600 Firewalls Breached by AI in 5 Weeks — Plus Chrome Zero-Day, CVSS 9.9 RCE & AI-Powered Malware | HN63

AI is reshaping both sides of the cybersecurity battlefield — and fast. In this episode, we break down five stories that prove it: the first Chrome zero-day of 2026 (CVE-2026-2441), a near-perfect CVSS 9.9 in Microsoft's Semantic Kernel SDK (CVE-2026-26030), a supply chain attack on AI coding assistant Cline that silently installed autonomous agents on thousands of developer machines, the first-ever Android malware using Google's Gemini AI at runtime (PromptSpy), and a Russian-speaking threat actor who used commercial AI tools to breach over 600 FortiGate firewalls across 55 countries in just five weeks.

Whether you're a developer, security professional, or just someone who uses a browser — this one's worth your time.

🔔 Subscribe and hit the bell so you don't miss an episode! 🎧 Also available on Spotify, Apple Podcasts, and wherever you get your pods.

---

### ⏱️ Timestamps

0:00 — Hook: AI Is Reshaping Cybersecurity 1:08 — Welcome & CTA 1:49 — Story 1: Chrome Zero-Day CVE-2026-2441 (CVSS 8.8) 5:15 — Story 2: Microsoft Semantic Kernel RCE CVE-2026-26030 (CVSS 9.9) 7:58 — Story 3: Cline CLI Supply Chain Attack — OpenClaw Installed on 4,000 Machines 14:35 — Story 4: PromptSpy — First Android Malware Using Gemini AI 20:15 — Story 5: 600 FortiGate Firewalls Breached via AI-Assisted Campaign 25:57 — Recap & Key Takeaways 28:46 — Outro

---

### 📰 Story Summaries

**Story 1 — Chrome Zero-Day: CVE-2026-2441 (CVSS 8.8)** Google patched the first actively exploited Chrome zero-day of 2026 on February 13th. It's a use-after-free vulnerability in Chrome's CSS engine — specifically in the CSSFontFeatureValuesMap implementation — caused by an iterator invalidation bug. An attacker can craft a malicious HTML page to achieve arbitrary code execution inside Chrome's sandbox. Reported by researcher Shaheen Fazim on Feb 11, patched two days later. Affects ALL Chromium-based browsers: Chrome, Edge, Brave, Opera, Vivaldi. Patched in Chrome 145.0.7632.75/76 (Win/Mac) and 144.0.7559.75 (Linux).

**Story 2 — Semantic Kernel RCE: CVE-2026-26030 (CVSS 9.9)** A critical remote code execution vulnerability in Microsoft's Semantic Kernel Python SDK — specifically in the InMemoryVectorStore filter functionality. CWE-94: Improper Control of Code Generation. Network-accessible with low attack complexity, low privilege required, and zero user interaction needed. If you're building AI applications with RAG, AI agents, or semantic search using Semantic Kernel, this one hits close to home. Patched in python-1.39.4. Microsoft's workaround: avoid using InMemoryVectorStore in production until patched.

**Story 3 — Cline Supply Chain Attack** On February 17, 2026, someone compromised Cline's npm publish token and pushed a malicious update (Cline CLI v2.3.0) that silently installed OpenClaw — a self-hosted autonomous AI agent — on every developer machine that pulled the update. The attack chain started when researcher Adnan Khan discovered a prompt injection vulnerability in Cline's AI-powered GitHub issue triage bot. The attacker used GitHub Actions cache poisoning to pivot from the triage workflow to the release pipeline, leaking npm publication credentials. Cline patched the prompt injection within 30 minutes but rotated the wrong token. Eight days later, the still-valid token was used to publish the compromised package. It was live for ~8 hours and downloaded roughly 4,000 times. Fixed in v2.4.0; publishing moved to OIDC via GitHub Actions.

**Story 4 — PromptSpy: First Android Malware Using Generative AI at Runtime** ESET researchers discovered PromptSpy — the first known Android malware to use Google's Gemini AI model during its execution flow. Traditional Android malware relies on hardcoded tap coordinates and UI selectors that break across different devices. PromptSpy solves this by taking an XML dump of the current screen and sending it to Gemini, which returns JSON instructions telling the malware exactly where to tap. It uses this loop to