⚡ Weekly Recap: AI Automation Exploits, Telecom Espionage, Prompt Poaching & More

This week’s recap highlights how small oversights can trigger large-scale cyber incidents, with high-profile flaws and misconfigurations driving widespread impact. A maximum-severity flaw in the n8n workflow automation platform, tracked as CVE-2026-21858, enables unauthenticated remote code execution and potential full system compromise, and was discussed alongside several related n8n CVEs.

Two Chrome extensions were found exfiltrating OpenAI ChatGPT and DeepSeek conversations, a technique dubbed Prompt Poaching that targeted about 900,000 installations before Google removed the extensions; the report notes that the risk extends to browsing data as well. The Top News section also covers a long-running UAT-7290 threat campaign targeting telecoms with Linux malware, and a separate analysis of a China-linked VMware ESXi exploit toolkit reportedly developed before the disclosed zero-days.

Other rapid-fire items include Kimwolf, an Android botnet infecting over 2 million devices via exposed ADB and proxy networks, and a critical zlib vulnerability (CVE-2026-22184) with a 9.3 CVSS that could cause memory corruption and potential code execution. According to Field Effect, the Ni8mare flaw in n8n hinges on how the platform processes multipart/form-data and could enable full-system compromise, underscoring how attackers exploit familiar tools with little new ingenuity.