Tuskira

AI is exposing a growing gap between machine-speed vulnerability discovery and human-speed remediation. That's the premise behind Tuskira Research's Patch Gap report (https://lnkd.in/eJWBjeAC), and we're excited to see Help Net Security spotlight the findings. Our analysis of 1,596 verified vulnerabilities disclosed through Anthropic Mythos found that AI-driven discovery is outpacing visible remediation by roughly 16.5×. Maintainers are responding, but remediation can't keep pace with machine-speed discovery, and that changes the enterprise security equation. If AI is discovering vulnerabilities before a CVE even exists, where should a modern security program begin? The challenge is shifting from identifying vulnerabilities to determining which are actually exploitable, pose a meaningful risk, and warrant immediate attention. Thanks to the Help Net Security team for covering the research. Read their article here: https://lnkd.in/ep95vaig

Join the AI Security Council on July 9th at 11:00 AM ET for an exclusive webinar: "Detecting Shadow AI: Moving Beyond the Illusion of Control." We’re bringing together top security leaders from Oracle, Good Day Farm, Lightcast, and Tuskira to discuss real-world, practical approaches to securing the enterprise. They'll discuss: 🔹 The New Hiding Places: Where Shadow AI is lurking in your network today. Identity as the Anchor: Why identity has become the critical control plane for AI security 🔹 Real-World Detection: How leading organizations are successfully spotting unauthorized AI activity 🔹 Balancing Act: Practical governance strategies that enable rapid innovation without sacrificing security Don't let the illusion of control leave your data vulnerable. Securing your enterprise starts with seeing the full picture. Register here: https://lnkd.in/ekzzXNnz AJ D. Sean Edgington Greg M. Chris Kirschke

Tuskira Threat Brief: Week of June 29, 2026 ERP Flaw Exploits, Receipt Phishing Abuse, and Industrial AI Distillation 1. Hackers now exploit critical Oracle E-Business Suite flaw Source: BleepingComputer ▪️ TL;DR: Attackers are actively exploiting a critical, unauthenticated vulnerability (CVE-2026-46817) in Oracle E-Business Suite's (EBS) Payments module. ▪️ Key Points: The 9.8-severity flaw in the File Transmission component allows complete takeover via low-complexity HTTP requests; active exploitation was spotted over the weekend via honeypots; hundreds of instances remain internet-exposed. ▪️ Our POV: Business-critical financial software is a goldmine for extortion groups. An unauthenticated edge flaw in a payments module means attackers don't just steal data they manipulate financial flows. This is an out-of-band P0 emergency. Apply Oracle’s May 2026 Critical Security Patch Update immediately. Restrict public HTTP access to EBS instances and hunt logs for unauthorized file transfers or unusual outbound connections. 2. Order-tracking app Shop abused to push callback phishing Source: BleepingComputer ▪️ TL;DR: Threat actors are abusing Shopify's Shop app to inject fake purchase receipts into users' legitimate order histories, routing them to callback phishing traps. ▪️ Key Points: Scammers leverage platform design loopholes to append fake invoices directly inside the app; targets are tricked into calling fraudulent support lines where they are pressured into downloading remote access trojans. ▪️ Our POV: This is a sophisticated Trust Hijack. Standard anti-phishing filters cannot see this traffic. Enforce strict endpoint protection rules blocking unauthorized remote desktop tools (e.g., AnyDesk, TeamViewer) to disrupt the payload stage. 3. Anthropic accuses Alibaba of massive model distillation campaign Source: Reuters ▪️TL;DR: Anthropic alerted Congress that Chinese tech giant Alibaba executed a massive distillation attack against Claude models using 25K fraudulent accounts. ▪️Key Points: Over 28.8M exchanges were generated to systematically siphon Claude’s advanced agentic reasoning and cyber capabilities to train cheaper, domestic models; flagged as the largest known attack of its kind. ▪️Our POV: This is IP theft operating at machine scale. Attackers are shifting from stealing code to draining model logic via rapid, systematic API polling. If you build proprietary AI models, API rate-limiting is no longer enough. Implement behavioral telemetry to detect distillation patterns (highly sequential, optimized prompt arrays designed to map logic maps) and instantly isolate anomalous multi-account clusters. Final Word: Whether it's targeting financial infrastructure via Oracle, abusing app data architectures via Shop, or siphoning model capabilities via industrial-scale API loops, the perimeter has given way to structural manipulation. Defense means validating inputs and behaviors at every transactional layer. Stay preemptive.

https://lnkd.in/e_EW4rDA Between March 20 and May 22, 2026, Anthropic’s Claude Mythos Preview analyzed more than 23,000 open-source code paths and disclosed 1,596 verified vulnerabilities across 281 distinct open-source projects. The central finding of this report by Tuskira is that AI-driven vulnerability discovery is now outpacing remediation by approximately one order of magnitude or more. The report includes key recommendations of what to do now and a #CISO quarterly checklist to assist you.

Today we're publishing Tuskira's new research report: The Emerging Patch Gap: What Anthropic Mythos Data Reveals About AI-Driven Vulnerability Discovery and Enterprise Remediation Will AI fundamentally change vulnerability discovery? The data says it has. Read the full report: https://lnkd.in/eGQmuT9M Analyzing Anthropic Mythos disclosure data, we found: • 1,596 verified vulnerabilities across 281 open-source projects in just 63 days • AI-driven discovery occurring at roughly 25.3 vulnerabilities per day • Visible remediation occurring at roughly 1.5 vulnerabilities per day • Discovery outpacing remediation by approximately 16.5× This report combines Anthropic Mythos disclosure data with insights derived from millions of vulnerability and exploit-path analyses across enterprise environments. The implication is that severity alone is no longer enough. Security teams need evidence: • Is the vulnerable code path reachable? • Is it exposed? • Is exploitation occurring? • Would existing controls stop it? In one example, a fleet of 1,200 nginx instances was reduced to just 3 systems requiring emergency action once runtime evidence was applied. The debate about whether AI will change vulnerability management is over, and now it's time to execute. How is your team prioritizing vulnerabilities when discovery is outpacing remediation?

Tuskira Threat Brief: Week of June 22, 2026 Alert Infrastructure Hijacks, Security Vendor Supply Chain Hits, and Router Botnets Cyberattack triggers false emergency alerts across Brazil  Source: The Record from Recorded Future News  ▪️ TL;DR: Brazil suspended its mobile alert system after a cyberattack broadcasted false crisis warnings to phones across multiple states. ▪️ Key Points: Threat actors compromised the cell-broadcast gateway; triggered localized panic; highlights extreme fragility in national communications infrastructure. ▪️ Our POV: This is cognitive warfare targeting societal trust. If business logistics rely on public warning infrastructure, build a secondary validation channel. Treat notification platforms as unauthenticated inputs until cross-referenced. Klue hack breaches data at major cybersecurity firms Source: TechCrunch ▪️ TL;DR: Market intelligence vendor Klue suffered a breach, allowing hackers to steal customer data belonging to top-tier cybersecurity firms. ▪️ Key Points: Targets competitive intelligence repositories; stolen data includes roadmap strategies and win/loss analytics; exposes a blind spot in the vendor ecosystem.  ▪️ Our POV: This is corporate espionage targeting defenders. Knowing a security firm's roadmap allows attackers to map future evasion strategies. Limit technical details uploaded to third-party sales and marketing tools. Audit data retention limits for external SaaS repositories. AryStinger botnet infects thousands of D-Link routers Source: BleepingComputer ▪️ TL;DR: A new botnet named "AryStinger" has compromised 4,000+ legacy D-Link routers, turning them into proxies for malicious traffic.  ▪️ Key Points: Targets unpatched, end-of-life edge hardware; compromised IPs are leased to threat groups to bypass geographic network restrictions and firewalls. ▪️ Our POV: Dead hardware is a permanent attacker staging ground. Audit remote worker networks for EOL edge devices. Enforce a hard replacement policy for hardware missing modern security microcode updates. Final Word: From civic cell towers to market research databases and legacy residential routers, attackers are leveraging the soft outer edge of technology to cause disruption and hide tracks. High-impact defense requires auditing your secondary asset inventory. Stay preemptive.

This recap from our recent Cyber Security Tribe webinar explores what Anthropic's Mythos could mean for CISOs, from evolving threat models and accelerated vulnerability management to the governance and leadership decisions security teams need to make now. Key takeaway: preparing for the next wave of AI-powered cyber capabilities starts today. If you want to hear the panelists, Alan Berry, Jason Barnes and Frank DePaola share their thoughts, you can watch the full on demand video here:https://lnkd.in/edg56iQ7 Thank you Tuskira for your sponsorship and Piyush Sharrma for your insights for the article. #CyberSecurity #CISO #AI #RiskManagement #CyberLeadership https://lnkd.in/eNFPiZEu

Most discussions about Shadow AI start with unauthorized AI tools, but the security experts in our latest AI Security Council workshop think that's the easy part. The harder problem? AI showing up inside browsers, SaaS platforms, local models, automation workflows, and autonomous agents, often within systems we already trust. A huge thank you to AJ D., Chris Zupa, Pratik Savla, Gerard Johansen, Pete A., Ryan René Rosado, Scott McDonough, Dr. Sean E., Emilio M., and Chris Kirschke for contributing their perspectives to our latest research paper: "Detecting Shadow AI: Why the illusion of control is the enterprise's biggest AI security problem." The report examines what happens when AI inherits the permissions, workflows, and security debt already embedded in the enterprise. Download the paper here (ungated): https://lnkd.in/ehCi4X2h Every AI Security Council paper begins as a candid discussion among practitioners. If you'd like a seat at the table, apply to join our community of security leaders shaping the future of AI security. https://lnkd.in/ejMt4SDt.