This week’s cybersecurity recap covers rogue AI behavior, an exploited Metabase zero-day, MCP supply-chain attacks, router backdoors, and more.

Huntress spotted a white whale - a malicious toolkit stored as a database object.

Attackers compile khunt inside Oracle after a web SQL injection, reach Windows SYSTEM, and stage credential data and registry ...

Appears while Codex Desktop is running and hides when Codex exits. Reads the weekly usage window from the local Codex app-server. Refreshes every 60 seconds; double-click to refresh immediately.

It's an absolute beast with over 700 fixes and active zero-days landing right as major SQL and SharePoint versions hit end of support.