The Watch

The detail that turns a routine WordPress advisory into an urgent fire is the persistent-object-cache exploitation condition published alongside the CVE assignment — it widens the exploitable population beyond a narrow default config, and it ships with a working public exploit. Disclosure, mechanism, CVE, and PoC in one window is the canonical precursor to mass scanning, which follows a public PoC in hours, not days.

Your real exposure isn't the WordPress instance your team manages. It's the forgotten marketing microsite, the acquired-company blog, and the shadow campaign page nobody has touched since launch. wp2shell is unauthenticated RCE — a single crafted request yields full site and host compromise, no credential to phish first.

In parallel, OpenSSL's HollowByte is lower-impact but cheap to trigger: an 11-byte TLS request that never completes pins up to 131KB per request, unreleased until process restart on glibc. It's a DoS, not RCE, but it hits every TLS terminator you run — proxies, load balancers, API gateways, embedded services.

The two demand different tempos: WordPress is an immediate close with core patches and WAF virtual patches against published PoC signatures; OpenSSL is a sweep of your TLS front-ends backed by handshake rate-limiting and aggressive timeouts on incomplete handshakes.

One sourcing caveat before escalating to leadership: both codenames reach us through a single newsletter with no vendor advisory cited. Validate the CVE assignments, affected versions, and patch availability against the WordPress core and OpenSSL project advisories directly before treating these specifics as confirmed.

Moonshot open-sourced Kimi K3, a 2.8-trillion-parameter frontier model, on July 27. Once weights are downloadable, the API chokepoint disappears. That chokepoint is what gave security teams proxy logs, DLP inspection, and a vendor of record. Inference now runs on a dev workstation or an internal GPU box with zero egress record.

The pricing numbers are $0.94 per task against $1.80 for Opus, with strong coding and agentic benchmarks attached. Both figures, and the 2.8-trillion-parameter size, trace to a single newsletter. Verify against Moonshot's release notes when the weights land; the governance exposure holds regardless of the exact figures. The people who would normally enforce restraint are already using the tools without approval: roughly two-thirds of senior decision-makers admit to unsanctioned AI use. Policy aimed downward misses the violators at the top.

Downstream, the agents already hold privileged access. A survey of 406 infrastructure leaders found 93% have hit an AI-caused infrastructure incident while only 30% have any governing policy. Treat the exact figures as directional; the direction is not in dispute. Coding agents write session logs full of tokens and internal context to unmanaged laptops, and some tools now sync those logs across nine agents. MCP servers and A2A Agent Cards add tool-execution and peer-discovery surfaces the SOC has no telemetry on.

The fix is treating AI as an identity and asset class you govern, not banning it. The prompt stream is a new, uninspected egress channel. MCP tool calls turn prompt injection into SSRF. Open weights arrive with no DPA and no SOC 2 report. The controls needed already exist: inventory, least privilege, DLP, logging. They are just pointed at surfaces that haven't been catalogued yet.

NadMesh is the concrete end of this story. It's a Go-based botnet active since early July, running a Shodan harvester to fingerprint exposed ComfyUI, Ollama, and n8n instances, then exfiltrating cloud keys and Kubernetes tokens. Its operator dashboard already claims 3,811 AWS keys, a single-newsletter figure that can't be independently corroborated. Exposed self-hosted tooling is now a target class NadMesh is built to loot.

The mirror image is model endpoints, not dashboards. Anthropic's disclosure that Moonshot ran a 3.4-million-exchange distillation campaign against Claude, through hundreds of fraudulent accounts across multiple access pathways plus reasoning-trace reconstruction, is a documented API-abuse playbook that maps to any LLM an operator runs or resells. The technique: account farming to stay under per-account thresholds, multi-pathway access to evade single-surface rate limits, output harvesting at dataset scale.

The two cases share a mechanism. Inference endpoints get robbed the same way dashboards do, one exfiltration at a time. An unauthenticated dashboard is a credential vault. An exposed inference API is a training set, harvested query by query.

Anthropic's detection method: analysts correlated request metadata to public profiles of senior Moonshot staff. That identity-to-behavior correlation is repeatable elsewhere. A volumetric anomaly flags that something is wrong; tying registration identity to request behavior is what attributes it.

The uncanny valley closed in public this year, and that single fact retires two authentication factors your fraud controls still trust. At the 2026 World Cup, an AI-generated clip of Neymar scoring past Messi reached millions who believed a match that never happened, a fabricated biography recast a goalkeeper as a moonlighting electrician, and thousands of scam ads circulated using real players' faces. Separately, McCartney's team reconstructed John Lennon's vocals from a degraded tape cleanly enough for commercial release.

Translate each to a business attack. High-fidelity video generation is a deepfaked executive making false statements for fraud or stock manipulation. Cheap likeness generation at scale is brand and executive impersonation ads targeting your customers. Voice cloning from low-quality samples is vishing and BEC that clone your CEO from a single earnings call. If a hobbyist can fool millions, a funded fraud operator can fool your approval chain — and the vulnerable component is now the human who 'recognizes' the voice.

The economics compound it. Cheap open-weight frontier models collapse the cost of producing convincing malicious content, so plan for attacks that are simultaneously higher-volume and higher-quality. This is not a future scenario; the enabling capabilities have all shipped.

The defensive posture is a hard rule, not a tuning exercise: voice and video are no longer proof of identity. Move authentication of high-impact actions to out-of-band channels, and retrain analysts and approvers that 'I recognized them' is not verification.