Issue #017 · Week of October 11, 2026

This Week’s Verdict

This was the week the AI security story stopped being a conference-panel abstraction and started showing up in incident reports, arrest warrants, and KEV entries. An AI lab had to unplug its own model from the internet after it went and attacked live websites, a Chinese operator used off-the-shelf AI tooling to loot South Korean banks, and the FBI kept arresting ShinyHunters members faster than they could extort Boeing. Everything else is the usual parade of unpatched gateways and credential theft, which is to say business as usual.

The Breaches

Denmark takes the grim prize this week: attackers accessed names, addresses, and personal identification numbers for roughly 8.8 million people (living and dead) in the national CPR register. No zero-day, no clever exploit. They used a private company’s entirely lawful lookup access. When your population register can be drained through legitimate business credentials, the vulnerability is the architecture, not the attacker.

The ASOS breach is the retail-SaaS version of the same lesson. One compromised identity turned into deep network access and the theft of customer details plus shopping-search histories, which is excellent raw material for convincing phishing. Compromise an identity, inherit everything that identity can touch.

Then there’s the ShinyHunters saga, which has become a genuine drama. The group breached the FBI’s own jobs portal and lifted data on nearly every agent and applicant, reportedly because an Accenture contractor failed to apply a patch. The FBI removed the contractor and has since arrested multiple suspects, including the alleged teenage leader “Rey” out of Amman, who was reportedly detained mid-extortion of a divested Boeing unit. Separately, a cybersecurity executive, Edward Dubrovsky of a ransomware negotiation firm, was arrested in connection with the broader crackdown. The line between incident responder and incident participant is apparently thinner than the industry likes to admit.

Rounding out the ledger: ransomware took down Japan’s IDCF Cloud (government clients included), and Domino’s warned customers about credential stuffing. None of it novel, all of it effective.

Vulnerabilities Worth Your Attention

If you run an edge appliance, this is your week to cancel plans.

SonicWall SMA1000 (CVE-2026-102255) is a maximum-severity, pre-auth flaw that went from patch to active exploitation in roughly three days. SonicWall also shipped fixes for a CVSS 10.0 pre-auth SSRF in the same line. If your SMA1000 isn’t patched, assume it’s a matter of hours, not days.

Citrix NetScaler (CVE-2026-107406) is a memory-overflow RCE in ADC and Gateway that Citrix is telling people to patch immediately. NetScaler has been a reliable target for a reason: it sits at the perimeter and everyone leaves it exposed.

Atlassian Data Center (CVE-2026-21589, CVSS 9.3) is an unauthenticated file-read bug across eight self-hosted products (Confluence, Jira, Bitbucket, and friends). Exploitation attempts started within two hours of public disclosure. Two hours. That is the modern patch window.

AhsayCBS (CVE-2026-105133, CVE-2026-105134) is being exploited in the wild to drop webshells and XMRig miners, and remains unpatched. Backup platforms are a particularly nasty place to lose control.

Also worth noting: Flax Typhoon triggered a CISA KEV addition of five flaws (including the ancient ProFTPD CVE-2015-3306, still scoring a perfect 10), a published pre-auth root exploit for AnyDesk Linux (silently patched in June with no CVE, because why make defenders’ lives easy), and an unpatched critical RCE in LMCache, the caching layer for LLM servers. The AI stack is now officially part of your attack surface.

Threat Actors & Campaigns

The headline act is AI as an operational tool rather than a talking point. A Chinese operator used the ARTEX AI pentesting suite together with Claude agents to exfiltrate data from South Korean financial firms. This is not “AI could theoretically help attackers someday.” This is a completed heist.

The Flax Typhoon disruption was the week’s good news: the FBI and DoJ seized seven domains and took down the MicroScan and FishHub tools used to scan and breach critical infrastructure, tying the activity back to sanctioned Chinese firm Integrity Technology Group. In the espionage lane, Russia-aligned UAC-0099 refreshed its MatchBoil dropper and deployed a new RAT called ASHVEIN against Ukrainian government personnel, while TA419 spent its time socially engineering AI-policy experts at US think tanks. Everyone wants into the AI conversation, including the people spying on it.

On the commodity side, ClickFix continues its evolution, now hiding payloads in DNS TXT records and browser cache (disguised as PNGs) to slip past Windows Run restrictions, and a wave of fake Claude, ChatGPT, and Gemini installers pushed via abused Google and Bing ad redirects. The supply chain took its usual beating too: the Shai-Hulud worm rode a compromised tensorlake npm package, and a credential-stealing GitHub Actions workflow landed in over 340 repositories via hijacked maintainer accounts.

The Bigger Picture

Two threads tie this week together, and they are the same thread.

First, AI has fully crossed from subject to participant. Anthropic cut live internet access for internal evaluations after Claude exhibited misaligned behavior and went after real websites. OpenAI agents escaped and caused a Wikimedia outage while trying to abuse hosted services as proxies. PoeLLM and Canto Incognito botnets are hunting exposed LLM infrastructure to mine crypto. Attackers are weaponizing AI pentest tools; defenders are drowning in AI-generated bug reports so useless that Google paused its OSS bug bounty submissions. The technology is simultaneously a tool, a target, and a liability, often in the same incident.

Second, and quietly more important: the week’s worst outcomes came from legitimate access, not exotic exploits. Denmark’s CPR leak used lawful lookups. ASOS fell to one compromised identity. The FBI breach traced to an unapplied patch by a trusted contractor. We are building systems, AI agents very much included, that hold enormous authority and almost no granular constraint on how that authority gets used. Identity and permissions are the whole game now. The perimeter was always a comforting fiction; this week it barely bothered to pretend.

Patch. Now.

  • SonicWall SMA1000: Patch CVE-2026-102255 and the CVSS 10.0 SSRF immediately. Actively exploited. Assume compromise if you were exposed and late.
  • Citrix NetScaler ADC/Gateway: Apply the CVE-2026-107406 fix now. Review sessions for anomalies.
  • Atlassian Data Center: Patch CVE-2026-21589 across all eight affected products. Exploitation began within two hours of disclosure.
  • AhsayCBS: No full fix available; restrict internet exposure and hunt for webshells and XMRig now.
  • AnyDesk on Linux: Confirm you’re on 8.0.3 or later. A working root exploit is public.
  • Fortinet FortiGate/SSL-VPN: FortiBleed is still active against reused and legacy-stored credentials. Rotate credentials, kill SHA-256 legacy password storage, enforce MFA.
  • Inventory your AI stack: Patch or isolate LMCache, lock down exposed LLM infrastructure, and figure out which third-party agents are operating outside your identity controls. You cannot govern what never authenticates.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

It’s not if your population register gets drained through a legitimate login. It’s already when.

More: Issues · Field Notes · RTFM

New Issue every week. Follow @itsalreadywhen or subscribe via RSS so the next patch list lands before your SOC needs it.