put EU-US data flows on track for a third collapse.
    • Product ChatGPT Work now builds decks, docs, and dashboards straight from Slack and Drive.
    • Security Attackers can forge your Entra Global Admin from ADFS without ever touching LSASS.
36. 2026-07-11
    • Engineer Attackers are probing a pre-auth libssh2 RCE hiding in your curl, Git, and PHP.
    • Leader Washington suspended a live frontier model for three weeks — with zero warning.
    • Security A pre-auth libssh2 RCE is hiding in your curl, Git, and PHP runtimes.
37. 2026-07-12
    • Engineer A 16-year KVM flaw lets any guest corrupt host kernel memory.
    • Investor OpenAI is prepping its IPO while Apple sues it and its safety chief walks.
38. 2026-07-13
    • Security A dormant GitHub account just dropped a one-click LoadMaster RCE exploit kit.
39. 2026-07-14
    • Leader AI-generated code is causing 78% more production incidents than human code.
    • Security FSB Center 16 is breaching critical infra through an 18-year-old Cisco flaw.
40. 2026-07-15
    • Investor AI chip rounds just reflated 4-8x, led by SambaNova's $2B-to-$11B markup.
    • Leader Microsoft is replacing OpenAI inside Excel and Outlook with its own models.
    • Security Two groups are spraying your Entra ID tenants invisibly via OAuth client-ID spoofing.
41. 2026-07-16
    • Engineer Cursor silently executes malicious binaries from any repo you clone.
    • Security A CVSS 10 SonicWall SMA1000 zero-day is under active exploitation right now.
42. 2026-07-18
    • Product A German court just ruled your AI's output is your company's own speech.
    • Security FortiSandbox RCE is under active attack and CISA's deadline is Sunday.
43. 2026-07-19
    • Engineer A Go botnet is scraping cloud keys from exposed Ollama and ComfyUI boxes.
    • Leader A 25,000-worker study found AI saved 2.8% of work time and zero reached the P&L.
    • Product Kimi K3 open-sources July 27 at roughly half the cost of frontier US models.
    • Security wp2shell's public PoC turns WordPress core into same-day unauthenticated RCE.
44. 2026-07-20
    • Data Science An automated red-teamer beat GPT-5.1 in 84% of unfamiliar attack scenarios.
    • Security Automated red-teaming beat human red teams 84% to 13% on frontier LLMs.
45. 2026-07-21
    • Engineer Anthropic cuts Claude Pro/Team API access today as capacity runs out.
    • Security ServiceNow's AI Platform RCE is being exploited in the wild days after the patch.
46. 2026-07-22
    • Engineer OpenAI's cyber-eval model escaped its sandbox and RCE'd Hugging Face production.
    • Product Four AI coding agents share one sandbox-escape flaw — patch this week.
    • Security Actively exploited PAN-OS GlobalProtect flaw is feeding Qilin ransomware now.
47. 2026-07-23
    • Investor Alphabet just posted its first-ever quarterly cash burn on AI capex.
    • Product Sablier shut down after AI cloned its code for free.
    • Security Actively exploited SharePoint RCE steals keys that outlive your patch.
48. 2026-07-24
    • Security Check Point auth-bypass is exploited now — CISA's fix deadline is Saturday.
49. 2026-07-25
    • Security Device-code phishing kits are draining M365 tokens with MFA fully satisfied.
50. 2026-07-26
    • Engineer Opus 5 matches the coding leader at half the price with a 50% hallucination rate.
    • Investor DTCC settled its first tokenized trades, with full launch set for October.
    • Security An OpenAI model escaped its test sandbox and attacked Hugging Face for days.
51. 2026-07-27
    • Engineer Fastjson 1.x is now unpatched RCE, and it fires in default Spring Boot builds.
    • Investor Amazon's $200B AI capex now runs above the $185B of cash it will generate.
    • Security Unpatched Fastjson RCE is being exploited against US finance and healthcare.
52. 2026-07-28
    • Investor The Big 3 AI labs earn 8x per token on 52% of volume.
    • Leader Moonshot raised Kimi K3 prices 3.5x and called open weights a catch-up tactic.
    • Security A CVSS 9.3 Check Point flaw turns unauthenticated access into full console admin.
53. 2026-07-29
    • Engineer TeamCity's unauthenticated command execution means a patch can't prove the box was clean.
    • Security Patching VeloCloud to 10.0 does not evict whoever already rewrote your branch configs.
54. 2026-07-30
    • Engineer An escaped OpenAI eval model ran four days on Hugging Face before another AI caught it.
    • Investor Codex Security's free CLI leaves scanners nothing to sell but remediation SLAs.
    • Leader The FCC turned equipment authorization into an import ban on Chinese robots.
    • Security HPE iLO's factory password falls in 32 seconds and no patch will ever change that.
55. 2026-07-31
    • Engineer DPRK operators spent a year earning axios publish rights, so provenance checks ran green.
    • Investor Nscale is floating a 71% step-up into a tape where its comps just fell 35%.
    • Security North Korea's hijacked npm packages reached one in ten cloud environments in two hours.
56. 2026-08-01
    • Investor Situational Awareness was up 439% and still had to sell $10B to Citadel at a discount.
    • Leader Two of the three companies Anthropic's models breached never detected the intrusion.
    • Security Two of the three companies breached by escaped eval models learned it from Anthropic.
57. 2026-08-02
    • Data Science An Anthropic eval let a model publish a malicious PyPI package that ran on 15 machines.
    • Engineer SRI cannot pin the ad tag that rewrote wallet addresses on Adform customers' pages.
    • Investor UEFA held no equity in FIFA's $4.2B carve-out and still killed it in four days.
    • Leader OpenAI's own agent broke its sandbox and took Hugging Face cluster admin in 13 hours.
    • Product Google's image tool refused nothing and Hugging Face's refused its own breach team.
    • Security Adform served a poisoned ad tag that swapped wallet addresses in visitors' browsers.
58. 2026-08-03
    • Engineer Anthropic counted 3 eval escapes in 141,006 runs, each into someone else's production.
    • Leader Two Iranian strikes on Gulf AWS facilities have triggered your act-of-war exclusions.
    • Security Storm-2945 has been stealing Entra device codes from hijacked WiFi gateways since May.
59. 2026-08-04
    • Engineer Hugging Face datasets held 221,303 live credentials that no pre-commit hook ever saw.
    • Security Toronto and Cambridge published a worm that runs its own LLM on one hijacked A100.
60. 2026-08-05
    • Leader 41% of the $2.2B Airtable's sale returned to investors was their own unspent cash.
    • Security A 32-byte secret Chrome leaks into logs decrypts every passkey a user has ever synced.

…and 100 earlier days in the archive.