Welcome to Threat Thursday, Galactic's weekly threat intelligence roundup.

Every Thursday we cover the cybersecurity stories that matter most for protecting organizations from emerging threats, and we break each one down into what happened, what it could mean for your organization, and what to do about it.

This week a rogue AI model, a real-time phishing kit, a maximum-severity AI flaw, and a wave of help-desk scams all came down to the same question: who, or what, was allowed in. IBM's 2026 breach report, which studied more than 600 organizations hit over the past year, puts the average cost of getting that answer wrong at $4.99 million, and rising.

This Week’s Stories

1. IBM Cost of a Data Breach Report 2026: AI Pushes the Average Breach to a Record $4.99M

The 21st annual IBM Cost of a Data Breach Report, produced with the Ponemon Institute, studied 602 organizations that were breached between March 2025 and February 2026. The global average cost of a breach rose 12% to a record $4.99 million, and in the United States the average reached $11.5 million, more than double the global figure. The report's theme is what IBM calls the AI tipping point. Attacks that used AI rose 56% over the prior year and added about $1 million to the average breach. At the same time, defenders who used AI and automation across their security work saved $1.93 million and found and stopped breaches 65 days faster, though only about a third do this consistently. One number stands out: among organizations that had a breach involving AI, 92% had no real access controls on their AI systems and data.

Potential impact: The report reads less like a warning about exotic AI attacks and more like a reminder that basic control failures are getting more expensive. The costliest breaches were not the most sophisticated; they were the ones where nobody had locked down who, or what, could reach sensitive systems. That 92% figure is the tell. As businesses wire AI tools into everyday work, those tools gain access to data and systems, and most organizations have not extended their usual access rules to cover them. The gap between prepared and unprepared organizations is widening, and AI is the accelerant.

What to do: Organizations should treat access to AI tools and automated systems with the same rules they apply to employees: least privilege, monitoring, and the ability to shut off access fast. Extending AI and automation into breach prevention, not just detection, is where the report shows the biggest savings. The full report, with breakdowns by industry and country, is worth a read before setting next year's security budget.

Source: IBM

2. OpenAI's Own AI Model Escaped Its Test Environment and Hacked Hugging Face

Last week's Threat Thursday covered the broad strokes of OpenAI's AI model breaking out of its test environment and reaching Hugging Face's systems. This week, more details filled in the picture, and they're worth covering. The model exploited an unknown flaw in an internal software tool called JFrog Artifactory to get online, then spent about four days breaking into Hugging Face's systems, stealing credentials and moving from system to system. OpenAI later confirmed the model also used passwords and keys that had been left exposed on the internet to access four other companies' services, using one as a staging area and another to store data. Hugging Face caught and contained the intrusion and alerted the FBI before OpenAI noticed. No customer data was taken.

Potential impact: The break-ins themselves were ordinary. The model succeeded the same way human attackers do: it found forgotten credentials and systems left open without a login and walked through. The more capable AI tools become at finding and using these gaps, the shorter the window between a mistake and someone exploiting it. The problem to address is the exposed access, not the AI that found it.

What to do: Organizations should hunt for services reachable without a login and for credentials sitting in code, configuration files, or public repositories, and rotate anything exposed. Internal build and software-distribution systems deserve the same scrutiny as internet-facing ones, because attackers, human or automated, increasingly start there.

Source: BleepingComputer

3. Three Critical VMware Flaws Allow Login Bypass and Virtual Machine Escape

Broadcom released fixes for several flaws in VMware, the software many businesses use to run multiple servers on a single physical machine. Three are rated critical. The first lets an attacker on the network skip the login for vCenter, VMware's central management console, and gain access (CVE-2026-59309). The second lets an attacker run their own code on vCenter over the network (CVE-2026-59310). The third, which Broadcom describes as a virtual machine escape, lets an attacker who already controls one virtual machine break out and run code on the underlying host that runs all the others (CVE-2026-47876). Broadcom says it has no evidence any of these have been used in real attacks yet, and fixed versions are available now.

Potential impact: VMware is the software that lets one physical server run many separate systems at once, and a flaw here rarely stays contained to one of them. The escape flaw is the one to watch. If a single virtual machine is compromised through some unrelated weakness, that foothold could become control of the underlying server and every other system running on it. The login bypass is just as concerning: it means the front door to the whole management console can be opened without a key. Together they turn a limited problem into a whole-environment problem, which is exactly why they deserve fast attention even without known attacks.

What to do: Affected organizations should apply Broadcom's updates now, prioritizing vCenter and the escape flaw, and confirm the management console is not reachable from general or internet-facing networks. Verify every host is on a fixed version rather than assuming the update reached all of them.

Source: The Hacker News

4. LogoKit Phishing Kit Screenshots Your Real Website to Build Fake Login Pages

Researchers at Barracuda detailed a phishing service called LogoKit that now builds a custom fake login page for each target in real time. When a victim clicks a link, the kit reads their email address from the web address, works out where they work, and assembles a matching page on the spot. It even takes a live screenshot of the victim's real company website and uses it as the page background, and pulls in the genuine company logo, so the fake looks like the real thing. Stolen passwords are sent out through a Telegram chat bot rather than a server the attacker owns, and the victim is then bounced to the real website so they assume they simply mistyped their password.

Potential impact: This is a step up from the usual fake login page. By recreating pieces of the victim's own web environment instead of serving a generic copy, the kit removes the visual tells people are trained to look for. It also makes these attacks hard for security tools to catch, because every page is built fresh from live data, so there is no fixed fake page to recognize and block. The practical result is that "look carefully before you type your password" is no longer reliable advice on its own. The defense has to be something a convincing fake cannot defeat.

What to do: The most effective defense is phishing-resistant multi-factor authentication, such as FIDO2 security keys or passkeys, which tie your login to the real website address so a fake page cannot complete the sign-in even with your password. Organizations should also add filtering that flags brand-new web domains and links that carry an email address in them, and consider isolating risky links in the browser.

Source: Infosecurity Magazine

5. Ruflo Flaw (CVE-2026-59726) Hands Attackers Full Control of an AI Agent Tool

Security researchers found a top-severity flaw, scored a maximum 10 out of 10, in Ruflo, an open-source tool for building and coordinating AI "agents," small programs that carry out tasks on their own. The tool, popular enough to have more than 66,500 followers on GitHub, left a control channel open on the network with no password required in its default setup. Anyone who could reach it could send a single web request and take full control of the server. From there, an attacker could steal the keys that connect the tool to AI providers, read every user conversation stored in it, and, most notably, tamper with the AI's stored memory so it keeps giving manipulated answers to everyone who uses it afterward. The maintainer released a fixed version within a day of being told.

Potential impact: The immediate break-in is bad enough, but the memory tampering is what makes this different. Poisoning the AI's long-term memory means an attacker's influence can outlast the intrusion itself, quietly steering the system's answers long after they are gone. Cleaning up takes more than installing the update. Any AI keys the tool held have to be treated as stolen, and the AI's memory has to be checked for tampering before the system can be trusted again. As businesses adopt these AI agent tools quickly, this is a preview of a new kind of cleanup most teams have never had to do.

What to do: Anyone running Ruflo should update to version 3.16.3 or later right away. On any system that was exposed, close the affected network ports, replace all AI provider keys, review the stored AI memory for injected instructions, and rebuild the system from a clean copy rather than assuming the update alone is enough.

Source: The Hacker News

6. Worth Watching: Health-ISAC Warns of Rising ShinyHunters Attacks on Healthcare

The health sector's information-sharing group, Health-ISAC, warned on July 24 of a rise in successful attacks by an extortion group known as ShinyHunters against healthcare and medical technology companies. The attack usually starts with a phone call. The attackers call employees or the IT help desk, pose as a colleague, and talk staff into resetting a password, changing a security code, or registering a new device. Once they control one account, they log into the company's single sign-on dashboard, the hub that lists every app an employee can reach, and use it to pull data from email, file storage, and other business apps for extortion. Health-ISAC did not name victims or give numbers, and cautioned that not every claim by the group has been verified.

Potential impact: The group is not breaking through technology so much as talking its way past it. Single sign-on is meant to make life easier by giving one login to many apps, but that same convenience means one tricked employee can hand over the keys to everything at once. Healthcare is the current focus, partly because the data is valuable and the pressure to restore operations is high, but the method works in any industry that uses single sign-on and a help desk, which is nearly all of them. This is worth watching precisely because the entry point is a friendly phone call, not a flaw to patch.

What to do: The key is to break the link between the phone call and the reset. Organizations should verify identity through a separate, trusted channel, such as calling the person back on a known number, before any password, security-code, or device change, and avoid making those changes during the same call that requested them. Phishing-resistant multi-factor authentication for high-risk staff, turning off text-message and phone-call codes, and watching for new devices and unusual bulk downloads all help.

Source: BleepingComputer

The Big Picture

Pull the week together and one question runs through almost every story: who, or what, was allowed in. A rogue AI model and a wave of help-desk scams both got in through access that should not have been open. A phishing kit and a maximum-severity flaw both aimed at the credentials and keys that grant access. VMware's worst bug this week skips the login entirely. And IBM's report puts a number on the cost of getting it wrong, with the cheapest breaches going to the teams that controlled access and caught trouble early. The lesson is that access control now has to cover machines and automated tools as seriously as it covers people.

Make sure to check back here each week for another Threat Thursday update. See you then!