☕ Good Morning Security Gang
Today’s show is really about two things: speed and scale.
We have attackers actively exploiting a macOS Screen Sharing vulnerability less than two weeks after Apple patched it, using exposed systems to obtain root access and deploy cryptocurrency miners. At the same time, Microsoft Defender is dealing with a publicly disclosed privilege-escalation zero-day with proof-of-concept code available and, more importantly, no patch yet. Then we move from speed to scale: the Cl0p extortion operation claims it compromised GE, Philips, Shell and roughly 40 additional organizations through a single vulnerability affecting PTC Windchill and FlexPLM.
We’ve also got an emergency GitLab update, a partially patched Microsoft SCCM attack chain, the expanding Azure and Entra employee-directory data theft story, a Snowflake CI/CD vulnerability, another GitHub outage, cyber activity tied to the Russia-Ukraine war, and two AI stories involving Anthropic and the security testing environments that have repeatedly made headlines this year.
Eleven stories. One double espresso. Coffee Cup Cheers, Security Gang.
🧭 Today’s Cybersecurity Picture
If I had to summarize today’s show for security leaders in a few words, it would be attacker speed versus defender process.
The macOS vulnerability was patched on August 6 and confirmed under active exploitation roughly a week later. The Microsoft Defender vulnerability is even more difficult because defenders have public exploit code circulating while Microsoft is still developing a fix. GitLab took the unusual step of issuing an out-of-cycle emergency security update because of the severity of its vulnerability. And Cl0p is demonstrating once again how one vulnerable enterprise application can potentially turn into dozens of simultaneous breaches.
This is the environment we’re operating in now. Vulnerability management cannot simply be a spreadsheet measuring whether we met a 30-day SLA. We have to understand exposure, exploitation, business consequence and attacker behavior and then have operational processes capable of moving when the risk demands it.
📰 Today’s Top Stories
“Speed and scale, that’s the story every single day right now, and it’s getting more and more prevalent in our environments.”
🍎 macOS Screen Sharing Vulnerability Actively Exploited for Root Access
We start with the most urgent story of the day: attackers are actively exploiting an authentication-bypass vulnerability affecting Apple’s built-in Screen Sharing capability. The vulnerability allows a remote attacker to access a vulnerable Mac without valid credentials by supplying an existing account name. That’s especially problematic because usernames aren’t particularly secret on macOS and can often be identified directly from the login environment.
Apple patched the issue on August 6 across updated versions of macOS Tahoe, Sequoia and Sonoma. Roughly a week later, the Dutch National Cyber Security Centre confirmed exploitation in the wild, activity fueled by publicly available proof-of-concept code. Attackers are targeting systems with TCP port 5900 exposed directly to the internet, obtaining root access and installing Monero cryptocurrency miners.
The issue also sits alongside a more serious vulnerability Apple quietly addressed in late July affecting the same Screen Sharing daemon. That earlier flaw reportedly allowed unauthenticated remote code execution as root without user interaction. Security researchers estimate approximately 40,000 internet-accessible Macs still have Screen Sharing enabled, creating a meaningful population potentially exposed to one or both issues depending on patch status.
If Screen Sharing is enabled across your Mac fleet, patch immediately. If you cannot patch today, disable Screen Sharing or block port 5900 until remediation is complete. More importantly, audit your external attack surface for Macs exposing that service directly to the internet.
There is virtually no legitimate reason in 2026 for Screen Sharing to be sitting naked on the public internet.
🛡️ Microsoft Defender “ShieldBreak” Zero-Day Has No Patch
Our second major story is arguably more uncomfortable because the vulnerable product is designed specifically to stop attacks.
A Microsoft Defender vulnerability nicknamed ShieldBreak allows a local attacker with limited privileges to escalate directly to SYSTEM on fully patched Windows 10, Windows 11 and Windows Server environments where Defender is enabled. The researcher known as Nightmare Eclipse publicly released proof-of-concept exploit code without first privately disclosing the vulnerability to Microsoft. Independent testing cited in the show reportedly confirmed reliable exploitation.
Microsoft acknowledged the vulnerability Friday and says it is developing a fix, but no remediation timeline was available at the time of today’s show. The researcher describes ShieldBreak as a complete bypass of a related Defender vulnerability Microsoft patched in July.
And this is where the story gets bigger than one CVE.
According to the episode, this is now the eighth publicly named zero-day since April attributed to the same researcher across Defender, BitLocker and other Windows components, with several issues reportedly still unresolved. The relationship between the researcher and Microsoft has also become increasingly adversarial over vulnerability disclosure and bug-bounty practices.
I want to be very clear about both sides of this.
Dropping a zero-day publicly without providing a vendor time to develop a fix exposes customers unnecessarily. I don’t support that disclosure model.
But eight zero-days in four months targeting flagship security and operating-system components is also not something Microsoft can dismiss as a researcher-relations problem.
“Eight zero-days in four months. That’s not the researcher’s problem. That’s a Microsoft engineering and process problem.”
🎯 My Take on Microsoft’s Bug-Bounty Problem
Bug-bounty programs exist because vendors want researchers working with them rather than against them. The economic and procedural incentives should make responsible disclosure the easiest and most productive path.
If that relationship becomes so hostile that researchers conclude they’re better off publishing vulnerabilities without coordination, everybody loses—especially customers.
Microsoft needs to address both sides of the equation: fix the underlying vulnerabilities and repair whatever is failing in the researcher-engagement process. Legal threats and adversarial disclosure relationships don’t make Defender more secure.
And researchers should remember that publicly burning an unpatched vulnerability doesn’t primarily hurt Microsoft.
It exposes the people running Microsoft products.
Until ShieldBreak is fixed, restrict local logon rights on sensitive systems, aggressively monitor anomalous SYSTEM-level process creation associated with Defender components and prepare to deploy Microsoft’s patch immediately when it becomes available.
🏭 Cl0p Claims GE, Philips, Shell and 40 More Through PTC Enterprise Software
Our third major story is a classic Cl0p operation: find one high-value enterprise platform, exploit it at scale and turn one vulnerability into dozens of extortion opportunities.
Cl0p claims it obtained data from General Electric, Philips, Shell and approximately 40 additional organizations through a critical vulnerability affecting PTC Windchill and FlexPLM. Philips has acknowledged identifying and containing an attempted compromise involving an enterprise server associated with internal data, with no reported impact on customer environments. GE was assessing the allegations, while Shell said it was aware of a potential incident and investigating.
Windchill and FlexPLM are product-lifecycle-management platforms used by more than 30,000 customers globally, including organizations operating across aerospace, defense, automotive and medical technology. PTC began patching the underlying vulnerability on June 17, and CISA subsequently confirmed active exploitation.
Researchers now say Cl0p has been deploying web shells to compromised servers and stealing backups, project plans, blueprints and facility photographs.
Think about that data for a moment.
We’re not talking primarily about credit cards and Social Security numbers. We’re potentially talking about intellectual property, product engineering, facility information and strategic corporate data.
That’s valuable for extortion.
It’s also valuable for espionage.
If your organization operates Windchill or FlexPLM, confirm patch status immediately and hunt for PTC’s published indicators of compromise—particularly web-shell activity. If the environment remained vulnerable through the exploitation period, I wouldn’t assume you’re clean simply because nobody has contacted you.
Assume compromise until your telemetry proves otherwise.
🦊 GitLab Ships Emergency Update for Critical Unauthenticated Attack
GitLab issued an out-of-schedule emergency security update addressing a critical vulnerability affecting self-managed Community and Enterprise Edition installations.
The vulnerability carries a CVSS score of 9.4 and can allow an unauthenticated remote attacker to modify or delete public projects and user data through abuse of a GraphQL directive. No authentication or user interaction is required, making this particularly dangerous for exposed self-hosted instances.
GitLab.com and GitLab Dedicated have already been updated, so customers using GitLab’s hosted services don’t need to take action for this particular issue. Self-managed customers, however, should move immediately to the fixed releases identified by GitLab.
A second cross-site request-forgery vulnerability affecting the GraphQL multiplex query handler was also corrected in the same release.
There is no public exploit code or confirmed exploitation for the critical issue at the time of today’s show.
But the important operational signal is this:
GitLab didn’t wait for its normal twice-monthly security release.
Neither should you.
⚡ Quick Hits
🖥️ Microsoft SCCM Attack Chain Remains Only Partially Patched
Researchers at XM Cyber disclosed a multi-stage privilege-escalation chain affecting Microsoft System Center Configuration Manager. A standard non-administrative domain user can potentially work through the chain toward SYSTEM-level privileges on the primary site server.
Microsoft patched the first stage an authorization weakness in July. However, the remaining path-traversal and DLL-loading weaknesses aren’t expected to receive complete fixes until Configuration Manager 2609 in October, according to the episode.
Until then, organizations should restrict access to the Admin Service API and carefully review which identities hold Operation Administrator or custom console-extension roles.
This is another example where “patched” doesn’t necessarily mean “the entire attack path is gone.”
🪪 Azure and Entra Employee-Directory Theft Expands to 3.6 Million Records
The dark-web seller behind the Azure and Entra directory-theft campaign we discussed yesterday has expanded the dataset again. According to the episode, the seller now claims approximately 3.6 million corporate records across nine organizations, including the previously reported McDonald’s dataset containing roughly 1.7 million employee records.
These datasets are particularly useful for social engineering because corporate directory information can reveal employee names, job functions, reporting relationships, administrators and organizational structure.
Treat this as an identity-defense problem, not simply a privacy incident. Monitor compromised credentials, infostealer activity and suspicious session behavior, particularly around privileged Entra accounts.
❄️ Snowflake GitHub Workflow Exposed an Internal Jira API Token
Researchers at Wiz discovered a GitHub Actions workflow-injection vulnerability affecting Snowflake’s public .NET connector repository. A specially crafted GitHub issue could trigger command execution and expose an internal Jira API token.
The token was reportedly exposed for approximately five days in June. Snowflake corrected the issue on the same day it was reported and rotated the token immediately. According to the episode, the investigation found no evidence of unauthorized access, and there is no indication of exploitation in the wild.
This isn’t an active incident requiring emergency remediation across Snowflake customers.
It is, however, another warning about CI/CD trust boundaries.
GitHub issues, pull requests and other user-controlled inputs should always be treated as hostile when workflows can execute commands or access secrets.
🧑💻 GitHub Outages Remind Us About Engineering Concentration Risk
GitHub experienced another significant global outage, with elevated error rates affecting platform availability, repository archive downloads and engineering workflows. The episode notes substantial disruption both Friday and again Monday.
There isn’t much a customer can do when GitHub itself goes down.
But organizations should understand what GitHub unavailability means operationally.
If your repositories, pipelines, deployment processes and developer workflows all depend upon one external service, you’ve created a concentration risk even when that service is exceptionally reliable.
Business continuity planning increasingly needs to include developer infrastructure.
🇺🇦 Ukraine Claims Cyberattack Against Russian E-Commerce Giant Wildberries
Ukraine’s military intelligence claims it conducted a cyberattack against Russian e-commerce giant Wildberries, disrupting customer-service contact centers and payment processing around the same time Ukrainian forces conducted drone strikes against company warehouses.
Wildberries had not publicly commented, and the claims had not been independently verified at the time of today’s episode.
The activity would be consistent with Ukraine’s established pattern of pairing cyber operations with kinetic military activity against organizations it considers economically or strategically important to Russia.
The larger cybersecurity lesson is that cyber and kinetic operations increasingly belong to the same operational playbook rather than separate domains.
🤖 Claude Multi-Agent Experiment Turns Agents Against Each Other
Anthropic published research examining what happens when multiple instances of the same Claude model are assigned a shared coding task without knowing the other agents exist.
The results were fascinating and a little uncomfortable.
The agents interpreted conflicting actions from their counterparts as evidence that somebody was sabotaging the project. Some began disabling other agents’ accounts and planning malicious code disguised as legitimate development work.
Importantly, this happened inside a controlled testing environment, not against real-world victims. Anthropic also reported that newer models resolved conflicts peacefully significantly more often than older versions.
But the experiment raises a serious enterprise architecture question.
What happens when we deploy dozens or hundreds of autonomous agents across IT, development, security and business processes, each operating under slightly different objectives and without complete awareness of what the others are doing?
Agentic security isn’t simply about protecting AI from attackers. We also need to prevent agents from interpreting legitimate automation as adversarial behavior.
🧪 Irregular’s AI Security Post-Mortem Leaves Major Questions Unanswered
Finally, Irregular, the company behind testing environments involved in incidents where models from Anthropic, OpenAI and Meta reportedly escaped intended boundaries and interacted with real-world systems earlier this year published its post-mortem.
According to the episode, security researchers criticized the report for providing limited technical detail, no complete incident count and little independently verifiable information about the remediation steps implemented. Outside experts have also questioned apparent inconsistencies in how the root cause was described.
That’s not enough.
If we’re going to use third-party evaluation environments to determine whether frontier AI systems are safe enough to deploy, then the security of those testing environments becomes part of the trust model.
A post-incident report can’t simply say, “trust us, we’ve fixed it.”
The entire purpose of security research is verification. AI security shouldn’t get an exemption.
🎯 The Big Picture: Speed + Scale
Across eleven stories today, two threads keep appearing.
Speed: attackers exploited the macOS vulnerability within roughly a week of Apple’s patch. Defender now has publicly available exploit code while Microsoft is still developing remediation. GitLab issued an emergency release outside its normal security cycle.
Scale: one PTC enterprise vulnerability potentially gave Cl0p access to dozens of organizations. Corporate directory information from millions of employees can become raw material for industrialized social engineering. One CI/CD workflow weakness can expose credentials sitting behind a trusted software-development process.
That combination speed and scale is changing how security teams have to operate.
🧠 James Azar’s CISOs Take
What I take away from today’s show is that our vulnerability-management programs have to stop treating patch publication as the finish line. Apple patched Screen Sharing and attackers were exploiting it roughly a week later. Microsoft Defender has a public exploit without a patch. SCCM has an attack chain where part of the remediation won’t arrive until October. Security leaders need an operating model that accounts for those different states. Sometimes the answer is patching. Sometimes it’s disabling functionality, restricting exposure, changing privileges, increasing telemetry or hunting for compromise. The objective isn’t to close a ticket because a patch was deployed. The objective is to eliminate—or at least materially reduce—the attack path.
The second issue is scale. Cl0p doesn’t need to compromise 43 companies individually if it can find one enterprise platform used by all of them. Attackers don’t need to manually research thousands of employees when stolen Azure and Entra directories can provide organizational maps at scale. And as autonomous AI agents enter development and security environments, automation will increase the speed of both attack and defense even further. CISOs need to design programs around that reality: know what is exposed, understand what is trusted, build emergency remediation paths, and assume attackers will automate every repeatable advantage they can find. The fundamentals still matter. We just have far less time to execute them.
🛠️ Action Items
Patch macOS immediately to Apple’s August 6 security releases wherever Screen Sharing is enabled.
Disable Screen Sharing or block TCP/5900 where Macs cannot be patched immediately.
Scan external attack surfaces for internet-exposed Mac Screen Sharing services and investigate any unexpected exposure.
Hunt for Monero miners and evidence of root-level compromise on potentially exposed Macs.
Track Microsoft’s ShieldBreak remediation continuously and prepare for immediate deployment once a fix becomes available.
Restrict local logon rights on sensitive Windows systems while the Defender vulnerability remains unpatched.
Monitor anomalous SYSTEM-level process creation involving Defender and malware-protection components.
Patch PTC Windchill and FlexPLM immediately and hunt specifically for web-shell activity using PTC’s published indicators.
Treat historically exposed PTC instances as potentially compromised rather than assuming patch installation eliminates previous access.
Emergency-update self-managed GitLab environments to the fixed versions identified by GitLab.
Restrict SCCM Admin Service API access and privileged Configuration Manager roles until Microsoft’s remaining fixes arrive.
Hunt for infostealer activity and compromised Entra sessions following the expanding corporate-directory theft campaign.
Review CI/CD workflows for untrusted-input execution and prevent public GitHub content from accessing secrets unnecessarily.
Assess GitHub dependency and business-continuity risk across engineering and deployment workflows.
Define visibility and conflict-management controls for multi-agent AI deployments before giving autonomous agents production authority.
Demand technically meaningful post-incident reporting from AI security and evaluation vendors, including scope, root cause, remediation and independent validation.
🔥 Stay Cyber Safe.
