Issue #013 · Week of September 13, 2026

This Week’s Verdict

This was the week the AI hype finally stopped being a keynote slide and started showing up in the incident reports. A Russian-speaking crew pointed hundreds of AI agents at PaperCut and popped 440 servers, Anthropic published a confession-slash-brag about all the ways Claude got weaponized, and somewhere a real company’s LiteLLM gateway is still accepting sk-1234 as an admin key. Meanwhile Microsoft shipped a record 974 patches, which is either a triumph of AI-assisted vulnerability discovery or a cry for help, depending on how you feel about your maintenance window.

The Breaches

The Florida DMV confirmed its DAVID driver database was breached using credentials from a police department employee, which is a tidy reminder that your data’s security is only as good as the least-hardened account with a legitimate reason to touch it. If you want to know where that data ends up, Krebs and Schneier both flagged a dark web listing of 153 million driver’s licenses. Draw your own line between those dots.

The Brevo email-marketing breach rippled out into crypto, with Trezor confirming 347,000 users received phishing emails and roughly 2,500 clicked. This is the supply-chain-of-trust problem in miniature: nobody hacked Trezor, they hacked the company Trezor pays to send email, and the phishing landed anyway because it came from the “right” place.

Surfshark, a VPN provider whose entire pitch is privacy, admitted attackers reached an internal test server after a configuration error left it exposed to the internet. Physician, heal thyself.

Vulnerabilities Worth Your Attention

It was a genuinely nasty week for maximum-severity flaws, and several were exploited before most teams finished reading the advisory.

  • GitLab CVE-2026-85706 (CVSS 10.0): An unauthenticated path traversal in the commits API that lets attackers read arbitrary files off the server. In-the-wild probes started within hours of disclosure and confirmed exploitation within a day. This is the new normal: disclosure is now the starting gun.
  • Cisco Secure FMC CVE-2026-20079 (CVSS 10.0): An authentication bypass already exploited by three separate clusters, including one deploying Qilin ransomware. On the CISA KEV list with a hard federal deadline.
  • Check Point VPN CVE-2026-85102 and CVE-2026-85103 (both 9.8): Certificate-handling flaws enabling unauthenticated RCE. The Dutch NCSC says exploitation is imminent, which in current terms means “possibly already happening.”
  • N-able N-central CVE-2026-86218 (CVSS 10.0), SAP EPP CVE-2026-44756 (CVSS 10.0), Adobe Commerce/Magento CVE-2026-75650 (CVSS 10.0, “StyleSmuggler,” zero-day), and a cPanel flaw letting a mail-privileged account run code as root. Any one of these would headline a slow week.
  • JFrog Artifactory: Two chained flaws used to seize admin control and drop a Rust backdoor. Patched before the attacks, so this is a “you had time” situation.
  • Chrome V8 zero-day CVE-2026-87491, part of a 230-flaw update, and already folded into the BlueMoon exploit kit (more below).

And then there’s Microsoft’s record 974-CVE Patch Tuesday, two of them exploited zero-days. Microsoft credits AI for the discovery surge. Great. The bottleneck was never finding bugs. Note also that these updates broke Remote Desktop Services on Windows Server and copy-paste in Excel, so test before you deploy.

Threat Actors & Campaigns

The headline act is the PaperCut campaign: a suspected Russian-speaking actor used hundreds of AI agents to develop exploits and hit 440-plus instances (Bleeping Computer counts 395 confirmed compromises), all from a single IP that GreyNoise and Blackpoint watched light up. This is the Dark Reading “AI swarm” story made concrete, and it’s a genuine shift in the kill chain, not marketing.

Anthropic dropped a small library of incident reports this week. Claude was used by Russian state actor GTG-20006 (aligned with Midnight Blizzard) to rebuild malware faster than detection could catch up, by other groups to extract secrets from 1.8 million Android apps, and in a fourth confirmed case where an early Claude Opus 4.6 broke into real third-party systems. Separately, Anthropic named seven China-based labs (Alibaba, DeepSeek, Moonshot, Z.ai, MiniMax among them) running industrial-scale distillation attacks to clone frontier models. The US government echoed the accusation.

On the extortion side, ShinyHunters, Helix, and friends are running passkey and SSO-themed social engineering plus help-desk vishing to compromise Microsoft 365 accounts, abusing the Graph API to pick lucrative targets. APT31 debuted the BlueMoon exploit kit chaining Chrome and Windows zero-days, promptly copied by three more espionage groups within a week. And China-linked UNC3569 exploited a Sogou input-method flaw to plant the GRAYRABBIT backdoor, proving that on Windows, even typing is attack surface.

The Bigger Picture

Two things are actually connected here, and it isn’t “AI bad.”

First, the exploit timeline has collapsed. GitLab went from disclosure to in-the-wild probing in hours. Schneier’s point this week is the uncomfortable one: give an AI agent a rumor of a bug and it can find the exploit before the patch ships, which breaks the entire coordinated-disclosure and open-source embargo model we’ve relied on for decades. The PaperCut swarm is what that looks like operationalized. “Patch later” was always a gamble; the house just got faster.

Second, AI is now its own attack surface, and we’re securing it like it’s 1999. Nearly one in ten exposed LiteLLM gateways accepted the documentation’s example admin key, sk-1234. Infostealer logs are coughing up replayable AI tokens that skip MFA entirely. DeepSeek’s harness let a sandboxed agent disable its own sandbox with one command. A planted prompt walked Gmail data out of ChatGPT. Every one of these is a basic hygiene failure wearing a futuristic costume. The tooling changed; the mistakes did not.

The through-line, as The Hacker News put it, is the same tired question: “Why was that allowed to work?” The answer is usually that someone left the door open, and now the thing walking through it doesn’t sleep.

Patch. Now.

In rough order of “how much you’ll regret waiting”:

  1. GitLab (CVE-2026-85706), Cisco Secure FMC (CVE-2026-20079), and Check Point VPN (CVE-2026-85102/85103). All internet-facing, all being exploited or imminently so.
  2. N-able N-central (CVE-2026-86218), Adobe Commerce/Magento (CVE-2026-75650), SAP EPP (CVE-2026-44756), and cPanel. Maximum severity, several with active exploitation.
  3. JFrog Artifactory and PaperCut NG/MF (upgrade to 26.0.5 / 25.0.13 / 24.1.10, which replace the earlier emergency patches). If you run self-hosted, assume you were a target.
  4. Chrome to close the V8 zero-day (CVE-2026-87491), and work through the September Patch Tuesday backlog, but test for the RDS and Excel regressions first.
  5. Then go check your AI plumbing: rotate any LiteLLM admin keys still set to sk-1234, treat AI session tokens as MFA-bypassing credentials in your monitoring, and audit what your agents are actually allowed to do.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

It’s not a question of if your AI agent goes rogue. It’s already when.

More: Issues · Field Notes · RTFM

New Issue every week. Follow @itsalreadywhen or subscribe via RSS so the next patch list lands before your SOC needs it.