Blog | Atarus Offensive Security

top of page

Home
About
Services
Research
AI Pen Tests

REQUEST CONSULTATION

All Posts

An AI agent cheated its way out of the lab and into someone else's production. One step was genuinely new. Four of them were things you already know how to fix.

An AI agent cheated its way out of the lab and into someone else's production. One step was genuinely new. Four of them were things you already know how to fix.

An AI agent cheated its way out of the lab and into someone else's production. One step was genuinely new. Four of them were things you already know how to fix.

Atarus Security Team

Jul 290 min read

AI is now on both sides of the attack: the thing we break into, and the thing that breaks in. Here is what actually changed, and what didn't.

AI is now on both sides of the attack: the thing we break into, and the thing that breaks in. Here is what actually changed, and what didn't.

AI is now on both sides of the attack: the thing we break into, and the thing that breaks in. Here is what actually changed, and what didn't.

Atarus Security Team

Jul 130 min read

We get past MFA on most engagements, and we almost never break it. Here is how, and what actually stops us.

We get past MFA on most engagements, and we almost never break it. Here is how, and what actually stops us.

We get past MFA on most engagements, and we almost never break it. Here is how, and what actually stops us.

Atarus Security Team

Jun 260 min read

Researchers caught a low-skilled attacker using AI agents to breach 14 companies. The uncomfortable part is that the AI mostly weaponized bugs you already have a patch for.

Researchers caught a low-skilled attacker using AI agents to breach 14 companies. The uncomfortable part is that the AI mostly weaponized bugs you already have a patch for.

Researchers caught a low-skilled attacker using AI agents to breach 14 companies. The uncomfortable part is that the AI mostly weaponized bugs you already have a patch for.

ai-agents-breached-14-companies-n-day-bugs

Atarus Security Team

Jun 220 min read

Five days, ten exploited bugs, almost none of them touched a core app. A week attackers spent walking in through everything else.

Five days, ten exploited bugs, almost none of them touched a core app. A week attackers spent walking in through everything else.

Five days, ten exploited bugs, almost none of them touched a core app. A week attackers spent walking in through everything else.

Atarus Security Team

Jun 190 min read

Microsoft patched three more Nightmare Eclipse zero-days on Tuesday, six in six weeks now. The story isn't the bugs, it's how fast a public PoC turns into a real attack.

Microsoft patched three more Nightmare Eclipse zero-days on Tuesday, six in six weeks now. The story isn't the bugs, it's how fast a public PoC turns into a real attack.

Microsoft patched three more Nightmare Eclipse zero-days on Tuesday, six in six weeks now. The story isn't the bugs, it's how fast a public PoC turns into a real attack.

Atarus Security Team

Jun 100 min read

Your network assumes the attacker comes through the firewall. A red team with a thirty-dollar badge cloner starts inside, as a trusted employee.

Your network assumes the attacker comes through the firewall. A red team with a thirty-dollar badge cloner starts inside, as a trusted employee.

Your network assumes the attacker comes through the firewall. A red team with a thirty-dollar badge cloner starts inside, as a trusted employee.

Atarus Security Team

Jun 40 min read

Sophos found a ransomware crew using AI coding agents to build EDR-evasion malware and automate Active Directory attacks. The tooling works. The AI's claims about beating EDR were hallucinated.

Sophos found a ransomware crew using AI coding agents to build EDR-evasion malware and automate Active Directory attacks. The tooling works. The AI's claims about beating EDR were hallucinated.

Sophos found a ransomware crew using AI coding agents to build EDR-evasion malware and automate Active Directory attacks. The tooling works. The AI's claims about beating EDR were hallucinated.

Atarus Security Team

Jun 30 min read

Attackers are forging a cookie to log into Palo Alto VPNs as any user, admin included. It was rated medium severity, and they were inside four days after the patch.

Attackers are forging a cookie to log into Palo Alto VPNs as any user, admin included. It was rated medium severity, and they were inside four days after the patch.

Attackers are forging a cookie to log into Palo Alto VPNs as any user, admin included. It was rated medium severity, and they were inside four days after the patch.

Atarus Security Team

Jun 20 min read

CISA added three supply chain CVEs to KEV including the Nx Console that compromised GitHub. The methodology is federally confirmed.

CISA added three supply chain CVEs to KEV including the Nx Console that compromised GitHub. The methodology is federally confirmed.

CISA added three supply chain CVEs to KEV including the Nx Console that compromised GitHub. The methodology is federally confirmed.

Atarus Security Team

May 290 min read

A single syscall escapes the browser sandbox and lands SYSTEM. CVE-2026-40369 is patched. The public exploit code is everywhere.

A single syscall escapes the browser sandbox and lands SYSTEM. CVE-2026-40369 is patched. The public exploit code is everywhere.

A single syscall escapes the browser sandbox and lands SYSTEM. CVE-2026-40369 is patched. The public exploit code is everywhere.

Atarus Security Team

May 270 min read

A new open-source framework turns 7 AI coding tools into 50 autonomous bug-hunting agents. Your adversaries now have it too.

A new open-source framework turns 7 AI coding tools into 50 autonomous bug-hunting agents. Your adversaries now have it too.

A new open-source framework turns 7 AI coding tools into 50 autonomous bug-hunting agents. Your adversaries now have it too.

Atarus Security Team

May 260 min read

The long weekend in review: Glasswing found 10,000 vulnerabilities. The supply chain attacks didn't break for the holiday.

The long weekend in review: Glasswing found 10,000 vulnerabilities. The supply chain attacks didn't break for the holiday.

The long weekend in review: Glasswing found 10,000 vulnerabilities. The supply chain attacks didn't break for the holiday.

Atarus Security Team

May 250 min read

Trend Micro patched an actively exploited Apex One zero-day. Compromise the endpoint security server, own every endpoint it manages.

Trend Micro patched an actively exploited Apex One zero-day. Compromise the endpoint security server, own every endpoint it manages.

Trend Micro patched an actively exploited Apex One zero-day. Compromise the endpoint security server, own every endpoint it manages.

Atarus Security Team

May 220 min read

GitHub confirmed overnight: TeamPCP exfiltrated 3,800 internal repositories via a poisoned VS Code extension.

GitHub confirmed overnight: TeamPCP exfiltrated 3,800 internal repositories via a poisoned VS Code extension.

GitHub confirmed overnight: TeamPCP exfiltrated 3,800 internal repositories via a poisoned VS Code extension.

Atarus Security Team

May 200 min read

Grafana lost its codebase to Coinbase Cartel, the new offshoot of ShinyHunters, Scattered Spider, and LAPSUS$.

Grafana lost its codebase to Coinbase Cartel, the new offshoot of ShinyHunters, Scattered Spider, and LAPSUS$.

Grafana lost its codebase to Coinbase Cartel, the new offshoot of ShinyHunters, Scattered Spider, and LAPSUS$.

Atarus Security Team

May 190 min read

Pwn2Own Berlin 2026 paid out $1.3 million across 47 zero-days. OpenAI Codex got hit three times.

Pwn2Own Berlin 2026 paid out $1.3 million across 47 zero-days. OpenAI Codex got hit three times.

Pwn2Own Berlin 2026 paid out $1.3 million across 47 zero-days. OpenAI Codex got hit three times.

Atarus Security Team

May 180 min read

CISA gave federal agencies 48 hours to patch a CVSS 10.0 Cisco SD-WAN auth bypass. UAT-8616 is already in.

CISA gave federal agencies 48 hours to patch a CVSS 10.0 Cisco SD-WAN auth bypass. UAT-8616 is already in.

CISA gave federal agencies 48 hours to patch a CVSS 10.0 Cisco SD-WAN auth bypass. UAT-8616 is already in.

Atarus Security Team

May 150 min read

32 lawmakers told the White House this week: AI is finding bugs faster than companies can patch them.

32 lawmakers told the White House this week: AI is finding bugs faster than companies can patch them.

32 lawmakers told the White House this week: AI is finding bugs faster than companies can patch them.

Atarus Security Team

May 140 min read

Checkmarx Confirmed on May 11 a Malicious Version of Its Jenkins AST Plugin Was Published to the Jenkins Marketplace. Third TeamPCP Compromise of Checkmarx in Three Months. CVE-2026-33634, CVSS 9.4.

Checkmarx Confirmed on May 11 a Malicious Version of Its Jenkins AST Plugin Was Published to the Jenkins Marketplace. Third TeamPCP Compromise of Checkmarx in Three Months. CVE-2026-33634, CVSS 9.4.

Checkmarx Confirmed on May 11 a Malicious Version of Its Jenkins AST Plugin Was Published to the Jenkins Marketplace. Third TeamPCP Compromise of Checkmarx in Three Months. CVE-2026-33634, CVSS 9.4.

Atarus Security Team

May 130 min read

Contact

info@atarussecurity.com

Legal

Atarus Offensive Security LLC.

© 2026 Atarus Offensive Security LLC. All rights reserved.

Precision Strike-Force Execution

bottom of page