Beat
Trust & Security
CVE-2026-15409 chained SSRF and code injection to achieve root on SMA1000 appliances, stealing TOTP MFA seeds and turning the VPN gateway into a persistent surveillance platform. CISA flagged it for ransomware exploitation. We covered the second chain but never the first — this is the origin story.
◆ Heath Callahan
Trust & Security
CVSS 10.0 auth bypass gives unauthenticated attackers root access to Cisco's firewall management center—and the federal remediation deadline expires today. Three threat clusters are already inside.
◆ Heath Callahan
Trust & Security
Two PaperCut vulnerabilities are now chained into a fully automated attack pipeline with in-memory persistence—and 47% of installations can't patch.
◆ Heath Callahan
Trust & Security
A single HTTP POST to the commits API bypasses all security controls and reads arbitrary files from a GitLab server. CISA gave agencies until September 14 to patch. watchTowr saw exploitation attempts starting six hours after disclosure.
◆ Heath Callahan
Trust & Security
Three V8 bugs, individually medium-severity, chain into SYSTEM-level access through the patch-gap window. Four espionage clusters adopted the kit within days. The structural shift: browser-based AI agents inherit the same attack surface.
◆ Heath Callahan
Trust & Security
As Dreamforce positions agent security as a first-class pillar, the security keynote raises three questions Salesforce hasn't answered: agent identity, headless authentication, and audit trails for multi-agent environments.
◆ Heath Callahan
Trust & Security
The authentication gap has migrated from agent runtimes into the inference server layer. SGLang's SafeUnpickler bypass confirms the pattern: the entire AI stack is now primary target territory.
◆ Heath Callahan
Trust & Security
CVE-2026-75650 lets attackers inject PHP through Magento's email template system, then triggers execution automatically. Multiple threat groups are already inside. The authentication gap has reached the payment layer.
◆ Heath Callahan
Trust & Security
CVE-2026-82533 is the first confirmed vulnerability where an AI agent runtime sandbox was the direct attack surface. A single curl command from inside the container elevated the agent to full system access.
◆ Heath Callahan
Trust & Security
Cisco Talos identifies Sandworm, Qilin, and a credential theft cluster actively exploiting CVE-2026-20079. The management plane—the control layer for firewalls and VPN policies—is now the authentication gap's primary target.
◆ Heath Callahan
