ClarityBeta

Security & Threat Intelligence

The Watch

5 min read · 919 words · 4 moves to watch
The Signal

Attackers can forge your Entra Global Admin from ADFS without ever touching LSASS.

Mandiant documented a Golden SAML variant. It pulls active signing keys from the DPAPI_SYSTEM LSA secret and mints valid Global Admin assertions that Entra ID accepts, without ever touching the live ADFS process. LSASS-focused EDR sees nothing, which is the same blind spot the original Golden SAML tradecraft exploited years ago. Any surviving ADFS host is Tier 0. Alert on Event ID 385 now.

In Play

  1. Federated Identity Forgery Bypasses Your EDR

    Mandiant's new Golden SAML variant lets a SYSTEM-level attacker on any ADFS host pull active signing keys from the DPAPI_SYSTEM LSA secret and forge Global Administrator assertions Entra ID trusts — without touching LSASS or the live ADFS process. Every LSASS-handle-access detection is blind to it.

    Ask Clarity

  2. AI Coding Agents Are Now a Primary Attack Surface

    Four+ attack classes hit Claude Code, Cursor, Codex, Amazon Q, Windsurf and Augment in one cycle: GhostApproval symlink escape (6 assistants), a 0DIN prompt injection with payload in a swappable DNS TXT record, GitLost repo exfiltration, and HalluSquatting. Sophos found legitimate agents trip the same EDR rules as intruders.

    Ask Clarity

  3. KEV Exploits on Your Web Tier + Perimeter RCE

    Adobe ColdFusion (CVE-2026-48282, CVSS 10.0) and Joomla Page Builder CK (CVE-2026-56290) entered CISA KEV July 7 and are exploited now. Pre-auth RCE sits in BeyondTrust (CVE-2026-40139, 9.8) and Citrix NetScaler (CVE-2026-8452/8655, 9.8); Gitea impersonation (CVE-2026-20896) is exploited; Containerd and the AI/ML tooling stack are riddled with 9.8–10.0 RCE.

    Ask Clarity

  4. Your EU→US Data Pipeline Just Got a Legal Expiry Date

    The June 2026 SCOTUS ruling letting the President fire an FTC commissioner without cause gives Schrems his constitutional hook for round three against the EU-US Data Privacy Framework, whose adequacy decision names the FTC as an 'independent authority.' Safe Harbor fell 2015, Privacy Shield 2020 — 3,600+ firms' flows hang on the third.

    Ask Clarity

  5. Synthetic Media + Vendor Data-Handling Erode Trust Controls

    Meta's Muse Image (default-on, @-mention any public Instagram account) and OpenAI's full-duplex GPT-Live voice strip the latency and skill barriers behind executive-impersonation BEC. Veriff reports AI-enabled fraud up 300% YoY. Separately, HubSpot silently pooled customer CRM records cross-tenant — a live vendor-risk case even after its reversal.

    Ask Clarity

Deep Dives

Golden SAML, Second Generation: The Identity Forgery Your EDR Can't See

This variant matters not because it forges a Global Admin — classic Golden SAML did that — but because of where it reads the keys. Prior tradecraft required extracting signing material from the live ADFS configuration or scraping process memory, both of wh

What to do

  1. Classify every remaining ADFS host as Tier 0 this week: enable SACL auditing on MachineKeys/Protect\S-1-5-18, wire Event ID 385 into your SIEM, and migrate signing keys to an HSM.

  2. Add ADFS retirement to this quarter's identity roadmap, moving surviving federations to native Entra ID.

Your Developers' AI Agents Are the New RCE Path Into the Build Chain

Four independent research teams disclosed distinct attack classes against the same tools in one week. That convergence is the signal. This is a design-class problem, not a vendor bug you can switch away from. Map each disclosure to the layer it breaks.

TechniqueBreaksScopePatchable?
GhostApproval (Wiz)The approval/consent model — agent asks to edit one file, symlinks grant broad machine access6 assistants (Claude Code, Cursor, Amazon Q, Antigravity, Windsurf, Augment)Yes — vendor patch + symlink hardening
0DIN prompt injectionStatic analysis — payload is a base64 reverse shell in a swappable DNS TXT record, not the repoAny agent pointed at an untrusted repoNo — usage/sandboxing control
HalluSquattingThe supply chain — attackers pre-register package names LLMs hallucinateAll LLM assistantsNo — intercept at install
Sophos EDR findingYour detection pipeline — legit agents fire the same rules as intrudersEndpoint telemetryNo — detection re-engineering

The 0DIN chain is the one to watch. Components: a README, a Python package that raises a RuntimeError, and a setup script piping a dig query into bash. The repo carries zero malicious code. The payload rotates server-side with no new commit. Code review and SAST see nothing, because there is nothing in the tree to see.

The human gate is going. Unreviewed AI commits went from 10% to 40% in a single month. DigiCert found 78% of enterprises have hit AI-related incidents, mostly misconfigured agents, not bad code. The Claude Code geo-fingerprinting episode fits the same pattern: surfaced by a Reddit reverse-engineer, flagged by China's MIIT. It confirms the behavior — these clients do undisclosed local inspection with unaudited network egress. One incident is a bug. Four in a week is a category.

What to do

  1. Egress-filter DNS TXT lookups and block agent-initiated shell/network calls from dev workstations and CI runners this sprint; sandbox agents in non-privileged containers and disable symlink following.

  2. Force-update the six GhostApproval-affected assistants, pin Claude Code to 2.1.198+ per CNVD guidance, and enforce dependency allow-listing against HalluSquatting.

  3. Re-tune EDR to baseline legitimate agent behavior separately (tag agent processes, allowlist), then red-team validate intruder detection survives the tuning.

Two Live KEV Exploits and Pre-Auth RCE Sitting on Your Perimeter

Two items separate signal from the dozens of 9.x CVEs this cycle. Adobe ColdFusion CVE-2026-48282 (CVSS 10.0) and Joomla Page Builder CK CVE-2026-56290 both entered CISA KEV on July 7. KEV listing means working exploits and active scanning, so these are incidents-in-waiting rather than triage. Anything internet-facing and unpatched by tonight stays exposed until it is isolated.

The secondary cluster hits the appliances that broker access to everything behind them, which is where the real damage lives. BeyondTrust Remote Support carries CVE-2026-40139 at 9.8, plus 40138 and a priv-esc, 40141, at 9.9. Citrix NetScaler ADC/Gateway carries CVE-2026-8452 and 8655, both 9.8 memory overflow. All of it is pre-auth. A compromised PAM or gateway is a compromised environment, and until the credentials those appliances broker are rotated, a patch alone leaves the trust chain intact. Separately, Gitea CVE-2026-20896 is exploited in the wild to impersonate any user, with 6,200-plus servers still exposed despite a fix out since end of June, which makes the auth logs worth a retro-hunt.

The under-monitored surface

The pattern worth watching is the AI/ML tooling ecosystem, which ships fast and secures slow. This is the same fast-adoption dynamic that made early container deployments a mess, and it is playing out again. Crawl4AI CVE-2026-57572 is a 10.0 command exec. LLaMA-Factory CVE-2026-58116 is 9.8 RCE via a malicious model path. txtai CVE-2026-58449 is 9.8 via /reindex. NVIDIA AIStore is 9.8 auth bypass. IBM Langflow carries seven CVEs up to 10.0. These live inside privileged data-science environments most SOCs do not monitor. Containerd adds container-escape potential through CVE-2026-50195 at 9.9 and 53492 at 9.6; the fixed builds are 2.3.2, 2.2.5, and 2.1.9.

The trap this cycle is that incomplete fixes are being bypassed. HPLIP CVE-2026-14544 and Pivotal CRM CVE-2026-51947 each reopen a prior hole. We have seen vendors close a bug and leave the door ajar before, so "patched" is a label to validate, not to trust.

What to do

  1. Patch or isolate every internet-facing ColdFusion (CVE-2026-48282) and Joomla Page Builder CK (CVE-2026-56290) tonight; if patching can't be immediate, pull behind auth or take offline.

  2. Patch BeyondTrust and Citrix NetScaler this week, review appliance logs for pre-auth anomalies, and rotate all credentials those appliances broker.

  3. Inventory AI/ML tooling (Crawl4AI, LLaMA-Factory, txtai, Langflow, AIStore) across dev and prod, patch to fixed versions, remove internet exposure, and stand up SOC detection on ML hosts.

The Legal Clock on Moving EU Data Stateside Just Started Ticking

The chain is direct. The European Commission's adequacy decision for the EU-US Data Privacy Framework names the FTC as one of the "independent authorities" underpinning SIGINT-redress oversight. The EU Charter requires exactly that. The June 2026 SCOTUS ruling holds that the President can fire an FTC commissioner without cause. It struck down the statute limiting removal to "inefficiency, neglect, or malfeasance." That hands Max Schrems a clean argument that no genuinely independent authority exists.

Schrems is 2-for-2. Safe Harbor fell in 2015. Privacy Shield fell in 2020. One legal expert calls the current argument "a stretch." A man who has killed two frameworks earns a contingency plan. The 3,600+ firms certified under the DPF hold the concentrated exposure.

Readiness costs less than a fire-drill during an invalidation. EU personal data most commonly lands in M365, Salesforce, and AWS/GCP US regions, and those US-region processing paths carry the worst downside. Other deadlines run alongside. The ECB has given EU banks four months to produce AI-cyberattack defense plans. CIRCIA's final breach-reporting rules are expected in September. The transfer question is the one with the hardest downside, so it leads.

What to do

  1. Commission a fresh Transfer Impact Assessment and pre-stage Standard Contractual Clauses / EU data-residency fallbacks for all US-hosted processing of EU personal data this quarter.

  2. Set a defined go/no-go trigger tied to the CJEU/noyb docket so the SCC fallback activates on a decision, not a scramble.

The bottom line

Stop treating identity federation, developer tooling, and cross-border data contracts as settled infrastructure. This week's highest-leverage move: re-draw your trust boundaries and ask which non-human, federated, and vendor-held identities can silently mint privilege or move data outside anything your controls actually watch.