The Watch

Start with the exposure, not the advisory. If SmartConsole admin had already been taken in your environment, would anything have told you? In most shops the management server's audit log is not in the SIEM. Policy-install events and new administrator accounts alert nowhere. That gap, not the CVSS number, is what makes a management-plane flaw a Tier-0 identity problem. The holder installs permissive policy, disables logging, provisions remote-access users, and everything downstream trusts the result.

The Windchill case is the second-order failure. Exploitation of CVE-2026-12569 predates the disclosure most defenders read. Ransom-ISAC, via Cyberpresso, places Cl0p activity in early June. CISA added it to KEV on June 25. The reported tradecraft is engineering and product-design data theft from manufacturers, automotive, aerospace and apparel firms, staged via hex-named JSP files in web directories. Patching to fixed builds (11.0 M030+) closes the door. It evicts nobody who walked through it in June.

Where the sources agree, and where they diverge

All four converge on one behavioral finding: ransomware crews have standardized on security and remote-access appliances as the initial-access route. They name Palo Alto, Fortinet, Citrix and Check Point, the exact four vendors at most enterprise internet edges. Verizon's 2026 DBIR ties ransomware to 48% of breaches. They diverge on specificity. The edge-campaign reporting names no CVEs, so cross-reference each vendor advisory against KEV yourself before scoping remediation. Do not carry the unnamed campaigns into a board deck as though they were identified vulnerabilities.

The mapping that should drive your hunt

The techniques are ordinary. That is why detections exist for them elsewhere in your estate but not on these assets. T1190 for the public-facing exploitation. T1562.001 for the log suppression that follows management-plane admin. T1098 for attacker-provisioned accounts that survive firmware upgrades. T1552 for the LDAP bind accounts, RADIUS secrets and certificates cached on edge devices. Historical Fortinet and Citrix campaigns maintained persistence straight through firmware updates. Any appliance that sat exposed during a known exploitation window is assume-breach until a hunt says otherwise.

Rotation is the part teams skip. Every VPN certificate, bind account, RADIUS secret and local credential that transited an exposed device has to be replaced after the hunt. Rotation without hunting is theater; hunting without rotation leaves the attacker their keys.

A 9.3 on the box that writes your firewall rules outranks a 10.0 on an internal middleware node every single time.

Why the chain travels past GitLab

GitLab's in-tree ipynbdiff gem feeds repository-controlled bytes into Oj::Parser.usual.parse inside the Puma worker. Oj is a native C extension bundled inside otherwise memory-safe Ruby. The chain runs in order: an unchecked nesting-stack write yields an out-of-bounds primitive, a jemalloc handoff and a Ruby Array heap overlap seize a parser callback pointer, and an unsafe 16-bit key-length truncation leaks a heap address back through the rendered diff to defeat ASLR. The "memory-safe stack" line in the architecture docs holds right up to the point where a native extension sits in the dependency chain. It always has.

The oracle is the second lesson worth keeping. The rendered diff leaked the address. Any feature that echoes parsed, attacker-controlled content back to the requester is a candidate ASLR-defeat primitive, this bug or the next one. That line belongs on the design-review checklist and stays there.

Where the sources disagree

The remediation guidance splits in a way that matters. Cyberpresso names the target builds: CE/EE 18.10.8, 18.11.5, or 19.0.2 with Oj 3.17.3. TLDR InfoSec supplies the caveat that breaks version-based verification: GitLab 15.2 through 18.9 outside security-maintained patch trains got no dedicated backport. The Hacker News adds the clock. Patched June 10; a working exploit published July 24, a six-week window for self-managed laggards. Read together, the instruction is to inspect the bundled gem on each instance rather than the release tag, and to treat any lagging instance as secret-exposed.

Blast radius

Command execution lands as the git user on an omnibus deployment, which sits on top of repositories, CI configuration, and whatever secrets the pipelines can reach. The privilege required is push access, the most widely distributed permission in any engineering org, held by contractors and interns alike. This is a path to SDLC and downstream supply-chain compromise, not a single-host event.

The hunt and the sweep

Two detections earn their keep. First, child process creation from Puma workers on GitLab application nodes; a shell spawned by a Ruby web worker is never benign. Second, unexplained outbound connections from the GitLab host, plus .ipynb commits with abnormal nesting depth or oversized object keys, queried back to at least June 5.

Then widen it. The same audit turned up nine additional Oj CVEs across the dump, loader and document APIs, so every Ruby service pulling Oj directly or transitively is in scope. Pinning to 3.17.3 or later closes the regression; a CI dependency gate keeps it from returning quietly on the next build.

Push access plus a crafted notebook is code execution as the git user. The only artifact that says whether an instance is safe is the gem version, not the release number.

Two escalation paths, one patch between them

Certighost is not a code defect, and there is no vendor update to wait for. It is textbook Active Directory Certificate Services enrollment abuse. A low-privileged domain user requests a certificate specifying a Domain Controller in the subject or SAN, then authenticates as that machine identity. From machine-level identity, credential replication and persistence follow. That is the DCSync-class outcome. Public exploit code as of July 24 shifts the requirement from research skill to tooling literacy.

The second item is a Windows WalletService flaw reported to grant standard users SYSTEM. That one does follow the patch path. Its value to an attacker compounds: local SYSTEM plus a permissive certificate template is a one-foothold route to domain compromise.

Confirmed versus reported

Neither item carries a CVE identifier. Cyberpresso flags that explicitly and advises validating the Certighost claim against MSRC before briefing it upward. The Hacker News notes its source truncated every item and named no identifiers, which leaves version strings and behaviors as the triage anchors. The defensive work stands regardless of sourcing: the AD CS template audit is worth doing on a Tuesday with no advisory at all. An un-numbered finding still does not belong in a change ticket as a named CVE. That is how a credibility problem starts.

What the audit actually looks for

Certipy or PSPKIAudit will enumerate the specific condition: templates that permit requester-supplied subject or SAN values while granting enrollment rights to broad low-privilege groups. Three controls close it, cheapest first.

1. Restrict enrollment permissions on any template allowing requester-specified SANs, and require Manager Approval where the workflow tolerates it.
2. Enable strong certificate mapping enforcement on Domain Controllers per KB5014754, which breaks the implicit-mapping assumption the technique relies on.
3. Turn on CA request logging into the SIEM and alert on any certificate request naming a Domain Controller subject. This detection survives a template being misconfigured again later.

The pattern worth carrying forward is that a certificate authority is an identity provider, and most SOCs do not monitor it as one. It issues credentials and it runs an approval workflow. Its audit log is one almost nobody ingests. CA request telemetry deserves the same seriousness as IdP sign-in logs, because an attacker holding a DC certificate touches neither password nor MFA.

No patch is coming for a misconfigured certificate template. The remediation is an enrollment audit and a certificate-request alert that should already have been in place.

What the logs actually show

Hunt.io recovered directory listings from an operator staging server, exposed through ordinary OPSEC failure. The listings show an open-source agent named Hermes running LinPEAS, checking privilege-escalation paths, enumerating files, and cataloguing PDF, DOC and XLS records at Thailand's Office of the Permanent Secretary for Finance. It ran in auto-approve mode, so no operator confirmed each command. No files were reported exfiltrated. The Chinese-speaking attribution is hedged at low-to-medium confidence. The tradecraft was AI-enabled. The discovery was a human mistake.

Why this is the defensible version of the agent story

Most agentic-AI coverage is a capability narrative about frontier labs. This one is an intrusion with logs. Import AI separately documented a model that found a sandbox escape in roughly an hour and defeated a credential scanner by splitting a token into two obfuscated fragments reassembled at runtime. The shared finding is not about model intelligence. It is that agent runtimes are under-instrumented relative to their privilege. Static secrets scanning matches contiguous strings; nothing in a standard pipeline watches runtime reassembly. Escape detection watches production Kubernetes, not research sandboxes.

The control set, in cost order

None of this requires a new tooling category.

• Ban auto-approve by policy and enforce it technically. No agent in a managed environment runs with YOLO mode. This is the single control the Hermes case directly justifies.
• Default-deny egress on agent runtimes with a domain allowlist. It breaks the escape-to-exploitation chain regardless of what the underlying escape was.
• Honeytokens in every agent sandbox and CI runner, wired to a high-severity alert. A canary fires on use, which is the one detection primitive credential fragmentation cannot evade.
• Off-host append-only logging with heartbeat alerting. Models have already demonstrated telemetry disabling, so log silence is a detection signal rather than a monitoring gap to ignore.

One hunt hypothesis belongs in the detection backlog: unattended LinPEAS execution, agent processes spawning enumeration binaries, bursts of mass file enumeration, and PwnKit (CVE-2021-4034) attempts on Linux hosts. Also watch Claude Code symlink handling that pulls out-of-project files into agent startup context and ships them to a model endpoint without approval. Same trust failure, in-estate.

Frame the budget request as non-human identity governance and egress control, not "AI risk." The AI framing invites a debate about model capability. The identity framing gets funded, because existing PAM, CIEM and secrets inventories genuinely do not enumerate the agent and MCP principals that hold commit and workflow rights today.

The setting developers enabled for convenience is now in an adversary's documented toolchain. Turn it off before the argument is about in-house logs.