The Watch

The Convergence That Demands Immediate Action

Three vulnerability clusters hit simultaneously this cycle, and your patch queue just became a triage exercise against active nation-state exploitation. The most critical: APT28 (GRU/Fancy Bear) is actively exploiting CVE-2026-21513, a Microsoft browser zero-day that chains specially crafted .lnk files with embedded HTML to bypass both Mark of the Web (MotW) and Internet Explorer Enhanced Security Configuration. The exploit achieves code execution outside the browser sandbox. Microsoft patched this in the February 2026 cycle, but Akamai researchers confirmed exploitation both before and after patch release.

The delivery vector — .lnk files — means email attachments, USB drives, and file shares are all viable initial access paths. This maps directly to environments where users handle external files, making it particularly dangerous for organizations with partner ecosystems or customer-facing document workflows.

Parallel Urgency: Roundcube and SolarWinds

CISA added two actively exploited Roundcube Webmail vulnerabilities to the KEV catalog: CVE-2025-49113 (deserialization → RCE, critical) and CVE-2025-68461 (XSS, high). Roundcube has been the default webmail for cPanel since ~2008, with 46,000+ internet-facing instances on Shodan and 10+ prior KEV entries. The CISA deadline is March 13, 2026. Secure versions are 1.5.13 and 1.6.13.

Separately, SolarWinds patched four critical vulnerabilities simultaneously — a volume that suggests high-severity exploitation potential. Given SolarWinds' history as a supply chain attack vector, threat actors will be reverse-engineering these patches within hours.

The Breakout Time Crisis

CrowdStrike's latest data provides the operational context: average breakout time is now 29 minutes, down from 98 minutes in 2021. The fastest observed breakout was 27 seconds. This 70% compression over four years means that if your SOC relies on manual triage and escalation, you are mathematically unable to contain most intrusions before lateral movement completes.

When APT28 is exploiting browser zero-days and attackers break out in 29 minutes, the question isn't whether your defenses are good enough — it's whether they're fast enough.

VulnCheck's 2025 Exploitation Data

Cross-referencing with VulnCheck's annual analysis: of 40,000+ CVEs published in 2025, only ~1% were exploited in the wild — but attackers disproportionately targeted network edge devices and 'repeat offender' vendors. Four SharePoint zero-days alone hit 400+ organizations. The data proves that CVSS-driven patching misallocates resources — exploitation-evidence-first prioritization is essential.

Three Distinct Attacks, One Target: Your Software Factory

Your CI/CD pipeline took fire from three directions this cycle, and the convergence is worse than any individual attack. A self-propagating NPM worm is actively harvesting secrets from CI environments, weaponizing build systems to spread across projects, and carrying a dormant wipe mechanism that can be triggered remotely. Separately, the Cline CLI AI coding assistant (5M+ installs) was compromised for eight hours on February 17, silently installing the malicious OpenClaw agent. And researchers demonstrated RoguePilot, a prompt injection attack that hijacks GitHub Copilot through crafted issue content to exfiltrate GITHUB_TOKENs.

The NPM Worm: Espionage + Destruction in One Package

This isn't a single malicious package — it's a worm with three operational phases:

• Harvest: Extracts API keys, cloud credentials, signing keys, and tokens from CI environments
• Weaponize & Spread: Uses compromised CI systems to propagate to other projects, including packages consumed by AI coding assistants
• Dormant Destruction: Carries a remotely-activatable wipe payload — pre-positioned sabotage

The targeting of AI coding tools is the critical evolution. If an AI assistant consumes a compromised package and suggests code patterns derived from it, the malicious payload propagates through developer trust in AI suggestions — a human-in-the-loop amplification vector that traditional SCA tools won't catch.

Cline CLI: Anatomy of an AI Tool Supply Chain Attack

The Cline compromise timeline reveals systemic failures in AI tool security:

1. December 2025: Researcher Adnan Khan discovers prompt injection flaw in Cline's AI-automated issue triage
2. January 2026: Khan warns production publish tokens are at risk — no response for over a month
3. February 9: Public disclosure; Cline patches within one hour
4. February 10: Anonymous source confirms possession of valid npm and OpenVSX credentials
5. February 11: Cline rotates credentials but misses an exposed npm token
6. February 17: Missed token used to publish compromised Cline CLI 2.3.0 with OpenClaw — live for 8 hours

Cline now uses OIDC provenance via GitHub Actions for npm publishing — a remediation that should have been in place before the incident.

RoguePilot: Copilot as Attack Vector

Hidden prompt injections in GitHub issues can silently hijack Copilot, causing it to exfiltrate privileged GITHUB_TOKENs. This bypasses every traditional code review control because the malicious payload lives in issue text — content developers don't scrutinize for executable intent. Any organization using Codespaces with Copilot enabled on repositories accepting external issues is exposed.

A self-propagating NPM worm with a dormant wipe payload is targeting the exact CI/CD pipelines and AI coding tools your developers trust most — if you haven't audited your dependency tree this week, assume you're already behind the attacker.

Your Federal Safety Net Has Holes — And the Exploit Supply Chain Just Got Sanctioned

Two developments this cycle fundamentally change your assumptions about federal cyber coordination and the offensive exploit market. CISA has lost approximately one-third of its workforce, shut down entire divisions, and operates under an unconfirmed acting director whose leadership has reportedly eroded trust with industry partners. Simultaneously, the U.S. Treasury sanctioned Operation Zero, a Russian exploit marketplace, its CEO Sergey Zelenyuk, and associates — including two Trickbot members running exploit brokerages in the UAE and Uzbekistan.

CISA Capability Degradation: Operational Impact

This isn't about politics — it's about operational capability. CISA nominee Sean Plankey remains unconfirmed by Congress. The practical impact across core missions:

• Advisory publication: Slower turnaround on vulnerability advisories and threat alerts
• JCDC coordination: Reduced capacity for joint cyber defense coordination with industry
• State and local support: Degraded assistance to state/local governments and election infrastructure
• KEV catalog: The catalog remains operational but the analytical capacity behind it is diminished

Some observers believe CISA can rebound if confirmed leadership arrives and staffing is rebuilt, but that timeline is uncertain. Organizations that have relied on CISA as a primary coordination point need backup plans now.

The Exploit Supply Chain: From Insider Theft to Russian Broker to Sanctions

Peter Williams, a former executive at L3Harris's Trenchant unit — a company developing offensive cyber tools for the U.S. government — stole and sold at least eight zero-day exploits to Operation Zero for approximately $1.3 million in cryptocurrency. The Justice Department estimated $35 million in losses to U.S. government offensive programs. Williams received 87 months in prison.

The sanctions reveal a deeply intertwined ecosystem: Operation Zero acquired exploits stolen from a U.S. defense contractor, and two sanctioned individuals are also Trickbot malware group members running exploit brokerages. This confirms that cybercrime infrastructure directly feeds nation-state offensive operations. Sanctions may temporarily disrupt Russia's exploit supply chain, but the network is resilient.

The federal cyber safety net is fraying — CISA lost a third of its people, and the exploit broker that bought stolen U.S. government zero-days just got sanctioned. If your defense strategy depends on anyone but you, it's time to fix that.

The Defense Production Act Just Entered Your Vendor Risk Framework

Defense Secretary Pete Hegseth gave Anthropic until Friday, February 28 to agree to let the Pentagon use Claude for "any lawful use" — including capabilities Anthropic has restricted around mass surveillance and autonomous weapons — or face three escalation paths: contract cancellation, supply chain risk designation, or invocation of the Defense Production Act. Anthropic CEO Dario Amodei has reiterated the company's refusal to remove ethical guardrails.

This creates a genuinely novel category of third-party risk that eight separate intelligence sources flagged this cycle. The implications cascade differently depending on the outcome:

Converging Signals: Safety Erosion and Enterprise Expansion

The Pentagon standoff doesn't exist in isolation. Anthropic simultaneously announced it will no longer pause development of potentially dangerous models if a competitor releases comparable capabilities — abandoning a founding safety commitment. And Claude Cowork launched enterprise integrations with Google Drive, Gmail, DocuSign, FactSet, Slack, Intuit, and LegalZoom — each creating new OAuth-mediated data flow paths.

The contradiction is stark: Anthropic is expanding its access to your enterprise data while weakening its safety commitments and facing government coercion to remove remaining guardrails. This is the moment where AI vendor risk assessment based on vendor promises alone becomes insufficient.

Industrial-Scale Model Distillation: The IP Theft Dimension

Anthropic disclosed that DeepSeek, Moonshot, and MiniMax ran coordinated campaigns using approximately 24,000 fake accounts generating over 16 million interactions to systematically extract Claude's capabilities. Each lab targeted different domains: DeepSeek focused on reasoning, Moonshot on coding and agent behavior, MiniMax on tool use with near-real-time adaptation to model updates. The proxy infrastructure replaced blocked accounts faster than detection could respond.

For any organization exposing AI models or high-value APIs, this is your threat model: distributed extraction through mass fake accounts that defeat per-account rate limiting. You need cross-account behavioral correlation to catch it.

The Pentagon's ultimatum to Anthropic isn't just a policy story — it's the moment third-party AI risk became ungovernable by vendor promises alone, and every CISO needs to treat AI vendor safety commitments as assumptions that can be revoked by government fiat.