A rogue AGENTS.md file in a Downloads folder was enough to redirect an AI coding agent into installing a malicious npm package. Using GitHub Copilot or any agentic tool against your Terraform or Bicep repos? Workspace hygiene is now a threat surface. h/t BleepingComputer

Two critical RCEs tracked as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) are now being exploited. If PHP-based web apps touch your AVD management plane or any internet-facing tooling in your Azure landing zone, patch timeline just moved to now. h/t BleepingComputer

An unpatched PHP RCE with no fix available yet - mitigations only. Does PHP run anywhere in your AVD supporting infrastructure? Session host app stacks, internal web apps served through AVD, or management portals all count. Worth an inventory check before this one gets a working exploit. (via BleepingComputer)

Torvalds on AI-generated kernel patches: the question is no longer whether AI was used, but whether the output is any good. That framing applies directly to IaC. AI-generated Terraform for AVD landing zones has the same problem - competent review catches the subtle misconfigurations, and no review ships them to production. (via The Register)

Three signals worth flagging from this week's security roundup: banks are actively detecting rogue AI agents inside their environments, self-rebuilding ransomware is now a macOS reality, and APT28 is targeting NATO defense firms. The rogue agent detection angle is the one to watch - that problem is coming to every enterprise AI deployment. h/t SecurityWeek

AI agents can be redirected mid-task through malicious emails, web content, or plugins - using their legitimate permissions to steal data or delete files. Before you wire Copilot or any agentic tool into your AVD management plane, the trust boundary question needs an answer. This is the prompt injection problem at enterprise scale. (via BleepingComputer)

China-aligned Storm-0940 is using the open-source AI pentest framework Artex to automate attacks via ConnectWise. If ConnectWise ScreenConnect or Automate touches your AVD or Nerdio management plane, treat this as active threat intel. Privileged access to RMM tools is a direct path to session host compromise. h/t SecurityWeek

Copilot governance is not just a licensing question. Data classification gaps, overshared SharePoint, and missing DLP policies will surface immediately once Copilot starts summarizing meetings and drafting from mailbox context. Most AVD shops enabling M365 Copilot for VDI users are not ready for what it can reach. (via Nerdio)

Environment variables holding secrets in a cloud platform got exposed in the Railway breach. How many Terraform pipelines and NME scripted actions store secrets in environment variables rather than Key Vault references? This is a good prompt to audit your secret hygiene across AVD automation. h/t BleepingComputer

PHP2Shell is bypassing RCE protections that admins assumed were solid. Researcher notes adversaries are burning real compute iterating on this. Any PHP-based management interface exposed from your AVD or EUC environment should be patched or isolated before this gets weaponized at scale. (via The Register)