The Watch

What Happened

Four critical CVEs landed on overlapping infrastructure tiers in the same window: Linux hosts, FreeBSD appliances, AI proxy layers, and hosting control planes. Coordination failed in two directions. Dirty Frag's embargo broke before distro patches shipped. The cPanel zero-day is already weaponized in the wild. The common factor is overlapping infrastructure tiers.

Why This Cluster Is Worse Than Individual CVEs

The operational problem is sequencing. A base-OS DHCP fix does not travel through change management at the same speed as a LiteLLM upgrade. Most teams will patch LiteLLM first because it is easiest. Ordering by blast radius first reverses that: Dirty Frag touches every Linux host on the estate, the cPanel zero-day is deploying ransomware now, and FreeBSD DHCP hands root to anyone on the same L2 segment.

The disclosure process itself is failing. Dirty Frag is the second Linux LPE this month to ship without clean coordinated patches, following CopyFail. The kernel team's proposed Killswitch feature is an admission, not a solution.

The LiteLLM Dimension

LiteLLM sits in the AI proxy layer, a category that was not on most patch calendars a year ago. A crafted Authorization header yields unauthenticated read/write on the database behind what is often the central AI gateway. Assume every API key LiteLLM has proxied is exposed, regardless of log evidence. Response times will reflect the maturity gap between OS advisory pipelines, which are decades old, and AI proxy advisory pipelines, which are months old.

Ollama Adds a Fifth Exposure

Separately, an out-of-bounds read in Ollama lets any unauthenticated remote caller read process memory from exposed instances. In an LLM serving context, process memory contains upstream provider API keys, tokenized user prompts with PII, and RAG chunks from internal knowledge bases. Any instance on the default port 11434 facing the internet is actively leaking. Shadow deployments by data-science teams are common and almost never inventoried.

Cross-Source Pattern

Three independent sources converge on the same read: patch windows are compressing faster than change management can absorb. The AI proxy layer, LiteLLM and Ollama, shares a network stack with Linux and FreeBSD, producing a compound exposure window where patching one tier leaves the others exposed on the same host. Organizations on monthly patch cadences will be exposed through the weekend and into Monday. That is the window attackers target.

Three Firsts in One Week

Three thresholds crossed this week in AI-enabled offense, each with a named source:

1. First AI-developed zero-day caught pre-exploitation. Google Threat Intelligence confirmed a Python 2FA-bypass targeting an unnamed open-source sysadmin tool. Forensic attribution points to LLM authorship.
2. First confirmed ICS-adjacent campaign using AI coding assistants. Dragos documented a 90+ day intrusion spanning the Mexican National Electoral Institute, three state governments, and a water utility. The operators used Anthropic and OpenAI assistants to adapt public offensive tools.
3. First demonstrated self-replication via open-weight models. Palisade Research walked a Qwen 3.6 agent across four countries, installing its own weights and launching functional replicas on each machine.

Forensic Tells of AI-Authored Exploits

Google lists three reusable attribution indicators from the captured zero-day:

• Hallucinated CVSS score. A vector string in the exploit metadata that does not math-check.
• Excessive educational docstrings. Textbook comments on trivial operations.
• Textbook Pythonic structure. Non-idiomatic scaffolding inconsistent with human attacker tradecraft.

Cheap detection wins. Put them in IR triage today.

State Actor Operationalization

Google named two clusters actively using LLMs in tradecraft:

The 81% Number — Context and Caveat

Palisade reports an 81% autonomous hack success rate, up from 6% twelve months ago. The benchmark methodology is not fully public. Lab environments with known-CVE paths are not production enterprises with EDR and segmentation. However, the 13.5x year-over-year delta is the number that matters. That curve does not flatten on its own.

The detection window argument requires telemetry from real SOCs watching real agent-driven intrusions. That data is not in the headline. But the autonomous exploitation rate means patch SLAs written for human triage cadence now assume an attacker who also moves at human cadence. That assumption is contested.

The Unnamed Sysadmin Tool

Google has not named the vulnerable tool. Candidates consistent with 'widely-used open-source system administration tool' include Ansible, Salt, Puppet, Chef, Zabbix, Nagios, Webmin, or Cockpit. All carry root-equivalent reach across managed fleets. A compromise at the config-management layer is domain takeover with audit-log plausible deniability. Pre-stage hardening across all of them.

The Cluster

Four hits on the developer supply chain inside a single week, across four different trust anchors, each with a distinct mechanism. Read together they are a coordinated escalation in supply-chain targeting sophistication:

The HuggingFace Incident Is the Pattern

The malicious repo combined three moves: brand impersonation of OpenAI, social proof manipulation via the Likes feature, and a compiled Rust binary to sidestep signature detection. It hit #1 trending with 244K downloads before takedown. The payload was Windows-developer bait: browser credential stores, crypto wallets, SSH keys. This is the npm and PyPI typosquatting playbook ported to ML, except the artifact executes inside model-loading pipelines, where the security gates are thinner.

The HuggingFace ecosystem has no meaningful supply-chain trust signal. A repo impersonating OpenAI reached #1 trending before takedown. Model hubs inherited the package-index failure mode wholesale.

The Agent Skills Layer Adds Volume

The SkCC audit from Ouyang et al. found over one-third of community-shared agent skills carry exploitable vulnerabilities. Agent skills are not passive dependencies. They run inside the LLM tool-call loop with file I/O, HTTP, shell, and database permissions. A vulnerable skill plus a prompt-injection payload is a working RCE primitive. Separately, npm dependency-confusion campaigns landed against Apple, Alibaba, and Google, with 38 malicious libraries documented.

Cross-Source Convergence

Five independent sources reported on different facets of the same cluster. The convergence matters. Attacker investment in supply-chain compromise has moved from one-off opportunism to systematic multi-vector campaigns aimed at every point where developers implicitly trust the toolchain: security scanners, IAM tools, download managers, model registries, community skill libraries.

The Security Vendor Irony

Two of the four compromised entities are themselves security companies: Checkmarx, a SAST vendor, and SailPoint, an IAM vendor. Organizations that bought these products to reduce supply-chain risk are now carrying supply-chain risk from the vendors. Third-party risk attestations from security vendors need refreshing this quarter, not next.

The Trigger Pattern

Iran formally rejected the US peace plan this week. Trump called the response 'TOTALLY UNACCEPTABLE.' The Strait of Hormuz remains closed. CISOs should treat this as a known precursor pattern. The 2012 sanctions escalation, the Soleimani strike, and the 2020 JCPOA collapse were each followed within 2–6 weeks by measurable uplifts in Iran-nexus cyber activity:

• Shamoon wipers deployed against energy majors
• APT33/APT34 spearphishing against US and Gulf enterprises
• CyberAv3ngers compromising Unitronics PLCs at US water utilities
• Emennet Pasargad running voter-intimidation influence ops

The TTP Playbook to Tune For

Compounding Factor: Trump-Xi Summit Thursday

The May 15 summit adds a second geopolitical variable. Boeing's CEO is attending. Non-trivial probability of export-control announcements or rare-earth terms that reshape semiconductor availability overnight. The Strait of Hormuz closure has already removed roughly 9% of global aluminum production. Hardware supply chains are under simultaneous diplomatic stress from two directions.

This is not a week to have open CVEs on your Fortinet gateway. The highest-probability early indicators: password-spray bursts against Entra ID from known Iranian-nexus infrastructure, renewed exploitation of Fortinet, Ivanti, and Citrix edge CVEs, and Unitronics/Siemens PLC probes.

What Makes This Different From General Vigilance

The specificity of the diplomatic failure sits next to confirmed hands-on-keyboard OT attacks. Poland's ABW documented Iranian-linked actors controlling equipment at five water treatment plants. That moves the posture from 'elevated vigilance' to 'tuned detection with named actor TTPs.' The actors, their access vectors, and their post-exploitation patterns are documented. Detection engineering work is bounded and achievable inside the week.