AI Ransomware, NetScaler Flaw & Linux VM Escape (07/06/2026)

Today’s stories point one direction: the cost of running an attack keeps dropping. An AI agent executed a real ransomware intrusion from start to finish, a NetScaler flaw went from proof-of-concept to active exploitation in days, and a bug that sat in the Linux hypervisor for sixteen years lets a guest virtual machine break out onto the host it runs on.

Top 5 Critical Security Alerts

1. An AI Agent Ran a Complete Ransomware Attack

An “agentic threat actor” exploited a flaw in Langflow to steal data from a production database and encrypt other systems, in what Dark Reading calls the first complete LLM-driven ransomware attack. The detail that matters, per TechCrunch’s reporting, is that a human still picked the victim and stood up the infrastructure. The model handled execution, not intent.

Operator Note: When execution gets cheap, your window between exposure and exploitation shrinks. Expect more attempts, not smarter ones, and shorten your patch and detection cycles to match.

2. NetScaler Flaw Under Attack, CitrixBleed All Over Again

Attackers began hitting a new memory-disclosure flaw in Citrix NetScaler within days of researchers publishing a proof-of-concept, a near-replay of the original CitrixBleed (Dark Reading). Memory-disclosure bugs on an internet-facing appliance leak session tokens, and a stolen session skips your authentication entirely.

Operator Note: Edge devices are the cheapest door an attacker will try. If you run NetScaler, treat this as a same-week patch, not a next-quarter one.

3. 16-Year-Old Linux KVM Bug Lets a Guest Escape to the Host

A use-after-free flaw in Linux’s KVM hypervisor, present for sixteen years and dubbed Januscape, can be triggered from inside a guest virtual machine to corrupt the host kernel’s memory on both Intel and AMD systems (The Hacker News). VM escape is the exact failure mode multi-tenant clouds are built to prevent, so one compromised tenant reaching the host puts every tenant on that host in the blast radius.

4. BusySnake Infostealer Hits Critical Infrastructure

A group researchers track as Armored Likho used the BusySnake infostealer to breach government agencies and electrical power entities in Russia, Brazil, and Kazakhstan (Dark Reading). Infostealers are the quiet first stage: reconnaissance and credential harvesting that set up the loud stage later.

5. Iran-Linked Group Aims New C2 at Israeli Organizations

An Iranian group tied to the Ministry of Intelligence deployed a previously undocumented modular command-and-control framework, Cavern, against Israeli government and IT-sector organizations (The Hacker News). State-linked C2 against a specific sector is a targeting signal. If you sit in that supply chain, assume you are on the list.

Additional Security Alerts

Threat Intelligence

• Canada ran offensive cyber operations in 2025: Canada’s CSE disclosed operations against a ransomware-as-a-service gang, a foreign extremist group, and drug traffickers. The Record
• Attackers voted themselves $20M in BONK: A malicious governance proposal let holders drain roughly $20 million from BonkDAO, a reminder that on-chain governance is an attack surface. The Record

Security Breaches & Incidents

• Medical device maker notifies nearly 4 million: Social Security numbers and health data were accessed in a breach at a major medical device manufacturer. The Record

Social Engineering

• EtherRAT via fake Teams IT support: Attackers impersonate corporate IT on Microsoft Teams voice calls to trick employees into installing EtherRAT for initial access. BleepingComputer
• Job-interview phishing at scale: A campaign impersonating more than 30 brands, including Adobe, Netflix, and OpenAI, uses fake job interviews to steal Google credentials. BleepingComputer

Emerging Security Technology

• Prompt injection targets AI agents: Zscaler found websites hiding prompt-injection text to manipulate AI agents into making crypto payments. Infosecurity Magazine

Security Tools & Best Practices

• Cloudflare adds granular AI bot controls: Site owners can now manage search, training, and agent crawlers separately instead of blocking all AI bots at once. The Decoder

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.