The Watch

What Happened

OpenSSH has carried a comma injection vulnerability in SSH certificate principal parsing since its implementation — approximately 15 years. The flaw is elegantly devastating: OpenSSH reuses a function that treats commas as list separators when processing certificate principals. A certificate issued with the principal deploy,root — intended as a single literal string — is split into two separate principals: deploy and root. The attacker authenticates as a low-privilege user and silently receives root access.

Why This Is Worse Than a Typical Critical CVE

Three factors compound the severity:

1. Zero authentication failures logged. Your SIEM sees a successful SSH login. No alert fires. The authentication looks legitimate because, from OpenSSH's perspective, it is legitimate — the certificate was valid; the parsing was wrong.
2. Trivial exploitation. Security researchers demonstrated a working exploit in 20 minutes. This is script-kiddie accessible. Any attacker who compromises your SSH CA — or any environment where certificates with commas in principal names have ever been issued — can mint silent root certificates.
3. 15 years of exposure. Every OpenSSH deployment prior to version 10.3 is vulnerable. The installed base is effectively universal across Linux, BSD, macOS, and cloud infrastructure.

A certificate containing 'deploy,root' silently grants root access with zero authentication failures in your logs — and this has been exploitable for 15 years.

Detection Gap

Standard log monitoring and SIEM detection rules will not catch exploitation. The login appears legitimate. Detection requires monitoring for SSH certificate authentication events where the authenticated principal doesn't match the expected value — a rule most SOCs don't have because this attack class didn't exist in their threat model until today.

Immediate Actions

1. Patch all OpenSSH instances to 10.3 — today. No exceptions, no staging window for this one. The exploit is trivial and leaves no forensic trail.
2. If patching is delayed even 24 hours: audit your SSH CA for any certificates with commas in principal fields and revoke them immediately. Query certificate logs for historical issuance of comma-containing principals.
3. Deploy detection rules for SSH certificate authentication where the authenticated principal differs from the expected principal. This is your only post-exploitation visibility.
4. Assess SSH CA compromise exposure. Any attacker who has ever had write access to your SSH CA can now retroactively leverage that access for silent root. Review CA access logs and key material handling.

The Pattern

This week's disclosures cluster around one mechanism: the attacker operates after authentication succeeds. MFA passes, the firewall is patched, the login looks legitimate, and the intruder is already inside the environment.

1. Microsoft Entra ID: Agent ID Administrator Privilege Escalation

Microsoft patched a mis-scoped 'Agent ID Administrator' role in Entra ID. The role was designed for managing agentic AI identities but granted the ability to take ownership of unrelated service principals. Blast radius was tenant-wide privilege escalation. The role shipped to production. Any organization that assigned it before the patch was exposed to lateral movement across the full Azure and M365 environment.

The broader read: IAM vendors are shipping agentic AI governance features faster than their security teams can review them. Expect more 'the role does more than intended' disclosures as AI identity features are rushed to market.

2. FIRESTARTER Update: Cold Start Required, Warm Reboot Leaves You Compromised

US and UK authorities issued a joint warning clarifying a remediation detail missing from earlier advisories: standard reboots do not clear FIRESTARTER. Only a full cold start (complete power cycle) removes the infection. Separately, CISA found that multiple federal agencies falsely reported Cisco firewalls as remediated when they were not. New indicators for hunt teams: the lina_cs malicious process, YARA rules against disk images and core dumps, and submission to CISA's Malware Next Generation platform, which is available to non-federal organizations.

3. AiTM Session Hijacking: MFA Passes, Token Is Stolen

Adversary-in-the-Middle attacks do not steal passwords. The proxy sits between user and login page, lets the user authenticate normally including MFA, and copies the resulting session token. The MFA dashboard records a successful, legitimate login. The SIEM sees nothing anomalous. Defense has to shift to post-authentication session monitoring.

The common thread: if your security architecture ends at the authentication gate, all three of these threats walk right past it.

Two Converging Signals

Your vulnerability management pipeline is about to face two unprecedented pressures simultaneously: a flood of AI-discovered zero-days in foundational software arriving within 90 days, and the revelation of a 20-year-old sabotage framework that targets computational integrity — a threat class your current controls almost certainly don't address.

Project Glasswing: Thousands of Zero-Days in Software You Thought Was Secure

Anthropic's Project Glasswing — backed by AWS, Apple, Google, Microsoft, CrowdStrike, Palo Alto Networks, and 40+ organizations — deployed an unreleased model (Claude Mythos Preview) against foundational open-source code. The results are staggering:

• A 27-year-old zero-day in OpenBSD — one of the most audited security-focused OSes in existence
• A 16-year-old vulnerability in FFmpeg — ubiquitous in media processing across nearly every tech stack
• Linux kernel exploit chains enabling full system control
• "Thousands" of additional high-severity zero-days with CVEs not yet assigned

Initial findings publish within ~90 days (~late July 2026). Funded by $100M in usage credits and $4M in open-source security donations. Cloudflare's parallel effort provides a production benchmark: their multi-agent AI code review completed 131,000 reviews in 30 days at $1.19/review, surfacing ~160,000 issues with 5% classified as critical — approximately 8,000 critical findings in one month.

AI models are finding decades-old zero-days in the most audited codebases on the planet. The disclosure wave begins in 90 days. Your patch pipeline either scales or breaks.

fast16: A Sabotage Framework Older Than Stuxnet

SentinelLABS researchers Vitaly Kamluk and Juan Andrés Guerrero-Saade uncovered fast16, a cyber sabotage framework with core components dating to 2005 — five years before Stuxnet. First surfaced in the Shadow Brokers' 2017 NSA leak, fast16 targets high-precision calculation software by patching code in memory to produce consistent but incorrect results across all infected systems in a facility.

The critical security insight: results appear internally consistent. The corruption isn't random — it's systematic. Every infected system in the same facility produces the same wrong answer. Effects range from tainted scientific research to physical infrastructure damage. The svcmgmt.exe binary was uploaded to VirusTotal roughly a decade ago with almost no detections. Detection is extraordinarily difficult because traditional integrity checks look for inconsistency — and fast16 delivers consistency.

What This Means for Your Pipeline

Every disclosed Glasswing vulnerability creates a race between patching and exploitation. Threat actors will reverse-engineer patches to develop exploits targeting laggards. Meanwhile, fast16 represents an entirely different threat class — data-integrity attacks on computation — that standard vulnerability scanners, EDR, and patching can't address.