AI Hunts Bugs, Hackers Hijack Routers, and Cybercrime Hits $21B: This Week's Biggest Security Moves

Analysis

Anthropic's Claude Mythos Found Thousands of Zero-Days — So They Locked It Away and Called It Project Glasswing

Anthropic's unreleased frontier model Claude Mythos autonomously found thousands of critical zero-days across every major OS and browser, including a 27-year-old OpenBSD bug — without being explicitly trained to do so. Rather than release it, Anthropic handed early access to AWS, Apple, Google, Microsoft, Cisco, and 40+ other orgs under Project Glasswing, backed by $100M in compute credits. The clock is ticking: security experts warn open-weight models will catch up in roughly six months, at which point every ransomware crew gets the same capability.

Why Cybersecurity Experts Are Rattled by Mythos: 'Six Months Until Open-Weight Models Catch Up'

Alex Stamos (former Facebook/Yahoo security chief) put the urgency in plain terms: once open-weight models hit the same bug-finding capability as Mythos, ransomware groups get autonomous zero-day discovery at near-zero cost with no forensic trail. Platformer rounds up expert reaction to Project Glasswing and surfaces the uncomfortable truth that Anthropic now holds a private stockpile of unpatched exploits in virtually every major software project. The model weight theft risk just went up significantly too.

Threat Intelligence

FBI and DOJ Disrupt APT28's FrostArmada: 18,000 Routers Hijacked to Steal Microsoft 365 Credentials

Russia's APT28 (Fancy Bear/Forest Blizzard) compromised MikroTik and TP-Link SOHO routers at scale, silently rewriting DHCP/DNS settings to redirect authentication traffic through GRU-controlled servers that harvested passwords and OAuth tokens — bypassing MFA in the process. At peak activity in December 2025, the botnet touched 18,000 IPs across 120 countries before an international law enforcement op and FBI court-authorized DNS resets killed the infrastructure. If your org has remote workers on home routers, this is a concrete reason to enforce certificate pinning and audit your conditional access policies now.

Vulnerability

Docker CVE-2026-34040: One Padded HTTP Request Bypasses Your Entire Authorization Stack

Cyera Research found that sending an API request body larger than 1MB causes Docker to silently drop it before the AuthZ plugin sees it — but the daemon still executes the payload, creating privileged containers with full host filesystem access. It's an incomplete fix for the CVSS 10.0 CVE-2024-41110 from 2024, and it works against OPA, Prisma Cloud, and every other AuthZ plugin equally. Patch to Docker Engine 29.3.1 now; public PoCs are already on GitHub.

CISA Adds Fortinet FortiClient EMS to KEV Catalog — CVE-2026-35616 Now Actively Exploited

CISA confirmed active exploitation of an improper access control flaw in Fortinet FortiClient EMS that lets unauthenticated attackers execute unauthorized code or commands via crafted requests. Federal agencies have until the mandated remediation deadline, but if Fortinet is in your stack you should treat this as urgent regardless — Fortinet vulns in enterprise VPN and endpoint tooling have a consistent track record of rapid weaponization.

News

Stryker Files 8-K/A Confirming March Cyberattack Was Materially Damaging to Q1 Results

Stryker just upgraded its SEC disclosure from "possible" to "confirmed material impact" on Q1 2026 financials after Iran-linked Handala group used compromised Microsoft Intune admin credentials to remote-wipe an estimated 80,000+ devices across global operations. Operations are restored, but the full financial damage lands on April 30 at the Q1 earnings call — and the investigation is still open. This is a textbook example of why MDM admin accounts need phishing-resistant MFA and dual-approval for mass operations.

Report

FBI IC3 2025 Report: Cybercrime Losses Hit $20.9B, Topping 1 Million Complaints for the First Time

The FBI's annual Internet Crime Report dropped this week with a record $20.9 billion in reported losses — up 26% year over year — and for the first time ever includes a dedicated section on AI-enabled scams, which racked up $893 million across 22,000+ complaints. Crypto fraud dominated at $11B+, and Americans over 60 bore $7.7 billion of the damage. The numbers are almost certainly understated given how few victims report, making this a floor, not a ceiling.