This week's edition covers three developments that, taken together, describe a widening gap between how fast software supply chains and AI tooling move and how slowly most medium enterprises are able to verify what they have actually installed, patched, or authorized. The first is a self-propagating worm that spread through some of the most widely used utility packages in the JavaScript ecosystem, reaching an estimated two billion monthly installs across more than two thousand affected package versions before defenders caught up with it. The second is an actively exploited Windows privilege escalation flaw disclosed in this month's Microsoft Patch Tuesday release, paired with a public bypass of Microsoft's own emergency fix released within hours of the patch going out. The third is a now-patched but only recently well understood flaw in a major AI vendor's agent-building tool, one that shows how a single clicked link can hand an attacker a fully autonomous, permissioned employee inside a company's own systems.
Get every edition free: subscribe to Frederick Weekly.