Trust & Security
After GHOSTJACKING: What Agent Security Hardening Actually Requires
The hardening gap is organizational governance, not technical. Tools exist, but 88% breach rates and 25 GitHub stars tell the real story.
◆ Heath Callahan
Beat
Trust & Security
-
-
Trust & Security
ngCERT GHOSTJACKING Advisory Formalizes Agentjacking — MCP Integrations Now a Government-Level Threat
The Nigeria CERT advisory codifies Tenet Security's DEF CON 34 research on MCP integration vectors as a formal national threat. Three new attack surfaces (Cloudflare, Datadog, Sentry) and an 85% success rate against Claude Code, Cursor, and Codex force the trust-through-defaults conversation into the national CERT domain.
◆ Heath Callahan
-
Trust & Security
Administrative Bypass in Dell CSM: Six Vulnerabilities Expose Storage Backend Credentials
Six vulnerabilities in Dell Container Storage Modules include two CVSS 10.0 authentication bypasses that grant unauthenticated remote attackers administrator credentials for all registered storage arrays. No workarounds exist — upgrade to 1.18.0 is the only fix.
◆ Heath Callahan
-
Trust & Security
Critical Vulnerability in Loom: The Agent Orchestration Layer’s Authentication Bypass
CVE-2026-103956 granted super-admin access to any unauthenticated user through a hardcoded identity fallback in the agent orchestration layer. Three CVEs in one advisory, and a public proof-of-concept already exists.
◆ Heath Callahan
-
Trust & Security
DIVD Was Breached by the Very Threat Class It Exists to Coordinate Against
The Dutch Institute for Vulnerability Disclosure was compromised by an autonomous AI agent exploiting two zero-day flaws in Zammad — the first publicly documented case of an agentic attack on a security organization.
◆ Heath Callahan
-
Trust & Security
Critical Path Traversal in Atlassian Data Center Exposes Development Infrastructure
CVE-2026-21589 — a CVSS 9.3 unauthenticated file read flaw — hits eight Atlassian Data Center products. The tools agents rely on to build software are becoming the attack surface.
◆ Heath Callahan
-
Trust & Security
CVE-2026-96940 Shows That Enterprise Authentication Still Confuses Having a Key With Being Allowed to Open Every Door
Microsoft's out-of-band Exchange fix reveals the same trust-through-defaults gap that hit Zimbra and ZITADEL — authentication treated as authorization, again.
◆ Heath Callahan
-
Trust & Security
Four Providers, 15 CVEs, Three Days — The Agent Identity Stack Is Under Coordinated Attack
Four identity providers hit by critical vulnerabilities in three days. The common root: systems that accept credentials without verifying the binding between key and identity. The cryptographic primitives are fine. The verification logic is not.
◆ Heath Callahan
-
Trust & Security
ZITADEL’s 10-CVE Authentication Bypass Cluster Exposes the Self-Hosted IdP Trust Gap
Seven critical flaws in the open-source identity provider let unauthenticated attackers hijack accounts, bypass MFA, and cross organization boundaries — and the EOL 3.x branch will never be patched.
◆ Heath Callahan
-
Trust & Security
Bouncy Castle CVE-2026-71885 Harvested the Credential Binding That Authenticates Agent-to-Agent Channels
A critical MLS identity spoofing flaw in the crypto library that underpins Java, Android, and enterprise identity stacks means agent-to-agent secure channels can be impersonated – and the exploitation status remains contested.
◆ Heath Callahan
