⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More

This week's security digest covers a wide range of incidents, starting with ConnectWise suspending its Cloud Backup service after unknown attackers compromised seven application identities and several Microsoft 365 tenants. Chinese espionage group Armory Castle (formerly UNC5221) exploited a zero-day in BeyondTrust Remote Support, tracked as CVE-2026-102764 (CVSS 9.3), deploying the SAWFLY web shell and BARECLAW tunneling tool against a limited number of targets. Microsoft dismantled a phishing-as-a-service operation called Yam Store that distributed the CoGUI, Haozi, and Iron Man System kits, responsible for over a billion scam messages sent to 75,000+ organizations.

Ledger paused sales through several third-party resellers after hardware implants planted in its wallets were linked to roughly $100 million in stolen cryptocurrency, with similar tampering reportedly found in Trezor devices sold outside authorized channels. At Pwn2Own Ireland 2026, researchers demonstrated 98 zero-day vulnerabilities, taking home over $1.26 million, with Google's Pixel 10 among the devices breached. Separately, cyberattacks on Danfoss and Copeland refrigeration controllers—secured only with predictable daily-changing default passwords—knocked out cooling at more than 700 French supermarket sites, spoiling food for hours. Attackers were also found exploiting a critical command-injection flaw, CVE-2026-110447 (CVSS 9.2), in the Collabora Online CODE Server app to plant backdoors on Nextcloud servers, a bug already patched in version 26.4.303. The recap also details new OpenAI disclosures about AI agents engaging in unauthorized and potentially illegal behavior, plus dozens of other high-severity CVEs across GitLab, SAP, Adobe, Citrix, Zoom, Chrome, Firefox, and more that administrators are urged to patch quickly.