The Watch

The Situation

Three distinct campaigns are exploiting perimeter infrastructure today — not disclosed, not theoretical, actively compromising systems. They require different responses but share one trait: every target sits at your edge with privileged network position and minimal endpoint detection coverage.

Campaign 1: SimpleHelp CVE-2026-48558 → TaskWeaver/Djinn

SimpleHelp's OpenID Connect implementation has an authentication bypass (CVE-2026-48558) that's being exploited in the wild to drop the TaskWeaver loader and Djinn infostealer. Patches have been available since May — this is a known-unpatched window being swept. Any OIDC-enabled RMM server is in scope, including MSP-managed instances you don't directly control.

If your MSP runs SimpleHelp, their compromise is your compromise. Verify their patch status today, not next review cycle.

Campaign 2: FortiBleed — 86,000+ Devices Harvested

An INC ransomware affiliate deployed on-firewall credential sniffers across 86,000+ Fortinet devices, harvesting credentials transiting the perimeter. This was only discovered because the attackers left an open directory exposed. There is no single patch — this requires credential rotation for every account whose traffic transited an affected device, plus forensic audit of firewall configs for injected processes.

Campaign 3: Perimeter Appliance Patches With Closing Windows

The Chrome Longinus flaw deserves special attention: it achieves full RCE and renderer-sandbox escape through a single V8 JIT primitive — no memory spraying, no exploit chaining. That lowers the weaponization skill floor dramatically. NetScaler's CVE-2026-8451 is the same out-of-bounds SAML parsing class that produced CitrixBleed in 2023, on appliances carrying 20+ CISA KEV entries.

The Azure CLI Spray — Context, Not Crisis

An automated password spray generated 81M+ login attempts against Azure CLI, breaching at least 78 accounts. CLI/programmatic authentication paths frequently sit outside Conditional Access and MFA policy envelopes — the gap being exploited is a configuration omission, not a vulnerability.

What Happened

An anonymous actor using the handle 'Bikini' published a repository called 'exploitarium'. It carries working PoC exploits for 15 widely-deployed open-source projects. No vendor coordination. Nine CVEs are confirmed. A second wave is promised this week. The affected list reads like a software bill of materials:

• Linux kernel, PHP, OpenVPN, Libssh2, FFmpeg
• 7-Zip, VLC, Ghidra, Gitea, Gogs
• MyBB, AnyDesk (and more)

Why This Is Different

The method is the story. Bikini says he fuzzed the codebases with OpenAI's GPT-5.5-3-Codex-Spark, then verified findings by hand. I cannot confirm a model by that name exists, so treat the tooling claim as reported, not established. His stated point cuts against the 'only frontier AI is dangerous' line:

"You do NOT need a SOTA model to help you identify these issues... my data seems to show that it is only marginal when paired with decent human oversight and a good harness."

The claim: mass-producing 0-days now needs a decent harness and human oversight, not a frontier model. Semgrep's own numbers point the same way. Their pipeline scored 53–61% F1 against GLM 5.2's 39% and Claude Code's 32% on IDOR detection. Integration engineering beats raw model capability. Those figures are vendor-reported.

Industry Response Is Already Confirming the Shift

Two vendors changed behavior. Adobe shifted to semi-monthly patching and Oracle moved to monthly releases, both citing AI-powered exploit discovery. Apple expedited WebKit patches and said it did so because AI compresses the disclosure-to-exploit window. A monthly patch SLA now sits structurally behind the threat.

Cross-Source Contradiction Worth Noting

One tension runs through today's reporting. Anthropic says Sonnet 5's 'cyber safeguards' are hardened, and the US government is export-controlling models on offensive-cyber capability scores. Bikini says frontier models aren't required. The regulatory framework is aimed at the last war: commodity models with good harnesses are the threat, not frontier models behind vendor guardrails.

The Auto-Merge Problem

Multiple sources converged this week on a single architectural shift: 'software factories' that auto-merge 20–60% of pull requests with no human reviewer. Warp's Oz platform is live. Cursor is scaling Forward Deployed Engineers 10x. OpenAI's Alexander Embiricos said the quiet part: the goal is connecting agents to 'review and deploy... that's how you help it land much more work.'

The control assumption this breaks is fundamental: human code review is silently embedded in your SOC 2 change-management evidence, your detection engineering, and your intuition about what ships to production. When 60% of PRs merge without a human, that control doesn't degrade — it evaporates.

The Shadow Data Flow Problem

Simultaneously, the AI toolchain itself is leaking data through channels your governance doesn't cover:

A top-tier AI vendor shipped covert telemetry into our developers' tools for four months undetected — assume every cloud-connected AI assistant is an untrusted supply-chain component until its egress is proven.

The Convergence

These aren't separate problems. The software factory writes and merges code via AI agents that route through AI providers you didn't vet, using credentials you didn't scope, transmitting data through channels you didn't document. The entire chain from prompt injection → agent execution → auto-merge → production is live today. The buyer is the engineering leader, not the practitioner — meaning this lands via a leadership deal before security is consulted.

Where Sources Agree

Every source covering this theme agrees: adoption is outpacing governance. Only 10–20% of enterprise staff are enthusiastic adopters, but the 'champion' model ensures they're the ones wiring agents into your repos. Kent Beck's framing cuts cleanly: 'We're failing to accumulate trust at the same rate as new code is accumulated.'