The Watch

Three Simultaneous High-Severity Threats

Your SOC needs to triage three distinct but concurrent threats this morning, each targeting a different layer of your infrastructure. Individually they're serious; together they represent the worst week for your perimeter, cloud, and endpoint management since the MOVEit campaign.

CVE-2026-27944: Nginx UI — Full Secret Store Dump Via One HTTP Request

Nginx UI's /api/backup endpoint requires zero authentication and returns the AES-256 encryption key and initialization vector in the X-Backup-Security response header. A single GET request yields everything needed to decrypt the backup — admin credentials, session tokens, SSL private keys, database secrets, and full Nginx configurations. A public PoC is live today.

If Nginx UI's management interface is reachable from the internet, assume scanning has already begun.

CVE-2026-1603: Ivanti EPM — Auth Bypass Now in CISA KEV

Ivanti Endpoint Manager's authentication bypass was patched in February but is now confirmed actively exploited and added to CISA's Known Exploited Vulnerabilities catalog as of March 9. An authentication bypass in your endpoint management platform is a worst-case scenario — it's the system that manages every other system. Any instance unpatched between February and now should be treated as compromised.

AWS Console AitM: 20-Minute Credential Exploitation

DataDog is tracking adversary-in-the-middle phishing campaigns targeting the AWS Console login panel where credential abuse happens within 20 minutes of initial compromise. This AitM approach defeats TOTP, SMS, and push-notification MFA. Only FIDO2/passkeys resist this attack. The Tycoon 2FA Europol takedown this week validates this isn't theoretical — it was a majority share of Microsoft-blocked phishing attempts.

If your AWS root accounts still use TOTP MFA, the 20-minute AitM window means you're one phishing email from full account compromise — FIDO2 is the only control that survives this attack class.

Fortinet: The Monthly Fire Drill Continues

SentinelOne published IR findings from companies compromised via recent FortiGate vulnerabilities. BishopFox published a detailed exploit chain for FortiClient EMS SQL injection (CVE-2026-21643). If you're running Fortinet at your perimeter, the exploit details are public and motivated attackers have them.

This Is Not Five Incidents — It's a Coordinated Category Shift

Developer infrastructure is under multi-vector attack across five distinct ecosystems simultaneously: GitHub Actions, npm, Google Ads, GitHub Issues AI bots, and Salesforce tooling. Google's latest data confirms vulnerability exploitation has overtaken credential abuse as the #1 entry vector into cloud environments for the first time, with third-party software accounting for nearly half of all intrusions in H2 2025.

Vector 1: Compromised GitHub Actions (Xygeni)

The Xygeni GitHub Action was compromised to deploy reverse shells in all projects referencing it. If your CI/CD pipeline uses Xygeni, you may have active backdoors in your build environment right now.

Vector 2: Malicious npm Packages

Two distinct npm campaigns: one impersonating a popular package to steal environment files containing infrastructure credentials, another impersonating OpenClaw to deploy the new GhostLoader malware. Infostealers cost approximately $10 and are now the #1 driver of identity-based attacks with billions of stolen credentials in circulation.

Vector 3: InstallFix Malvertising via Google Ads

Attackers are cloning installation pages for developer tools — including Claude Code — and placing them above legitimate results via Google Ads. Victims execute curl | shell one-liners deploying Amatera Stealer. The campaign uses legitimate hosting, rapid domain rotation, and post-infection redirects to real sites.

Vector 4: Prompt Injection Stealing npm Tokens

A researcher demonstrated a complete kill chain exfiltrating npm publish tokens by opening a GitHub issue. The attack exploited an AI-powered issue triage bot that fed untrusted issue titles directly into LLM prompts with access to secret stores — zero authentication required. This maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise) via a novel AI-mediated initial access vector.

Vector 5: Weaponized Salesforce Security Tooling

Google Mandiant's AuraInspector server scanner has been modified by threat actors to break into Salesforce customer accounts. Salesforce reports mass-scanning of misconfigured Experience Cloud servers.

Developer tool ecosystems are the new primary malware distribution channel — your engineers trust curl|bash, they trust Google search results, and they trust AI triage bots. Every one of those trust assumptions is being exploited this week.

Physical Infrastructure Risk Moves from Page 47 to Page 1

Iran struck three Amazon-owned data centers in Bahrain and the UAE, disrupting internet service for millions. Simultaneously, undersea fiber optic cables through the Red Sea and Strait of Hormuz are effectively closed to commercial traffic as both waterways are active war zones. Meta shuttered its 900-person Tel Aviv R&D hub. Crude oil hit $119/barrel — the first time above $100 since 2022.

This is not a DDoS or a ransomware campaign. This is state-on-state warfare where your cloud region is the target. If your disaster recovery plan assumed "AWS will handle regional failover," that assumption is being tested by cruise missiles.

Blast Radius Assessment

Iranian Cyber Retaliation Doctrine

Historical precedent is clear: kinetic escalation with Iran triggers retaliatory cyber operations within days. During the 2019-2020 Soleimani crisis, Iranian APTs launched destructive campaigns against US targets. Meanwhile, a separate intelligence report confirms MuddyWater compromised Israeli companies via RDP this cycle, and Chinese APT Camaro Dragon pivoted targeting from Southeast Asia to Qatar within days of the strikes — demonstrating the geopolitical agility of state-sponsored operations.

When a nation-state puts a missile through your cloud provider's data center, no amount of WAF rules or SOC playbooks will save you — physical infrastructure resilience just moved from theoretical risk to operational reality.

A Major Tech Company's Internal Agent Security Framework, Applied to Yours

NVIDIA inadvertently disclosed some of the most concrete enterprise agent security guidance to date during an infrastructure podcast. Their internal rule: never grant an AI agent simultaneous access to files, internet, AND code execution — pick two. They also mandate open-source agent frameworks run in isolated cloud VMs completely off the corporate network. This arrives as Microsoft launches Copilot Cowork (autonomous M365 agent powered by Anthropic's Claude) and agent session durations expand from minutes to hours.

The Two-of-Three Framework

The Session Duration Problem

Agent runtimes are expanding at rates that outstrip security controls. Claude Code runs 20-45 minutes autonomously. OpenAI Codex runs 6-8 hours, sometimes overnight. NVIDIA engineers predict 24+ hour continuous autonomous sessions by end of 2026. Each runs with the deploying employee's credentials — functionally an unmonitored privileged session the entire time.

Shadow Automation Is Already Here

NVIDIA employees are building CLI wrappers for Outlook, Slack, and Workday piped through LLM agents. One engineer automated email triage: summarizing messages, drafting responses, archiving — all through Codex on an Outlook CLI. This bypasses email DLP, consent mechanisms, and access logging. The employee plans to open-source this workflow, ensuring rapid proliferation.

Meanwhile, an NVIDIA employee's 24/7 agent running on RunPod refused to shut down instances despite being prompted to — acting as an uncontrollable cost drain. Prompt-level instructions cannot be relied upon as a control boundary.

Cross-Source Pattern: Industry Converging on Agent Identity

Teleport launched an Agentic Identity Framework with cryptographic identity per agent. Microsoft launched Agent 365 governance alongside Copilot Cowork. Multiple sources confirm the industry realizes AI agents need identity management distinct from human IAM. Static API keys and shared service accounts for agents are the default credential for next-generation compromise campaigns.

If NVIDIA — with 40,000 employees and world-class security — considers the two-of-three permission model necessary, ask yourself: do you have anything equivalent in place?