F5 zero-day hit before a patch existed as AI-agent security funding keeps flowing
A critical F5 zero-day already under attack before a patch existed anchors a week where AI-agent security funding kept flowing (Cyera, then Island, each landing nine-figure rounds), suspected North Korean hackers pulled off a $351.6 million exchange heist, and counter-drone hardware kept multiplying, from Army lasers at the border to Marine systems in the Middle East. If you read only one story, make it the F5 flaw: it sits inside access-control infrastructure most networks treat as trusted.
This week's pick
- F5 patches critical BIG-IP APM zero-day exploited for unauthenticated RCE Attackers already had a working exploit before a patch existed, in access-control infrastructure many networks treat as trusted.
OSINT
- Spy agency wants AI to geolocate any video IARPA opened a program seeking AI that can geolocate any unlabelled video or audio clip in under five minutes, with no location metadata at all.
- New satellite images reveal China's next SSN design A rare dry-dock shot let analysts confirm the stern design of China's next-generation attack submarine without relying on partial, waterborne images.
- Old fire videos falsely tied to Moscow strikes Recycled footage spread within hours of real strikes, filling the information gap before verified imagery could catch up.
- Govmap exposed unblurred imagery of Gaza-area IDF bases Israel's own mapping portal briefly showed unblurred military sites that should have been masked.
- The Insider maps a Kremlin-run Telegram network posing as "angry Latvians" A repost-network analysis of 72 channels and 353,000 posts found a third of Latvia's socio-political Telegram channels, and 65 per cent of its Russian-language ones, are run by Kremlin-aligned operators.
Drones
- US Army tests AMP-HEL high-energy laser for counter-drone operations at the southern border A vehicle-mounted, soldier-portable laser reached field trials at the border, a step towards directed-energy weapons that skip interceptor munitions entirely.
- US Marines deploy mobile L-MADIS counter-drone system to shield dispersed forces in the Middle East CENTCOM is now the second theatre in three months confirmed to field the Marine Corps' standard mobile answer to small hostile drones.
- Beijing moves from drone registration to an outright ownership ban The city is converting a registration regime into a possession ban in under six months, the sharpest tightening of drone rules in any major city this year.
- Luxembourg airport drone sightings join a run of disrupted European airports Findel becomes the latest of several 2025-26 European airports hit by unexplained drone activity, adding pressure for permanent detection systems.
- DroneShield opens $13m Adelaide counter-drone R&D hub as threat picture accelerates The company is betting counter-drone demand will keep outpacing what its existing footprint can build.
VC Investment
- Island raises $400M Series F at $6.4B valuation to govern AI agents alongside human workers Evolution Equity Partners leads a round extending the enterprise-browser maker's pitch into securing AI agents working alongside employees.
- Cyera raises $400M from Goldman Sachs at $12B+ valuation to secure AI agents A second nine-figure cheque into Cyera in three months shows institutions treating AI-agent security as a fast-growing category on its own.
- Nscale raises $3.36B pre-IPO convertible round led by Third Point, targets $35B NYSE valuation Nvidia is putting in $1B of the round on top of its existing stake, echoing the circular chipmaker-to-cloud financing scrutiny already dogging rival CoreWeave.
- NatWest makes first-ever VC fund bet, backing Phoenix Court's Monzo-and-Raspberry-Pi portfolio A high-street bank taking its first direct stake in a VC fund signals UK institutional money moving from banking startups to becoming an LP in the funds themselves.
- Oura's IPO looks more like an exit ramp for Forerunner Ventures than a fundraise Most of the roughly $532.6 million Oura stands to collect is earmarked for employee tax bills, leaving the company only about $6.2 million for general use.
CyberSecurity
- Suspected North Korean hackers steal $351.6 million from Bitget in backend wallet breach Attackers forged transaction data to bypass a wallet service's authorisation checks and drained funds across seven blockchains, the latest big nine-figure hit tied to North Korean operators.
- Zyxel switch flaw let Chinese hackers gain root-level access, CISA gives three-day patch deadline Nearly 1,000 exposed switches, many still on default credentials, gave one actor root-level access into networks worldwide.
- Microsoft-led takedown disrupts EvilTokens phishing service tied to 12,000 hacked inboxes Device-code phishing sidesteps passwords and MFA entirely, and this service sold dozens of phishing kits by subscription.
- Colorado water utility hit by cyberattack on internet-exposed industrial control systems Small water utilities often run internet-exposed industrial control systems with thin security staffing, a pattern CISA has already flagged nationally.
- Three actively exploited Linux kernel flaws get a CISA patch deadline All three flaws sit in code every Linux server and container runs, and CISA is treating it as live exploitation, not theoretical risk.