The Engineer

An unusually dense cluster of critical vulnerabilities landed this week across infrastructure components you almost certainly depend on. This isn't the typical churn of IoT CVEs — these hit your container registry, PKI, web frameworks, CI/CD pipelines, and security monitoring simultaneously.

The Critical Path

Step CA ≤0.30.0-rc6 (CVE-2026-30836, CVSS 10.0) allows unauthenticated certificate issuance via SCEP UpdateReq. If you're using Step CA for internal PKI — common for device certificate enrollment and mTLS — an attacker can mint certificates your entire service mesh trusts. This undermines zero-trust architectures entirely.

Harbor ≤2.15.0 (CVE-2026-4404, CVSS 9.4) has hardcoded credentials enabling unauthenticated web UI access to your container registry. Every docker pull from a compromised Harbor becomes suspect. Patch, then rotate all credentials and audit image integrity.

Spring Security 5.7.0–7.0.3 (CVE-2026-22732, CVSS 9.1) is the most insidious: it silently stops writing HTTP security headers — HSTS, CSP, X-Frame-Options. Nothing in your logs tells you. Your apps have been running without these protections, potentially for weeks. A quick curl -I against your endpoints will tell you immediately.

The CI/CD Layer

Tekton Pipelines (CVE-2026-33211, CVSS 9.6) has path traversal via pathInRepo enabling arbitrary file reads — effectively a credential dump, since CI/CD pipelines typically hold keys to everything. Spinnaker Clouddriver (CVE-2026-25534, CVSS 9.1) has a URL validation bypass that's a repeat of CVE-2025-61916, meaning the first fix was incomplete.

Your Security Tools Are Also Vulnerable

Wazuh SIEM 4.0.0–4.14.2 has RCE and privilege escalation from worker to master (CVSS 9.1). An attacker who compromises a worker node can pivot to owning your entire security visibility. The master typically has read access to all agent data, events, and integration credentials. Patch the master first, then workers.

Your vulnerability scanner (Trivy), your SAST tool (Checkmarx), and your SIEM (Wazuh) were all exploitable this week. Security tooling as an attack surface is no longer theoretical — it's the pattern.

Also on your list

• Rails Active Storage (CVSS 9.8): Path traversal + injection across versions prior to 8.1.2.1, 8.0.4.1, 7.2.3.1
• Citrix NetScaler: Unauthenticated memory disclosure matching CitrixBleed severity — TLS-terminating load balancers leak session tokens and plaintext creds from memory
• jsrsasign npm 7.0.0–11.1.1 (CVSS 9.1): Biased DSA nonces during signature generation — run npm ls jsrsasign and npm ls jspdf to check transitive exposure

Seven independent intelligence sources flagged Google's post-quantum cryptography migration this week — the strongest cross-source convergence in today's briefing. This isn't an echo chamber effect; each source brings different detail that, combined, paints a clear picture: the timeline for quantum-safe migration just compressed by six years, and platform vendors are already shipping implementations.

What Google Actually Said

Google accelerated its internal PQC migration from 2035 to 2029, citing faster-than-expected advances in quantum hardware, error correction, and factoring algorithms. This is the company that builds the Willow quantum processor and runs arguably the deepest quantum research program outside government labs. When their internal threat modeling moves by six years, the signal carries weight that a random vendor announcement wouldn't.

The Implementation Is Already Shipping

Android 17 beta includes PQC key support for app signing and signature verification. Chrome and Cloudflare have been running hybrid key exchange (X25519+ML-KEM-768) in production for over a year. The NIST standards are finalized: ML-KEM (FIPS 203) for key encapsulation, ML-DSA (FIPS 204) for signatures, SLH-DSA (FIPS 205) for stateless hash-based signatures. OpenSSL 3.2+, BoringSSL, and AWS-LC all have support at various maturity levels.

When a platform vendor starts shipping post-quantum primitives in beta, it means they believe production deployment is 12–18 months out. If your systems use RSA-2048 or ECDSA for anything, you need to understand your exposure.

The Harvest-Now-Decrypt-Later Threat

The White House is simultaneously considering moving the federal deadline from 2035 to 2030. The convergence from multiple independent parties signals this isn't Google grandstanding. The practical question for engineers isn't "will quantum computing break RSA?" — it's "will data I encrypt today still be safe in 2032?" If you handle healthcare records, financial data, or anything with long-lived confidentiality, the answer is increasingly maybe not. Nation-state actors are actively stockpiling encrypted traffic.

The Migration Is a Sprawling Dependency Problem

The crypto isn't the hard part — it's the inventory. Most teams have no consolidated view of where they use which algorithms. RSA in your TLS config, ECDSA in JWT signing, AES-GCM with ECDH key agreement in at-rest encryption — scattered across dozens of config files, libraries, and managed services. ML-DSA signatures are ~40x larger than ECDSA, which affects certificate chain size and bandwidth. The practical migration path is hybrid mode: classical + PQC in parallel. Start with TLS termination points and work inward.

Crypto-Agility as Architecture Property

The real question: can you swap cipher suites and key exchange algorithms without redeploying your entire fleet? If the answer is no, fixing that architectural gap is your first step — before any algorithm changes. Abstract cryptographic operations behind well-defined interfaces managed at the infrastructure layer (service mesh, TLS proxy, KMS).

Two independent projects — NVIDIA's OpenShell and Niels Provos's IronCurtain — arrived at nearly identical agent sandboxing architectures this week. When independent teams converge on the same design, that's the strongest signal the pattern is correct. If you're running AI agents in production, this is your reference architecture.

The Converged Pattern

OpenShell ships as K3s-in-Docker supporting Claude, Codex, and Ollama out of the box with hot-reloadable policies. IronCurtain's credential isolation pattern — a MITM proxy that swaps fake API keys for real ones in --network=none containers — is immediately implementable.

DNS: The Universal Escape You're Not Testing

AWS Bedrock AgentCore's "Sandbox" network mode — documented as "complete isolation with no external access" — allows public DNS queries sufficient for bidirectional C2 tunneling, reverse shells, and full data exfiltration. AWS's response: they won't fix it, they'll update the docs, and here's a $100 gift card. If your isolation boundaries don't block DNS, they don't block anything.

Every sandbox and isolation boundary in your infrastructure needs a DNS egress test. Run a simple `dig` from inside your 'isolated' environments. If it resolves, you have a C2 channel.

The Shadow Agent Problem Is Already Here

Microsoft's Cyber Pulse report shows UK enterprise agent adoption tripled in one year (22% → 62%), with 84% of leaders admitting shadow agents are deployed without security oversight. The confidence gap is telling: 87% say they can stop unauthorized agents while 86% simultaneously say they aren't ready for agent security challenges. These aren't chatbots — they're autonomous actors with credentials making write operations against production systems.

MCP Governance Is Marketing, Not Engineering

Six vendors announced MCP governance at RSAC. None enforce the protocol at a meaningful level. If you're building agents that interact via MCP, you are currently on your own for security enforcement. Treat every MCP endpoint like an untrusted external API. Cisco's open-source DefenseClaw is notable specifically because you can audit what it actually enforces versus what it claims.

CLIs Are Your Agent's New Syscall Interface

Cursor published CLI design guidelines for agent consumption, ElevenLabs immediately adopted them, and multiple new tools shipped CLI-first this week. Every CLI you maintain is now a potential agent API surface. If your deployment scripts output colored tables with spinners, they're broken for agents. Add --json output modes, proper exit codes, idempotent operations, and eliminate interactive prompts.