The Watch

The Situation

Your enterprise application layer is under coordinated assault. Oracle E-Business Suite CVE-2026-46817 (CVSS 9.8) is confirmed exploited in the wild per Defused Cyber — not a disclosure, an active campaign. Simultaneously, an Oracle PeopleSoft zero-day was weaponized at scale before Oracle knew it existed, with NAIC confirming unauthorized access on June 11 that cascaded into credit rating agency feed pauses and suspended insurer investment designations. Nissan confirmed employee PII, SSNs, banking, and tax data theft across four countries via the same PeopleSoft campaign.

Two Oracle zero-days exploited in the same window, one pre-disclosure — this isn't opportunistic scanning, it's systematic ERP targeting.

The Full Exploitation Surface

SimpleHelp deserves special attention because it's a remote-support tool — high-privilege by design — and attackers are deploying two previously unreported malware families: TaskWeaver (persistence/C2) and Djinn Stealer (infostealer). Any host where SimpleHelp ran must be treated as credential-compromised.

DirtyClone is the fourth DirtyFrag-family kernel LPE in six weeks. JFrog published a full exploit walkthrough June 25. It abuses unprivileged user namespaces to reach CAP_NET_ADMIN and tricks the kernel into treating read-only page-cache memory as writable. Ubuntu 24.04+ blocks it via AppArmor, but default Debian and Fedora are vulnerable. The patch shipped May 21 — unpatched hosts at this point are a hygiene failure.

Why This Matters Together

The common pattern: attackers are targeting high-privilege, often internet-facing chokepoints — ERPs, remote-support tools, load balancers. These aren't endpoints; they're infrastructure that trusts everything behind them. A compromised EBS instance holds SOX-relevant financial data. A compromised SimpleHelp agent holds credentials to everything it manages. A rooted LoadMaster holds every TLS private key it terminates.

Two Supply Chain Failures, One Week

Taiwanese prosecutors raided Super Micro Computer on June 30 — searching six homes and three company sites including data-center operator Chief Telecom and distributor Albatron Technology — as part of a probe into smuggling Nvidia AI chips into China. This follows March 2026 US criminal charges against three Supermicro employees for diverting at least $2.5 billion of Nvidia AI servers to China via falsified documents and shell companies. The probe is now multi-jurisdictional and expanding into distribution and hosting layers.

Separately, Tata Electronics — Apple's Indian contract manufacturer — was hit by ransomware. The attackers posted iPhone 18 Pro component details, photos, and supplier-to-part mappings Apple deliberately excludes from public databases. Tesla product secrets were compromised in the same incident. One intrusion, two principals, neither of whom contracted Tata for the other's protection.

When export documents are falsified and shell companies sit in the distribution path, you can no longer assume the hardware you bought traveled a clean, authorized route.

What This Means For Your Fleet

The Supermicro story isn't a CVE — it's a chain-of-custody integrity problem. Diversion means components circulating without verifiable provenance. That cuts two ways: regulatory/export-compliance exposure, and elevated tampering risk inherent to grey-market hardware (unsigned firmware, compromised BMC/IPMI management planes). Supermicro's BMC attack surface is well-documented from prior research.

The Tata breach demonstrates fourth-party concentration failure: a single shared manufacturer holds sensitive IP for multiple unrelated principals. Most TPRM programs score Tata-class vendors in isolation and miss that the same facility holds competitors' designs — which multiplies both attacker incentive and blast radius.

Five separate intelligence sources flagged the Supermicro raid this cycle, confirming market-wide concern. Combined with the FCC expanding its import ban to cover older Chinese telecom and surveillance equipment, the US-China hardware decoupling is accelerating enforcement, not just rhetoric.

The Governance Gap Is Widening Faster Than Controls

Three product launches in the past week crossed a line: Anthropic's Claude Tag is live in Slack (Teams imminent), requiring deep connections to databases, GitHub, and internal apps to function. Cursor for iOS now lets developers launch agents, control them, and merge pull requests from a mobile device. And connector platforms like Zero.xyz give any AI model access to thousands of tools and APIs with a free-credit signup — no procurement gate, no security review.

A Slack message can now trigger code execution in your pipeline, a phone can merge to protected branches, and a free signup can wire an agent into your API surface.

The Adoption Numbers Are Alarming

This isn't theoretical future risk. Perplexity enterprise users on Slack grew 17% per week. Viktor gained 400+ customers in one week post-launch. Codex hit 5M+ weekly active users (6x since February), with non-technical adoption now matching engineering departments. All deploy at zero cost to the user — no payment gate triggers procurement review. A major software CEO privately compared these integrations to Facebook's 'Like' button: a Trojan horse that harvested intelligence about everything it touched.

What Okta Just Shipped Tells You the Scale

Okta's GA release of AI Agents – Core confirms the industry is treating agent risk as an identity problem: agents registered in Universal Directory, least-privilege via scoped short-lived tokens, continuous SIEM streaming, and a containment kill switch — all inside FedRAMP/HIPAA boundaries. When your IAM vendor ships a product to solve this, the problem is already at scale in production environments.

The MCP Layer Nobody's Monitoring

Underneath all of this sits the Model Context Protocol (MCP) — the emerging standard for AI-to-data connections. X launched a hosted MCP server giving Grok, Cursor, and any MCP-compatible tool 'zero-setup' API access. 'Zero setup' means the auth decision is made once and never revisited. Every hosted MCP endpoint is an un-inventoried OAuth-like grant that your DLP and CASB don't see.

The compounding risk: agents that 'can't complain' (Cursor's own term) — they don't surface warnings or errors to humans the way local tools do. Failures and malicious behavior run silently unless you build instrumentation yourself.