This Week in Cybersecurity #62

Five Days to Compromise: When Patch Windows Collapse, Control Planes Fall, and the Attack Surface Grows Beyond Your Perimeter

Aug 14, 2026

Good Morning, Security Gang!

Double espresso. Back from Hacker Summer Camp. And this week left absolutely no time to ease back in.

James returned from DEF CON and Black Hat with one message above everything else he heard: defenders need to spend less time chasing individual vulnerabilities and more time protecting the platforms that orchestrate trust across the enterprise. By the end of four episodes this week, every major story validated that observation.

VMware vCenter disclosed a CVSS 9.8 unauthenticated RCE on July 29. By August 5, five days later, 343 of the 361 eventually identified victims across 47 countries had already been compromised. That’s not a patch cycle. It’s an incident response timer. Microsoft released 421 vulnerabilities in August Patch Tuesday, including an AFD.SYS zero-day tied to North Korea’s Lazarus Group and its FudModule rootkit. SharePoint saw its fifth exploitation of the summer with Rapid7’s proof-of-concept going from publication to active honeypot exploitation in under 24 hours. LiteLLM’s supply chain compromise malicious packages available for just 40 minutes potentially exposed 2,500 organizations and 434,000 CI/CD pipelines. Cisco confirmed active exploitation of ASA and FTD VPN gateways. And a Sandworm recruitment campaign turned the IT job interview itself into a delivery mechanism for trojanized WireGuard clients.

The week also covered Metabase’s maximum-severity SQL injection under active exploitation, N-able N-central’s incomplete patch creating a second wave of MSP compromise, Microsoft pre-releasing three CVSS 10 identity infrastructure vulnerabilities before Patch Tuesday, and an AI model autonomously creating fake personas and sending phishing emails during UK testing. Plus a North Korean national reportedly obtained a position inside a U.S. federal agency, and The Gentlemen ransomware group hijacked AnMed’s hospital Facebook page to post ransom demands directly to patients.

James’s defining observation across the week: “The edge device you forgot about is the one an attacker is counting on.”

Let’s get into it.

🌐 Critical Infrastructure & Active Exploitation

“The edge device you forgot about is the one an attacker is counting on.”

VMware vCenter CVSS 9.8: 95% of Victims Compromised Within Five Days of Disclosure

Broadcom disclosed a critical directory-traversal vulnerability in VMware vCenter’s syslog component on July 29, CVSS 9.8, unauthenticated RCE, no workaround. By August 5, 343 of the 361 identified victim systems (approximately 95%) had already been compromised, with victims across 47 countries including Germany, the United States, Turkey, Iran, and France. Attackers deployed Reverse SSH, a Go-based reverse-shell utility providing persistent outbound connectivity bypassing inbound firewall controls, blending into legitimate administrative SSH traffic. Emergency-patch vulnerable vCenter immediately. Remove management interfaces from public internet exposure. Require VPN and MFA for administrative access. Hunt aggressively for Reverse SSH artifacts and anomalous outbound SSH connections from virtualization infrastructure. Five days between disclosure and widespread compromise is not a patch window, it is an incident response timer.

Cisco ASA and FTD: Active Exploitation of VPN Denial-of-Service, No Workaround

Cisco confirmed active exploitation of a high-severity DoS vulnerability in Secure Firewall ASA and Firepower Threat Defense an unauthenticated attacker sends a specially crafted request to an SSL listening socket causing the appliance to reload. Remote-access VPN, SSL VPN, and certain ZTNA configurations are affected. No workaround exists. Cisco issued hotfixes across supported ASA and FTD branches. Deploy hotfixes immediately, review appliance availability and reload events for anomalous patterns, and treat this as the top Cisco priority this week arriving alongside separate ClamAV vulnerabilities affecting Secure Endpoint Connector with public proof-of-concept code already circulating.

SharePoint: Fifth Exploitation of the Summer — Proof-of-Concept to Active Exploitation in Under 24 Hours

A newly disclosed SharePoint authentication bypass allowing authenticated users to access or modify unauthorized information was published with detailed technical research and proof-of-concept by Rapid7 on August 11. Less than 24 hours later, exploitation attempts against honeypots were observed. This is the fifth SharePoint vulnerability exploited in the wild this summer. Rapid7 also disclosed a second vulnerability chainable for unauthenticated RCE, patched in August Patch Tuesday, not yet under active exploitation at time of publication. Confirm both July and August Microsoft updates are deployed across all on-premises SharePoint infrastructure. Monitor authentication logs and anomalous access attempts against internet-facing SharePoint front ends.

Microsoft August Patch Tuesday: 421 CVEs, AFD.SYS Zero-Day Under Active Exploitation by Lazarus

Microsoft’s August Patch Tuesday delivered 421 vulnerabilities including CVE-2026-68820 a use-after-free in AFD.SYS (Windows Ancillary Function Driver) allowing a locally authenticated attacker to escalate privileges to SYSTEM through a race condition. Researchers tied exploitation to North Korea’s Lazarus Group, which built an exploit targeting modern Windows 11 builds and incorporated it into a new FudModule rootkit version capable of tampering with Windows Smart App Control. Additional high-priority items: a Windows User Profile Service privilege escalation (another local account can access another user’s registry hive), a publicly disclosed Container Isolation FS Filter Driver issue, and RCE vulnerabilities across Windows DNS Server, TFTP Server, Deployment Services, Microsoft QUIC, HPC Pack, and an Exchange Server elevation of privilege. Priority order: AFD.SYS zero-day first, User Profile Service second, then risk-based deployment across the remainder.

Cisco ClamAV: Seven Vulnerabilities in Secure Endpoint Connector, PoC Available

Seven ClamAV vulnerabilities affect Cisco Secure Endpoint Connector across Windows, macOS, and Linux, with public proof-of-concept already circulating for two. Windows carries particular risk because ClamAV executes with elevated privileges in that environment. Prioritize these updates as they become available do not allow them to disappear into routine patch queues.

SonicWall SMA 1000: Ransomware Operators Now Using Pre-Patch Zero-Days

CISA updated the SonicWall SMA 1000 KEV entries to confirm ransomware operators are exploiting the same zero-days (Knuckleball, OrangeTail) that sophisticated actors used during the three-week pre-disclosure exploitation window. More than 380 SMA 1000 appliances remain internet-exposed. Patch SonicWall immediately, investigate appliance activity back through late June, rotate all associated credentials, and treat any pre-patch-window access as potentially persistent. For MSPs operating this infrastructure for customers, this is a call-your-customers situation, not a monitor-the-situation situation.

Metabase Maximum-Severity SQL Injection: Active Exploitation, Framework Computer Confirmed Compromised

A maximum-severity SQL injection vulnerability in Metabase allows completely unauthenticated attackers to inject SQL commands, obtain administrator privileges, modify system configuration, steal database credentials, and access every connected data source. Framework Computer confirmed compromise through this vulnerability with customer names, email addresses, IP addresses, and shipping information accessed. Deploy patched releases immediately, revoke all active sessions, rotate every database credential connected through Metabase, audit API keys and administrative accounts, and inspect query history for reconnaissance or exfiltration activity.

Adobe Commerce and Magento: Active Probing After Patch Release

Adobe patched seven vulnerabilities affecting Commerce and Magento, and researchers detected probing activity against one immediately after release capable of hijacking customer accounts without credentials. Patch and review authentication logs for account takeover attempts.

🏭 OT and Critical Infrastructure

Sandworm Pivots from Fortinet VPN to Cellular Router to Private APN to PLC: Poland Heat Plant Attack

CERT Polska published detailed analysis of a Sandworm destructive attack against a combined heat-and-power facility supporting approximately 50,000 residents assessed as destructive rather than espionage-driven. The attack chain: internet-connected Fortinet VPN/firewall at a wind farm → pivot to a cellular router → abuse exposed SSH to tunnel into a private APN used for substation communication → additional gateway with SSH enabled → OT environment access → one week of reconnaissance → Siemens PLCs placed in STOP mode, password-protected → steam turbine and water treatment shutdown. Recovery required factory-resetting affected PLCs and restoring logic from backups. Attackers also corrupted a gateway’s partition table on the way out, destroying forensic evidence. CERT Polska identified this as the first documented use of a private APN as an attack vector. This attack succeeded because multiple independent assumptions failed simultaneously: the VPN would hold, the cellular router was trusted, the APN was private, SSH exposure would go unnoticed, and OT segmentation would prevent consequences. Audit OT connectivity through cellular routers and private APNs, remove unnecessary SSH access, and validate whether a compromised edge appliance can ultimately reach PLC networks.

Siemens, Schneider Electric, Phoenix Contact ICS Updates

Siemens issued ten new security advisories including a maximum-severity unauthenticated RCE affecting SIMATIC IOT2050 devices. Schneider Electric and Phoenix Contact released fixes for APC PowerChute and PLCnext firmware. OT teams should read vendor advisories directly and determine remediation windows based on operational consequence, not CVSS scores alone.

CISA Expands Iranian OT Advisory: Siemens, Schneider Electric, Rockwell Automation

CISA expanded previous Iranian OT targeting warnings to specifically include Siemens, Schneider Electric, and Rockwell Automation PLC deployments. Emphasize segmentation and secure remote access in any environment running these systems.

🧬 Supply Chain & Developer Ecosystem

“Five days. That’s the entire runway you got between a vendor advisory and 95% of the eventual victims already being owned.”

LiteLLM Supply Chain: 40 Minutes, 2,500 Organizations, 434,000 CI/CD Pipelines

Team PCP first compromised Aqua Security’s Trivy vulnerability scanner, which LiteLLM’s automated build process pulled as a dependency giving attackers access to LiteLLM’s release pipeline. Two malicious LiteLLM Python package versions were published to PyPI and available for approximately 40 minutes. Automated dependency resolvers, build systems, caches, and CI/CD pipelines propagated the packages before removal. Potential exposure includes NVIDIA, AWS, Samsung, Salesforce, Cisco, ServiceNow, Siemens, Regeneron, London Stock Exchange Group, FedEx, Volkswagen, and Zscaler. Exposed information includes cloud credentials, SSH keys, API tokens, package-publishing credentials, environment variables, and AI-provider API keys. If your organization consumed affected LiteLLM versions during the exposure window: do not debate whether a specific secret was accessed rotate everything reachable by the process, including credentials in memory, environment variables, disk, and instance metadata. Forty minutes of malicious code creates months of remediation work.

N-able N-central: Attackers Exploit Incomplete Fix, Persist via Cloudflare Tunnel

N-able released N-central Hotfix 2 after discovering attackers were actively exploiting an incomplete fix from the original update. Attackers gained administrative access before leveraging N-central’s remote administration capabilities to compromise managed endpoints, then established persistence using Cloudflare Tunnel, which many endpoint security platforms treat as legitimate traffic because it represents legitimate infrastructure. Even after N-central admin credentials were revoked, persistence remained through Cloudflare Tunnel. Deploy Hotfix 2 regardless of previous remediation status. Review Cloudflare Tunnel registrations across all managed environments. Do not assume credential rotation removed all attacker access.

Salesforce and ServiceNow Guest Permissions: CityForum Campaign Extracts Data for Over a Year

A data-theft campaign dubbed CityForum quietly extracted information from Salesforce and ServiceNow customer portals for more than a year by abusing guest-user permissions that unintentionally allowed unauthenticated users to access sensitive records. This was not a zero-day, it was a configuration problem. Audit guest-user sharing rules, record visibility, and portal permissions in Salesforce and ServiceNow immediately. Sometimes the fastest vulnerability to fix doesn’t require a patch.

TrueConf Video Conferencing: Russian Operators Trojanize Server Installers

Kaspersky documented an ongoing campaign targeting TrueConf, a widely deployed enterprise video conferencing platform in Russia, where attackers compromised internet-facing TrueConf servers and replaced legitimate software installers with trojanized versions containing the PhantomCore backdoor. PhantomCore communicates through Microsoft OneDrive, blending with trusted cloud traffic. Even organizations that don’t use TrueConf remain at risk if employees join meetings hosted by compromised external organizations. Validate installer integrity for any enterprise software distributed through organizational servers.

North Korean IT Worker Reportedly Obtains U.S. Federal Agency Position

The FBI is investigating how a North Korean national allegedly obtained a remote IT position inside an undisclosed U.S. federal agency, a significant escalation beyond the hundreds of private-sector organizations previously documented. Identity validation cannot end after onboarding. Continuous assurance that the person performing work is the person who was hired is now an operational security requirement.

🔐 Identity, Authentication & Social Engineering

Microsoft Pre-Releases Three CVSS 10.0 Identity Infrastructure Vulnerabilities Before Patch Tuesday

Microsoft released security guidance for more than a dozen vulnerabilities across Active Directory, Entra ID, Azure, SharePoint, and Teams before official Patch Tuesday, including three carrying the maximum CVSS 10.0 rating affecting identity provisioning, Active Directory infrastructure, and enterprise identity services. No active exploitation reported at time of release, but pre-Patch Tuesday guidance signals elevated exploitability concern. Prepare deployment plans immediately. Patch fatigue is understandable. Identity compromise is significantly more expensive.

Sandworm Recruitment Campaign: WireGuard Client Trojanized Through Fake IT Interviews

Ukraine’s CERT documented a Sandworm campaign since at least May targeting system administrators and IT professionals through fake recruitment. Attackers research resumes on legitimate job platforms, contact candidates as recruiters, move to Telegram, arrange Zoom interviews, and send technical exercises requiring a “corporate VPN” download — actually a trojanized WireGuard client that decrypts and executes embedded PowerShell, establishes scheduled task persistence, and retrieves additional payloads. The Linux version retrieves malware through the VPN tunnel. Even WireGuard’s Base64 implementation was modified with a dynamically generated alphabet to frustrate static detection. Teach technical teams that job interviews, recruiter outreach, open-source contribution requests, and technical assessments can all be delivery mechanisms. The people most capable of spotting malicious infrastructure are still vulnerable when the attack arrives inside a workflow they expect to trust.

Atlassian Rovo AI: Single Link Exfiltrates Enterprise Data From Confluence, Jira, SharePoint

Researchers demonstrated that a single crafted link could manipulate Atlassian Rovo into collecting sensitive information from connected enterprise systems before transmitting it externally without exploiting a traditional vulnerability, by leveraging legitimate AI capabilities. Atlassian corrected the issue before public disclosure. The lesson extends beyond one product: enterprise AI assistants with broad visibility across collaboration platforms require continuous review of exactly what information those systems can access, not simply whether the software is patched.

Fortinet MFA Bypass: Guinera/Golden Community Modifies Authentication Files to Accept Fixed OTP

A joint FBI, CISA, DoD Cyber Crime Center, NSA, Secret Service, and South Korean NPA advisory documented the Guinera/Golden Community ransomware operation exploiting FortiOS and FortiProxy authentication bypasses. In one documented intrusion, attackers compromised an SSL VPN admin account protected only by default credentials, then modified authentication files on a corporate VDI portal so that a specific one-time password value would authenticate successfully every time. They didn’t break MFA cryptographically they changed the system implementing MFA to accept their authentication. Post-intrusion: lateral movement over SMB, domain controller credential harvesting, VPN session cookie hijacking, massive data exfiltration, then ransomware with demands routinely exceeding $10 million. Validate MFA workflows by testing authentication behavior, not simply confirming MFA is enabled. Validate FortiOS and FortiProxy remediation and audit VPN/VDI authentication files for unauthorized modifications.

AnMed Hospital: The Gentlemen Ransomware Hijacks Hospital Facebook Page to Post Ransom Demands

The Gentlemen ransomware group encrypted AnMed’s systems, stole approximately six terabytes of data including allegedly sensitive mental health and assault records, maintained presence for multiple weeks with numerous facilities still closed, then escalated by hijacking AnMed’s Facebook page to post ransom demands directly to patients before the page was removed. The operation offers affiliates 90% of ransom payments an unusually generous model enabling aggressive recruitment. Entry methodology: target internet-facing edge infrastructure, brute-force VPN and web-panel credentials, exploit known vulnerabilities or purchase initial access, obtain admin privileges, disable security tools, exfiltrate, encrypt. The group also abuses vulnerable third-party drivers to terminate EDR products. EDR tamper protection and vulnerable driver block-listing must be prioritized alongside VPN hardening.

Lazarus FudModule Rootkit with New Windows Smart App Control Bypass

The AFD.SYS zero-day (CVE-2026-68820) was used by Lazarus alongside a new FudModule rootkit version adding capability to tamper with Windows Smart App Control. The new backdoor “Troy” supports 17 commands including file exfiltration, in-memory DLL injection, and remote process termination. Operation Dream Job targets defense, aerospace, and aviation employees in Europe and India through fake recruitment. At least one compromised French organization was used as spear-phishing infrastructure for additional targets. For defense-industrial-base organizations: prioritize the Windows update, investigate unexplained EDR telemetry gaps as potential rootkit indicators rather than agent malfunctions, and hunt for Roundcube RelayShell indicators where the platform is exposed.

🔓 Data Breaches & Exposures

CEVA Logistics: Eight European Warehouses, Customer Data Exposed to Banking, Retail, Technology Customers

CEVA Logistics confirmed a cyberattack beginning July 29 affecting eight European warehouses and exposing customer information downstream to banking, retail, and technology customers including Valve/Steam hardware buyers. Names, addresses, phone numbers, and email addresses confirmed stolen. If your company uses CEVA, determine whether customer or employee information flowed through affected facilities before waiting for formal breach notification.

Belgian Connective eID Extension: 2 Million Users, Eight of Ten Largest Banks

Researchers disclosed severe vulnerabilities in Belgium’s Connective eID browser extension enabling malicious websites to silently access electronic identity and payment card information, with fraudulent authentication prompts tricking users into disclosing PINs. A separate RCE could have enabled self-propagating attacks. Fixes shipped in late July; no exploitation confirmed before disclosure. For financial institutions: browser extensions and middleware supporting authentication become part of the institution’s effective security perimeter even when developed by other vendors.

Healthcare Software Provider Unlimited Technology Systems: 3.8 Million Patients, Nine-Month Notification Delay

Healthcare software provider disclosed a breach affecting 3.8 million individuals including SSNs, medical records, and diagnosis data with public notification beginning approximately nine months after original compromise. Nine months is not an acceptable notification timeline for this data category.

UK ACRO Criminal Records Office: Missed Alerts for Nearly Two Years

Britain’s data protection regulator reprimanded ACRO after three breaches remained undetected for nearly two years with antivirus alerts going unread while a content management system remained unpatched for almost four years. Nearly 11,000 people had information staged for theft. Buying security tools doesn’t create security. Someone has to monitor them, respond to them, and maintain the systems they protect.

IEH Corporation: Defense Supplier Email Compromise, Export-Controlled Technical Information

Military supplier IEH Corporation supporting Patriot and THAAD programs disclosed compromise of an employee mailbox containing purchase orders, customer communications, and potentially export-controlled technical information.

Levi Strauss Internal Systems: Three Employees Socially Engineered

Levi Strauss confirmed attackers accessed internal corporate systems after socially engineering three employee workstations. Consumer information reportedly unaffected.

Helix Claims Uber Freight Breach via Help Desk Social Engineering

Hacking group Helix (UNC6671) claimed breach of Uber Freight through mail, cloud storage, and dispatch documentation via help desk social engineering attacks. Uber Freight stated operations unaffected; claims unconfirmed at time of publication. The help-desk attack vector is the consistent entry point regardless of victim organization.

🤖 AI Security

UK AI Security Institute: Anthropic’s Claude Creates Fake Personas and Sends Phishing Emails During Testing

The UK’s AI Security Institute reported that Anthropic’s Claude model independently created fake online personas and sent phishing emails during additional testing exercises. Meta, OpenAI, and Anthropic all confirmed participation in the third-party AI evaluation program responsible for these autonomous testing incidents. AI safety from theoretical research into operational cybersecurity reality continues moving rapidly. Build AI deployments with containment failure as a design assumption.

OpenAI Expands Daybreak Cyber Defense with GPT-5.6 SOC Integration

OpenAI expanded its Daybreak Cyber Defense program with a cybersecurity-focused GPT-5.6 offering for incident response, malware analysis, and vulnerability research, with trusted partners including Accenture, IBM, CrowdStrike, and Cloudflare. Frontier cybersecurity AI models are moving from research and pilots into actual SOC stack integration. The governance question is how much authority these systems should havenot whether they’ll be present.

Deadlock Ransomware Moves C2 to Polygon Blockchain

Deadlock ransomware stores command-and-control addresses on the Polygon blockchain, uses decentralized communications for victim negotiations, and cloud storage for stolen data designed to make traditional law-enforcement takedowns more difficult. Microsoft recommends EDR block mode, tamper protection, controlled folder access, and attack-surface-reduction rules targeting lateral movement tooling.

⚖️ Policy, Law Enforcement & Industry

Adobe August Patches: Three Priority 1 ColdFusion Vulnerabilities Including OS Command Injection at Perfect Severity

Adobe addressed 50+ vulnerabilities including three Priority 1 critical ColdFusion issues — OS command injection, expression-language injection, and a serious authorization flaw. Campaign Classic received three critical Priority 1 updates. Vendor patch timelines are guidance, not your risk model. These belong high in the remediation queue.

SAP August: Perfect-Severity Commerce Cloud Authorization Bypass, NetWeaver Unauthenticated Memory Corruption

SAP patched four critical vulnerabilities including a perfect-severity authorization bypass in Commerce Cloud Data Hub Adapter, code injection in Manufacturing Integration and Intelligence, and an unauthenticated memory corruption in NetWeaver Application Server ABAP. No exploitation reported; Commerce Cloud and NetWeaver are attractive enterprise targets.

Zoom “Zoom’s Day”: Zero-Click RCE Through Annotation Functionality

A zero-click RCE through Zoom’s annotation functionality, another meeting participant can potentially compromise a victim’s machine without clicks or warning prompts. Three additional annotation and VDI vulnerabilities corrected. Update Zoom Workplace, Rooms, and Meeting SDK to fixed versions. A meeting participant silently obtaining code execution through a collaboration feature deserves accelerated deployment.

Mozilla: Firefox and Thunderbird GPG Signing Key Rotated After Accidental GitHub Exposure

Mozilla rotated signing keys after an unencrypted copy was accidentally committed to a private GitHub repository with limited authorized user access. No exploitation evidence. Organizations manually validating signatures or installing through RPM workflows should update verification procedures.

Palo Alto Networks: PAN-OS, GlobalProtect, Prisma Access Updates

Security updates released outside standard Patch Tuesday affecting PAN-OS, GlobalProtect, and Prisma Access, highest severity 7.2, no known exploitation. Deploy through accelerated maintenance process and continue monitoring.

Intel and AMD: 80+ Vulnerabilities Including Xeon and Ryzen Master

Intel addressed 72 issues including Xeon processors and wireless drivers. AMD patched high-severity vulnerabilities in Vitis development and Ryzen Master utility. No active exploitation identified. Prioritize based on deployed hardware and actual exposure.

U.S. Senate Confirms Adam Cassidy as Cyber Ambassador

Adam Cassidy confirmed as Ambassador for Cyber and Digital Policy, only the second individual to hold the position since its creation.

Rapid7 Cuts 12% of Workforce

Rapid7 eliminating approximately 314 positions as new CEO restructures the company. Platform consolidation, AI, and changing customer expectations are reshaping the security vendor market. The employees affected are generally not responsible for strategic complacency, the cybersecurity community should help talented practitioners land next opportunities.

DEF CON 30,000 Feet Incident

Delta is investigating allegations that DEF CON attendees conducted a Wi-Fi deauthentication attack on an Atlanta-bound flight from Las Vegas, broadcasting a rogue Delta-branded access point and reportedly capturing credentials. Federal agents met the aircraft and seized equipment. Responsible security research requires authorization. A commercial aircraft with passengers is not your lab.

✅ This Week’s Priority Action List

Immediate (Do This Now)

Emergency-patch VMware vCenter — CVSS 9.8, no workaround, 95% of identified victims compromised within five days; remove management interfaces from internet, require VPN and MFA for admin access, hunt for Reverse SSH
Deploy Cisco ASA and FTD hotfixes — active exploitation confirmed, no workaround, VPN infrastructure at stake
Patch all on-premises SharePoint — fifth summer exploitation, Rapid7 PoC to active honeypot exploitation in under 24 hours; rotate machine keys where compromise is suspected
Prioritize CVE-2026-68820 (AFD.SYS Windows zero-day) — Lazarus Group exploitation confirmed, investigate any EDR telemetry gaps as potential rootkit indicators
Emergency-patch Metabase — maximum-severity SQL injection, Framework Computer already confirmed compromised; revoke sessions, rotate every connected database credential
Deploy N-able N-central Hotfix 2 regardless of previous remediation — incomplete fix, Cloudflare Tunnel persistence survives credential rotation; audit Tunnel registrations
Patch SonicWall SMA 1000 — ransomware operators now confirmed using pre-patch zero-days; investigate appliance activity back to late June, rotate all credentials
Review Salesforce and ServiceNow guest-user permissions — CityForum campaign active for over a year through configuration problem, no patch required to fix

Short-Term (This Month)

Identify whether affected LiteLLM versions entered any CI/CD pipeline and rotate all reachable secrets immediately
Validate FortiOS and FortiProxy remediation and audit VPN/VDI authentication files for unauthorized modification — Guinera modified MFA implementation itself
Deploy Microsoft identity infrastructure CVSS 10.0 vulnerabilities before routine Patch Tuesday window
Patch Adobe ColdFusion, Campaign Classic (three Priority 1 each), and Commerce
Patch SAP Commerce Cloud and NetWeaver August vulnerabilities
Update Zoom Workplace, Rooms, and Meeting SDK — zero-click RCE through annotation
Strengthen help desk identity verification — AnMed, Uber Freight, and Levi Strauss all entered through social engineering
Train technical staff that job interviews, recruiter outreach, and technical assessments are attack delivery vectors — Sandworm WireGuard campaign targets sysadmins specifically
Review enterprise AI assistant data access permissions (Atlassian Rovo lesson extends to all similar tools)
Audit OT connectivity through cellular routers and private APNs; remove unnecessary SSH access — Poland attack is documented proof of concept

Strategic (This Quarter)

Build an emergency vulnerability remediation lane that can operate within hours for internet-facing exploitation — VMware’s five-day window and SharePoint’s 24-hour window make standard patch cycles operationally insufficient
Establish continuous remote worker identity validation, not just pre-hiring verification — North Korean federal agency placement requires this
Implement EDR tamper protection and vulnerable driver block-listing as baseline controls — The Gentlemen uses vulnerable drivers to terminate EDR before encrypting
Develop governance framework for SOC-integrated AI before frontier models become deeply embedded in security workflows
Build software composition analysis and CI/CD secrets management into standard operational security — LiteLLM’s 40-minute exposure window is the operational model for why these matter

🎙️ James Azar’s CISO’s Take

Coming back from Hacker Summer Camp, one message stands above everything else: defenders need to spend less time chasing individual vulnerabilities and more time protecting the platforms that orchestrate trust across the enterprise. Metabase manages enterprise data. N-central manages customer infrastructure. Microsoft manages identity. VMware manages virtualization. Atlassian Rovo manages organizational knowledge. These systems don’t simply support the business, they control access to it. That makes them strategic assets deserving of continuous monitoring, segmentation, privileged access controls, and executive visibility. The Poland attack is a perfect illustration of what happens when that principle is ignored at the OT layer: a VPN gateway everyone forgot about became the first step in a chain that reached Siemens PLCs controlling a heat plant for 50,000 residents.

The second lesson is patch velocity. Four hundred twenty-one Microsoft CVEs, VMware’s five-day victim window, SharePoint’s proof-of-concept to active exploitation in under 24 hours, LiteLLM’s 40-minute exposure cascade across 2,500 organizations, the message is consistent and unmistakable. Standard vulnerability management timelines were built for a threat environment that no longer exists. Security programs need emergency remediation lanes that can operate at attacker speed for internet-facing exploitable vulnerabilities, while maintaining responsible change management for the rest of the estate. Attackers aren’t honoring our maintenance window schedules, and our operational posture needs to reflect that reality.

📋 Week in Summary

This was a week that quantified what “too slow” looks like in 2026: 95% of VMware vCenter victims compromised within five days of disclosure. SharePoint exploitation in under 24 hours after a public proof-of-concept. LiteLLM’s malicious packages active for 40 minutes and potentially reaching 434,000 CI/CD pipelines. SonicWall’s zero-days exploited for three weeks before patches existed, and now by ransomware operators after disclosure. These are not outliers. They are the new baseline for internet-facing enterprise infrastructure.

The structural stories were equally important. A Sandworm recruitment campaign turned the IT job interview into a malware delivery mechanism specifically targeting the technical professionals most likely to spot an attack. Guinera ransomware modified MFA authentication files so their OTP would always work, they didn’t break MFA, they changed the system implementing it. N-able’s incomplete patch created a second compromise wave, with attackers persisting through Cloudflare Tunnel even after credential rotation. And AI continued its operational emergence on both sides: UK government testing showed Claude creating fake personas and sending phishing emails autonomously, while Atlassian Rovo required only a single crafted link to exfiltrate enterprise data from connected systems. The common thread across all four episodes: trust without continuous validation has become the most exploited vulnerability in enterprise security, and the organizations that validate faster than attackers exploit will be the ones still standing at the end of this.

Stay informed. Stay prepared. Stay Cyber Safe. 🔐

Discussion about this post

Ready for more?