The Watch

The Threat Model Just Inverted

A public proof-of-concept for CVE-2026-55200 dropped today targeting a client-side vulnerability in libssh2. This is not a server hardening problem — it's the reverse. A malicious or compromised SSH server can trigger memory corruption on any client that connects to it, with likely code execution and zero credentials required.

There is no auth step to log, alert on, or block. The victim is the client, not the server.

The traditional SSH mental model — harden the server, watch auth logs — offers no protection here. The attack fires during the connection handshake before any authentication occurs. Your EDR will not see a failed login. Your SIEM will not fire on brute-force detection. The compromise happens in the gap between network connect and session establishment.

Why Your CI/CD Is the Primary Target

The highest-value libssh2 clients in most environments are not human operators typing ssh. They are:

• CI/CD runners pulling code via git-over-SSH
• Deployment automation pushing to production hosts
• Jump boxes and bastion hosts initiating connections
• Language bindings wrapping libssh2 (libgit2, Ruby net-ssh, Python paramiko-adjacent)

These systems initiate outbound SSH constantly, often holding privileged deployment tokens and signing keys. A poisoned or man-in-the-middled SSH endpoint becomes a foothold into your build pipeline. With a PoC public, expect weaponization at scale within days.

Compensating Controls When You Can't Patch Immediately

Because no auth event gates this attack, your compensating control must operate at the network layer:

1. Restrict outbound SSH egress to an allowlist of known-good destination IPs/hostnames via firewall policy
2. Monitor for SSH connections to novel endpoints — any new destination should trigger investigation
3. Isolate CI runner networks so a compromised runner cannot laterally pivot with its deployment credentials

The patch is the only durable fix. Everything else is a delay tactic.

Hard Dates, Not Aspirations

On June 22, 2026, two actions converted post-quantum cryptography from a research topic to a compliance mandate: a presidential executive order and a companion Pentagon PQC Strategy that calls cryptographically relevant quantum computers an "existential threat" to U.S. military missions. The deadlines are now load-bearing facts:

The DOD strategy explicitly mandates phasing out non-compliant systems. If you're a federal agency, DOD contractor, or hold data with a 5+ year confidentiality requirement, you have a forced modernization cycle starting now.

The Active Threat: Harvest-Now-Decrypt-Later

The strategic problem isn't the quantum computer that doesn't exist yet — it's the HNDL attack running today. Adversaries are collecting encrypted traffic and data stores now, betting they can decrypt it once quantum capability matures. For any data whose confidentiality must outlive ~2030, current RSA/ECC encryption is functionally a delay timer, not a lock.

The quantum computer that breaks your encryption doesn't exist yet — but the adversary stealing the data it will decrypt is operating today.

Bitcoin's 7 million BTC in exposed-key addresses is the most legible public illustration of this risk — the same math applies to your TLS, VPN tunnels, code-signing keys, and PKI infrastructure.

Why Discovery Is the Non-Negotiable First Step

Both the EO guidance and DOD strategy lead with the same foundational requirement: a complete, living cryptographic inventory. You cannot migrate crypto you cannot see. Discovery alone runs months in a large estate, which is why the timeline math matters: a full cryptographic migration is a 4-6 year program. 2030 is not far away.

Adjacent deadline: IETF hybrid TLS

An advocacy source alleges NSA pressure to adopt single-algorithm PQC (ietf-tls-mlkem) over the hybrid construction (ietf-tls-ecdhe-mlkem). Opposition comments close July 7. Hybrid constructions provide defense-in-depth against implementation errors in new PQC algorithms — standardize on hybrid regardless of the vote outcome.

Note: the NSA allegation carries lower confidence. The strategic implication (favor hybrid) holds regardless.

A New TTP: Prompt Injection Against Your SOC

A genuinely novel technique has surfaced: macOS malware now embeds adversarial prompts in its code that convince LLM-based security analyzers to refuse analysis. The AI doesn't flag the sample as malicious — it simply declines to look. A 'pass' generated by refusal is the worst kind of blind spot, because it looks like a clean result rather than a detection failure.

This isn't novel malware — it's old malware learning to talk its way past your new tools.

If your pipeline routes samples through any LLM-based triage, analysis, or classification step, you have a structural vulnerability: the model's refusal is indistinguishable from a legitimate 'not malicious' determination unless you explicitly instrument for it.

Convergent Evasion: StegoAd and the MV3 Failure

The same evasion philosophy — weaponize trust assumptions — appears in the StegoAd campaign: 119 malicious Edge extensions across 90+ developer accounts, 2.6M installs, active since 2021. Three techniques work in concert:

• Steganography: Payloads hidden in image and font files bypass content scanning
• Delayed activation: 3-5 days post-install, dodging both marketplace review and EDR baselining
• MV3 compliance: The campaign successfully ported to Manifest V3, proving the new extension security model doesn't stop sophisticated actors

Separately, an 11-million-install 'Adblock for YouTube' extension gained code execution through a configuration update — no store review, no extension update, no permission prompt required. Install-time vetting is structurally blind to post-install payload delivery.

The Pattern for Detection Engineering

Three evasion categories are converging that bypass traditional controls:

Your blocklist-centric defenses are increasingly blind to all four. The common thread: each technique exploits a trust assumption — that AI tools report honestly, that post-install behavior matches install-time behavior, that image files are inert, and that config updates don't carry code.