The Watch

The AhsayCBS chain outranks bugs that already carry CVE numbers. One detail elsewhere in Risky Bulletin's weekly sweep explains why. The IronChain ransomware can botch its own encryption and destroy files permanently. Paying the ransom does not guarantee the data comes back. In that case the backup copy is the only recovery path left. The AhsayCBS management console is the system that controls those copies.

Huntress discovered the two zero-days last week and saw them chained in attacks. An authentication bypass comes first, then code execution on the console. The reporting so far carries no CVE numbers, CVSS scores or account of what attackers did after getting in. We think code execution on a backup console puts every restore point within an attacker's reach. The hunt below looks for admin sessions, accounts and backup jobs nobody on staff created. Ahsay has shipped no fix, so these steps are our hardening advice, not vendor guidance.

The rest of the exploited-now queue

Three other zero-days landed the same week. All three have fixes. None of the reporting includes CVSS scores, so rank them by exposure and exploitation status. Risky Business's James Wilson makes the same point about vendor updates: raw bug counts per release mislead defenders.

FortiBleed needs no new patch. Attackers reuse leaked credentials against Fortinet firewalls and VPNs. The FBI says the attacks keep working because few organizations have mitigated them. It is the item most likely to be sitting half-finished in a patch queue. The Atlassian bug updates Friday's coverage. It was already being exploited, and fixes now cover all Data Center versions. A patch does not evict an attacker who got in before it. Read the logs first.

The other backup consoles

Veeam is on the same week's vendor-update list. So are Cisco, Dell, GitLab, JetBrains, MongoDB, Splunk, SonicWall, Elastic and Arista. The Ahsay logic applies now to Veeam and to any other backup platform. A single management console that reaches every copy is a single point of failure for recovery, whichever vendor built it. The check is the same on every platform.

Confirm each console is reachable only from a management network. Confirm at least one copy sits where the console cannot delete it.

Arena has launched an Alignment Index, per TheSequence. It scores models on unauthorized actions and false attribution, plus deceptive completion: a claim to have finished a task that was never done. OpenAI models lead the preliminary rankings. Claude Opus 5.5 is sixth and Claude Fable ninth. Arena calls the rankings preliminary, and they work as one directional input to model selection.

The keynote reported by The Institute for Ethical AI & ML covers the monitoring gap. An agent can hold 100% availability and 100% latency while being 100% wrong, and current dashboards would register nothing. Uptime and latency monitoring was built for services that either work or fail loudly. An agent that confidently does the wrong thing stays green until a person sees the consequence.

Where a false “done” becomes a false audit record

An agent reports a patch applied, and the report closes the ticket. If the patch never landed, the claim is now control evidence. The same applies to a configuration reported as hardened or a ticket reported as remediated. TheSequence flags this as a SOC 2 audit problem wherever agent output feeds attestations. The keynote warns that agents can store a hallucination or an injected instruction as a “fact” in memory, where it resurfaces months later many steps downstream. Refactoring's Luca Rossi argues that a good design doc is “pretty much the context you want to give your agents.” By that logic, anyone who can edit the ADRs (architecture decision records) can steer agent-written code.

Human review is a weak backstop. In the Science study, people who got agreeable answers became more convinced they were right, and they preferred those answers. That study measured personal advice, so transfer to alert triage and security work is unmeasured. The analyst writing a triage prompt usually holds the hypothesis already. A model that leans toward agreement will hand it back.

The same problem, arriving from outside

Sierra and Meta announced the Personal Agent Protocol (PAP) with Shopify, Stripe and Walmart. It is an open standard for consumer agents to sign in to company sites and APIs. Its OAuth sessions can be guest or signed-in, read or write. TheSequence says a v0.1 spec and a reference implementation are due later this month, with design workshops on the same schedule. Account-takeover detection keys on human signals such as device fingerprint and behavior cadence. A legitimate agent acting for a real customer will look anomalous by design. The options left to fraud teams are alert fatigue or blanket allow-listing.

The move: verify from system state

SRE Weekly's editor praised incident.io for publishing how it measures the accuracy of its AI SRE investigations, and called that openness rare in the category. That disclosure sets a workable procurement bar before any AI tool gets read access to logs and deployment history. Inside the SOC, a framing-flip test produces a local sycophancy number. It takes 20 closed alerts with known outcomes and presents each twice, once framed as likely benign and once as likely malicious. The output is a count of how often the verdict follows the framing instead of the telemetry.

The record that closes a ticket is the system state: the patch as installed, the configuration as hardened. The agent's report is a claim about that state.

The FBI's response to the PeopleSoft breach is the part worth copying. Reuters reports that ShinyHunters took personal and business data on almost all FBI special agents through the platform Accenture had left unpatched. The FBI's answer was to end the contract. Most vendor agreements could not support that move, because they contain no patch SLA to breach and no termination right tied to one. The related arrest claims in the same reporting are single-source.

The MonsterCloud charges break a different assumption: that your incident-response firm tells you what it did on your behalf. A retainer that does not require disclosure of payments made for you leaves you unable to know whether a ransom went out in your name. In our view, that also undermines any sanctions screening or payment reporting you would otherwise own. Oracle's year-late Cerner disclosure is the third version of the problem: a health-data processor's notification that customers received long after the breach. Check the breach-notification deadlines in your business associate agreements (BAAs, the HIPAA contracts with data processors) against the obligations you carry yourself.

Solvency is the next promise likely to fail

Financial health is the vendor claim almost nobody asks about. The Bear Cave's point is that distress does not arrive as a CVE. It arrives as a security team cut in half, a slower patch cadence, or a late SOC 2 report with new exceptions. It can also arrive as a distressed sale to a buyer with different data practices, or an end-of-life notice with 90 days' warning. The loan markdowns land on sponsor-owned, debt-financed borrowers, the same profile as much of the mid-market SaaS and security-tool market.

AI infrastructure shows the same strain with less transparency. About $35B of Lambda's $50B backlog, roughly 70%, comes from Anthropic, per TheSequence, and Lambda has taken on $1B in new debt. That makes Lambda a fourth party for any workload you run on Claude. Reports on Firmus Grid's withdrawn IPO also disagree. The Information describes a roughly $5B raise at a valuation above $30B, pulled over market volatility. The Bear Cave cites a $44B target and X-sourced figures of a $68M loss on $51M of revenue, with $30B of debt against 46 MW of capacity. Those Firmus financials are unverified. When press accounts of a supplier's finances diverge this far, your contract terms are the only protection you control.

A vendor questionnaire records what a supplier claims. Claims about patching, ransom payments, breach notice and solvency all needed proof the questionnaire never asked for.