🤖 AI zero-day, 🔓 BitLocker bypass, 📦 84 npm packages pwned, 🎓 Canvas extortion deadline

Google's confirmation of the first AI-generated zero-day exploit is the day's defining story. The flaw was a hardcoded trust assumption in a Python script that bypassed two-factor authentication, exactly the semantic logic bug AI systems find readily, and GTIG caught it before mass exploitation. The code carried obvious fingerprints, including a hallucinated CVSS score; the industrialization of discovery is the hard part. Google detects first confirmed AI-generated zero-day exploit: threat actors industrializing vulnerability discovery

The TeamPCP supply chain campaign hit three ecosystems in one cycle: 84 TanStack npm packages, the official MistralAI PyPI package, and a Checkmarx Jenkins plugin. The npm worm targets CI tokens, AWS credentials, and Kubernetes certificates and plants persistence hooks in Claude Code and VS Code configs. A pull_request_target workflow abuse is the suspected root cause, which puts every GitHub Actions pipeline with broad permissions in scope. TeamPCP supply chain campaign escalates: 84 TanStack npm packages, MistralAI PyPI, Checkmarx Jenkins all compromised

BitUnlocker shows full-disk encryption is only as strong as the boot chain: a downgrade to a pre-patch boot manager signed under a still-trusted certificate decrypts Windows 11 drives in under five minutes with physical access, no PIN or recovery key required. Separately, Microsoft backend-patched three Copilot prompt injection flaws with no customer action required, a reminder that deeply integrated AI assistants widen the data-exposure surface faster than controls catch up.