The Watch

Scoping is where this goes wrong. Query inventory for 'libssh2' or 'SSH servers' and you miss most of the blast radius. libssh2 is a transitive dependency of curl, Git, and PHP runtimes, which means CI/CD build agents, cron-driven curl calls, package managers, and PHP web tiers all carry the pre-auth RCE. Defenders scoping this correctly are querying SBOMs for every artifact linking libssh2 and prioritizing internet-facing exposure.

The flaw triggers during the SSH handshake, before authentication. There is no credential barrier and no login attempt to alert on. The fix is libssh2 >1.11.1. Where a rebuild isn't possible yet, the interim controls are SSH-outbound restrictions and IPS signatures for anomalous handshakes.

This was not a coordinated advisory. A researcher operating as 'bikini' dumped 130+ unvetted PoCs to a public repo with zero vendor notice. Within days, actors were probing the libssh2 flaw and a companion Gitea admin-impersonation bug that spoofs X-WEBAUTH-USER on default Docker configs. Gitea's fix is one line at the reverse proxy: strip or validate the header.

Running in parallel is XQUIC 'XRING', an unpatched remote DoS in Alibaba's QUIC/HTTP/3 library. One wrong variable lets any client crash an HTTP/3 endpoint with completely legal traffic, needing no authentication, no malformed packets, and no special tooling. With no patch available, the only control is architectural. Operators are finding every HTTP/3 termination point that links XQUIC — CDN edge, LB, reverse proxy, API gateway — and failing back to HTTP/2 until Alibaba ships a fix.

The pattern holds across all three: the patch backlog and the dependency graph are the attack surface, and public weaponization is running ahead of vendor response.

The figure that resets priorities: 54% of enterprises already report an agent-related security incident. 69% share credentials across agents. Only 32% assign each agent a unique managed identity. That maps to MITRE Valid Accounts (T1078). A compromised agent is a valid account with over-broad scope and no attribution. Maximum blast radius, blind audit trail.

The failure mode now scales. OpenAI's ChatGPT Work (GPT-5.6) is auto-rolling to Business/Enterprise/Edu tenants and desktop apps across all tiers, aggregating context from every connected tool. Anthropic's Claude Cowork is the direct competitor. Each OAuth connection hands an autonomous agent standing read/write access. It bypasses central IT and trips no human-behavior baseline. The sharpest point across sources: crown-jewel tacit knowledge lives in exception logs and decision traces, not the PDFs your DLP is tuned to catch. That is exactly what these agents ingest.

Then there is the flaw spanning Amazon, Anthropic, Google, and Cursor. It let an agent present false information to the human approving its output. That structurally defeats human-in-the-loop. Where the auditor story rests on a reviewer checking agent output, the agent can lie to that control.

Sources converge on the fix, and it is not novel. AI gateways fronting Bedrock/foundation models get reclassified as Tier-0 assets. Shared credentials give way to short-lived scoped tokens per agent. GitHub's 'safe-outputs' propose-not-write pattern applies. Agent tool-calls feed the SIEM. Standing access is hard to claw back, which puts the control at onboarding, before business units connect these, not after.

During a ransomware event you hand your negotiator your most sensitive strategic data — insurance ceiling, pay-tolerance, business-impact threshold. DigitalMint proves that trust is a documented attack vector: Angelo John Martino III drew 70 months for feeding BlackCat affiliates his own clients' insurance limits and negotiating floors to inflate demands, pocketing a cut — $75.3M extorted from five firms in six months, single victims paying $26.8M and $16.5M. BlackCat was sophisticated enough in 2023 to recruit and run an insider inside the negotiation industry itself. Assume your IR retainer lacks dual-control, negotiator vetting, and contractual liability for collusion — most do.

The vendor-trust theme extends into your AI stack via availability and honesty. A single federal export-control directive dark-started Claude Fable 5 and Mythos 5 worldwide for roughly three weeks — the first government-driven suspension of public model access. That's a vendor outage by regulation, not DDoS, and your BC/DR plan almost certainly doesn't model it. Compounding it: an OpenAI privacy engineer testified under oath the firm could search 'anonymized' ChatGPT logs it had told a court it could not, and 17 media orgs are seeking sanctions for withheld discovery. If staff pasted source code or regulated data into consumer ChatGPT, that corpus is more searchable than claimed — and now court record.

The lesson: the parties given the most implicit trust — your crisis negotiator and your frontier-AI provider — are where you have the least verification and redundancy. Compartmentalize what any single external party sees; build documented failover for any AI-dependent production path.

A rare structural win: npm v12 disables lifecycle scripts (preinstall/postinstall) and implicit node-gyp builds by default; pnpm 11.10 binds registry tokens to specific hosts. Lifecycle scripts are the execution primitive behind nearly every npm supply-chain compromise. event-stream, ua-parser-js, countless typosquats. Arbitrary code fires on npm install. Making it opt-in closes the default hole. The residual risk is behavioral. Native packages break, devs re-enable scripts globally, and the vulnerability comes back quietly. Control: a policy gate that treats any --foreground-scripts use or re-enabled lifecycle scripts as a reviewed security exception.

Offense is not slowing. Sysdig's JADEPUFFER is the first end-to-end LLM-driven ransomware. It got in through years-old known bugs in Langflow and Nacos. That is patch-backlog exploitation at machine speed. GodDamn ransomware moves through Windows via BYOVD, AnyDesk, and open-source credential stealers. Microsoft patched the RoguePlanet Defender zero-day: SYSTEM-level command execution via a race condition on fully patched Win10/11, real-time protection off, weeks after exploit code went public. Engine updates lag the OS patch cycle. Verify the Malware Protection Engine version fleet-wide. Do not trust Patch Tuesday to have covered it.

For detection engineering: the WP-SHELLSTORM crew left its own server open for three weeks, exposing a 1.4M-site WordPress target list. That list is IOC-hunting material. Datadog is tracking GitHub API org-enumeration from dormant accounts, a pre-exploitation phase where detection buys lead time.