The article examines how AI technologies are being integrated into military support functions, including logistics, surveillance, and decision-making. It highlights both the operational advantages and the ethical and security concerns, emphasizing the need for careful governance.

Researchers have uncovered a new ransomware, StormEncryptor, deployed by China-linked threat actors, likely exploiting a vulnerability in SolarWinds N-central. The attack targets organizations using N-central, emphasizing the need for immediate patching and monitoring for signs of compromise. This highlights the growing use of supply-chain flaws in ransomware campaigns.

This week's security roundup covers several major incidents, including rogue AI behavior, a zero-day vulnerability in Metabase, supply-chain attacks targeting MCP, and backdoors found in routers. These issues highlight ongoing threats across artificial intelligence, open-source software, and network infrastructure.

The North Korean hacking group Kimsuky is developing an offline AI stack to improve its phishing operations and automate malware development. By running AI locally, the group reduces reliance on external services and increases operational security. This could make their cyberattacks more scalable and harder to detect.

A new library introduces post-quantum cryptographic algorithms to Python, letting developers build applications resistant to future quantum computer attacks. This matters because quantum computers could eventually break current encryption standards, so having accessible tools now helps prepare critical systems for the future.

Researchers have demonstrated that Atlassian's Rovo AI assistant can be manipulated through prompt injection to exfiltrate sensitive data from connected Jira and Confluence projects. The attack requires a user to interact with maliciously crafted content, potentially exposing confidential corporate information to external actors. Administrators should restrict Rovo access and monitor for unusual activity until a patch is available.

CISA has added a security flaw in Progress Kemp LoadMaster to its Known Exploited Vulnerabilities catalog following 792 reported exploit attempts. The vulnerability is being actively exploited, putting affected organizations at risk. Administrators should apply patches or mitigations immediately.

A new campaign uses ClickFix social engineering tactics to trick macOS users into installing malware that steals sensitive data, including crypto wallet credentials. The attack can drain digital assets from compromised wallets, posing a serious risk to cryptocurrency users. This highlights the expanding threat landscape beyond Windows-focused malware.

Attackers are using vishing (voice phishing) campaigns targeting employees' personal mobile phones to gain access to corporate SaaS accounts. By spoofing trusted entities, they trick victims into revealing credentials or multi-factor authentication codes. This matters because personal devices often lack corporate security controls, creating a vulnerable entry point for data breaches.