ClarityBeta

Security & Threat Intelligence

The Watch

7 min read · 1,367 words · 3 moves to watch
FRIDAY, OCTOBER 2, 2026
The Signal

Eleven of the 16 flaws CISA added to KEV this week carry a CVSS score of zero.

The scores are missing rather than low, and a severity-sorted dashboard will still file these entries beneath 28 Microsoft 9.8s that no one is exploiting. The exploited ones include the boxes that authenticate and configure your network: F5 BIG-IP APM, Check Point management, Arista VeloCloud's orchestrator, Citrix NetScaler, Cisco Catalyst SD-WAN.

In Play

  1. Perimeter and Management Planes Under Active Exploitation

    Between Sept 22 and 27, CISA added six actively exploited flaws to its Known Exploited Vulnerabilities catalog. All of them sit on the systems that authenticate, filter and orchestrate networks: F5 BIG-IP APM, Check Point management, Arista VeloCloud Orchestrator and Citrix NetScaler. Cisco Catalyst SD-WAN (CVE-2026-76504) and Zammad add more. The edge, not the hosts behind it, is the battleground. Scoring makes it worse: 11 of the 16 KEV entries this issue carry a CVSS of 0 (unscored), so severity-sorted dashboards bury the exploited flaws below 28 Microsoft 9.8s with no reported exploitation.

  2. AI Agents Erase Rarity Detection and Become Standing Identities

    AI coding and ops agents now run curl, tcpdump and throwaway Python all day, which destroys the statistical rarity that single-execution tripwire alerts depended on. The Hugging Face incident showed the consequence: sensors fired on credential reuse, token minting and 180+ VPN enrollments, but no one was paged because each action looked routine. Meanwhile, OpenAI's Dots and Google's Gemini skills (rolling to Workspace Oct 5) ship as always-on identities. They hold standing OAuth tokens into mail, Slack and Jira and run from vendor cloud, outside your EDR. Your detection logic and your IAM scope were both built for a world that no longer exists.

  3. TA419 Walks Through Standard MFA Against AI-Policy Targets

    TA419, a China-aligned actor, is running adversary-in-the-middle phishing with a modified open-source kit. It relays victims to the real Microsoft OneDrive login and steals the authenticated session cookie, not just the password. TOTP, SMS and push approvals do not stop it once the token is replayed. The lures impersonate White House officials, economists and a named Anthropic employee, and the campaign has hit defense contractors, think tanks, universities and law firms since April 2025. There is no CVE to fix, so the lever is identity architecture (origin-bound FIDO2, token binding), not patch cadence.

  4. LLM Endpoints Are Extraction Surfaces Rate Limits Can't See

    OpenAI disclosed a coordinated model-distillation campaign it tied to individuals linked to Moonshot AI: 16,000 requests from 4,000+ accounts over two days, spread across 15,000+ accounts in total, which works out to roughly four requests per account. No server was breached. The traffic was authenticated and paid for, and per-user rate limits never fired. Any team exposing an LLM-backed product needs detection that clusters across accounts (prompt-embedding similarity, shared ASN, payment and device fingerprints). Client-returnable artifacts like encrypted reasoning must be cryptographically bound to the issuing session.

  5. AI Compute Vendors Converge on One Financial Counterparty

    S&P cut Oracle to BBB-, one notch above junk, as its $300B+ OpenAI relationship reaches roughly 45% of its $664B backlog. Underneath, CoreWeave draws 72% of revenue from three customers and makes up 77% of Core Scientific's total revenue. An OCI tenancy, a CoreWeave GPU reservation and an OpenAI API dependency can therefore be one correlated bet rather than three separate vendors. For third-party risk this is an operational-resilience question: BCP/DR plans assume vendor failures are independent, and increasingly they are not. Add financial-health triggers and insolvency-surviving data-return clauses to AI compute contracts.

Deep Dives

Perimeter Week: Six Exploited Edge Flaws, Most Scored Zero

The systems that authenticate and orchestrate your network are a confirmed battleground, and the dashboards you triage by are pointing you at the wrong fires.

Start with the detail a severity dashboard hides. Check Point's own advisory is titled “Action Required” and describes a pre-authentication path traversal (CVE-2026-93616, CVSS 9.8) on the management plane — anyone who can reach your management server can rewrite your firewall policy. The Arista VeloCloud 10.0 (CVE-2026-93952) sits on the orchestrator, which pushes configuration to every branch edge. If a carrier or MSP operates your SD-WAN, the patch is theirs but the exposure is yours. Cisco Catalyst SD-WAN (CVE-2026-76504) is an API auth bypass to admin access, exploited as a zero-day with no disclosed start date — hunt as far back as your logs reach.

The scoring trap

CISA added six exploited flaws to KEV between Sept 22 and 27, four of them on a single day. The pattern across F5 BIG-IP APM (CVE-2026-94127), Check Point, Arista, Citrix NetScaler (CVE-2026-88771/88772), plus Cisco ISE and MikroTik RouterOS earlier, is unmistakable: attackers are going after the devices that guard everything else, not the hosts behind them.

Here is the operational problem. Eleven of the sixteen KEV entries this issue are published at CVSS 0 — unscored, not harmless. Both exploited NetScaler bugs, Check Point's certificate-validation flaw and the SharePoint code injection are in that group. Meanwhile Microsoft shipped 28 CVSS 9.8s this cycle, none of them KEV-listed. Sort your queue by score and your tooling puts the bugs nobody is exploiting at the top and the ones attackers are using now at the bottom.

Where the two reports agree, and where they add

The SANS and Risky.Biz analyses converge on the same prescription: patch speed at the edge is now your primary ransomware control. Risky.Biz sharpens it with two un-CVE'd cases. Zammad has two unpatched zero-days chaining session hijack to RCE; with no fix available, the only control is removing it from the internet. Zimbra's July command-injection is being used now to plant Java web shells and steal mailboxes, so verifying the patch is not enough — you must hunt for shells. Risky.Biz also cites Google's finding that AI has doubled both vulnerability disclosure and exploitation in a year, which is why a 30-day patch SLA for internet-facing systems is now too slow.

A patch program that ranks by CVSS alone is aimed at the bugs attackers are ignoring and away from the firewalls, gateways and SD-WAN controllers they are actively inside.

One more exposure sits in the same tier: ManageEngine Applications Manager 182200 and below leaked a Google Cloud service-account private key (CVE-2026-86708, CVSS 10.0). Patching does not revoke a leaked key — rotate first, then upgrade.

What to do

  1. Patch and run a compromise assessment on the exploited edge stack this week — F5 BIG-IP APM, Check Point, Arista VeloCloud Orchestrator, Citrix NetScaler and Cisco Catalyst SD-WAN — removing internet access to management interfaces and terminating active sessions after patching.

  2. Rewrite vulnerability-prioritization logic so KEV membership overrides CVSS and null/0 scores map to 'unscored, triage now' rather than 'low'; re-run the queue against all 16 KEV entries this sprint.

  3. Take unpatched Zammad off the open internet behind VPN/SSO and hunt Zimbra web directories for Java/JSP web shells today, since Zammad has no patch and Zimbra has been actively exploited.

Your Tripwires Went Blind and Your Agents Never Log Off

The same shift — AI agents behaving like privileged users at machine speed — is breaking both your detection logic and your identity model at once.

The Hugging Face incident is the case study. Sensors fired. Credentials were used from several environments. Workloads minted tokens they had never touched. More than 180 VPN enrollments were recorded. Nobody was paged, because each action on its own looked like ordinary agent workload. Only correlation surfaced the intrusion. Detection logic that still alerts on a single run of curl, tcpdump or ad-hoc Python gets two results at once. It floods the queue with false positives from legitimate agents and shows nothing on the attacker moving among them.

Why rarity died

Rarity-based detection assumed a human ran those tools occasionally. AI coding and ops agents run them constantly. The statistical anomaly is gone. The fix is architectural, not another rule. Assign each signal a confidence score and alert when a chain crosses a threshold. Add sequence detections. A secrets-manager read followed by an outbound upload is exfiltration, even though either action alone is legitimate. Casey Ellis states the structural problem plainly. Offensive adoption is gated only by compute. Defense is gated by change control and “twelve people in four time zones agreeing on one Jira ticket.”

The identity half of the same problem

OpenAI's Dots are always-on agents running on OpenAI-hosted compute and connecting to 4,000+ apps. They ship on individual Pro plans. The first ones to touch corporate data will arrive the way shadow IT always has. A power user clicks “connect” and grants OAuth scopes into the tenant. Google's Gemini skills reach Workspace on Oct 5. Both run from vendor cloud, outside EDR and the secure web gateway. The remaining telemetry is SaaS audit logs and IdP token events. An attacker who steals an agent's long-lived refresh token inherits its access and never triggers an MFA prompt.

An always-on agent can read SharePoint and submit a web form from a computer the organization does not own, without touching endpoint, egress or DLP controls. Treat every one as an unmanaged privileged identity until OAuth consent is locked to admin approval.

The analyses agree on the control set. Baseline agent principals before alerting on them, covering 24/7 cadence, bulk reads and vendor-cloud IP ranges. Give every agent its own identity, with a named sponsor and an offboarding trigger. Block agents from the cloud metadata service at 169.254.169.254, which cuts credential theft at the source. CSO adds that none of this counts until it is tested. “Guardrails configured” fails open until the kill switch is pulled in a tabletop and confirmed to work.

What to do

  1. Audit detection rules that fire on single-execution of curl/tcpdump/nc/ad-hoc Python or token minting, and re-architect toward confidence-scored, multi-signal correlation with explicit sequence detections (secrets read then outbound upload) this sprint.

  2. Require admin approval for third-party OAuth apps in Entra ID and Google Workspace before Oct 5, then export and review every existing grant to OpenAI-, ChatGPT-, Codex- and Gemini-branded apps, revoking unsanctioned grants with mail-send, broad-read or write scopes.

  3. Stand up a non-human identity register that assigns every production and endpoint agent a named human sponsor, scoped short-lived tokens, and an offboarding trigger tied to the sponsor's HR record this quarter.

TA419 Steals the Session, Not the Password

A China-aligned actor is harvesting live M365 sessions through spoofed OneDrive logins, and your high-risk cohort of AI and policy staff sits outside the executive phishing program that would protect them.

No CVE is involved, so patch cadence is the wrong lever. TA419 runs an adversary-in-the-middle kit built on modified open-source tooling. It presents a fake Microsoft OneDrive sign-in page, relays the victim to the real login, and captures the password, the MFA token and the authenticated session cookie in one pass. The proxy then replays the cookie. TOTP, SMS and push approvals offer nothing once the token is in the attacker's hands. The chain maps to T1557 (adversary-in-the-middle) into T1550.004 (web session cookie).

The target profile sits inside ordinary org charts

The relay mechanics are familiar on this beat. The target list is what sets this campaign apart. The lures impersonate White House officials, economists and a named Anthropic employee, identities chosen for trust inside the AI policy community. Proofpoint has TA419 active against defense contractors, think tanks, universities and law firms since at least April 2025 and counts it as the second Chinese APT seen targeting the US AI sector. Two separate Chinese clusters on the same sector reads as a collection requirement rather than a one-off, provided the attributions stay distinct. Companies that build with AI, ship controlled technology, or employ ex-government advisors and trade-compliance staff have people who fit this profile. Those people almost certainly sit outside the executive VIP phishing program.

Where MFA is TOTP, SMS or push, the working assumption is that TA419 can already be inside the M365 session. Origin-bound, phishing-resistant authentication breaks the relay.

What stops it

Origin-bound WebAuthn, via FIDO2 keys or device-bound passkeys, defeats AiTM relay because the credential will not authenticate against the attacker's proxy domain. The supporting controls are Entra token protection and session binding, blocked legacy authentication, and device-compliance Conditional Access, which leave a stolen cookie useless off managed infrastructure. Session-hijack detection covers the period before hardware keys roll out. The relevant signals are new-ASN or geo sign-ins, impossible travel, token reuse from unfamiliar IPs, and OneDrive auth flows redirecting through non-Microsoft domains. MIT's analysis raises a process point technical teams miss: the payload may simply be a conversation. An out-of-band verification rule for unsolicited requests for calls, drafts or “perspective on chip controls” carries as much weight as any rule in the gateway.

What to do

  1. Enroll a high-risk cohort — AI/ML research leads, export-control and policy staff, legal, and anyone with former government service — in phishing-resistant FIDO2/passkeys and your mail platform's targeted-user impersonation protection this quarter.

  2. Deploy session-hijack hunts now — new-ASN/geo sign-ins, impossible travel, token reuse from unfamiliar IPs, and OneDrive flows redirecting to non-Microsoft domains — and retro-hunt 90 days of mail to the cohort for AI-lab and former-official personas on unauthenticated domains.

The bottom line

Three of today's stories share one defect: the signals your defenses sort and trust by have quietly stopped working. A severity score, the statistical rarity of a command, and the mere presence of a second factor each used to tell you where to look first, and each now points away from where attackers actually are. The assumption that your tooling's default ranking reflects real risk is broken. It breaks silently, and the gap widens with every week of AI-accelerated disclosure. Re-rank your remediation around exploitation evidence rather than severity score this week, rebuild agent detection on behavioral correlation instead of rarity, and treat any control whose output you have never adversarially tested as unproven until you have.