APT28 exploited CVE-2026-21513, an MSHTML zero-day (CVSS 8.8), using malicious LNK files to bypass security controls and execute code.
With progress slowing to a crawl, I researched Windows App SDK alternatives and then started experimenting with AI pair programming.