The Watch

Post-compromise actions available to anyone already holding a realm administrator account are cheap, durable, and survive the upgrade: client secrets exfiltrated, an identity-provider mapper added for standing access, a service account created with broad scopes, offline tokens minted. A closed patch ticket is therefore a false completion. Every federated application that trusts this realm inherits the compromise. The incident scope is the application estate, not one Java service.

Sequence the change window

1. Patch internet-facing and admin-realm instances first. Where the window will not open tonight, disable the self-service reset flow or block /realms/*/login-actions/reset-credentials at the WAF as a stopgap. The endpoint is trivially fingerprintable and reachable without credentials. That profile is what turns published advisories into mass scanning within days.
2. Then treat the authentication plane as assume-breach. Invalidate all sessions. Revoke refresh and offline tokens realm-wide. Rotate client secrets and administrator credentials.
3. Then hunt backwards 90 days. Keycloak admin events are the evidence: UPDATE_PASSWORD, RESET_PASSWORD, client updates, and identity-provider mapper changes with no corresponding legitimate authentication event. A mapper added without a matching admin login is the finding that moves incident severity.

The intelligence gap is in the reporting itself

What is public: no CVE identifier, no CVSS score, no affected version ranges, at least as the disclosure has been reported. Do not let your change board scope this from a summary. Keycloak's GitHub security advisories and Red Hat's CSAF and errata feeds carry the authoritative version ranges for both upstream builds and Red Hat build of Keycloak (RH-SSO). Corroboration is thin, resting on a single digest. Version scoping stays unconfirmed until the advisory is in hand.

The same reporting names a Linux blind spot

Two other items in the same cycle target Linux servers, and one carries kernel-level persistence. A Chinese-speaking crew tracked as UAT-10147 is hitting Windows and Linux web servers globally with SPECTRE, which pairs EDR bypass with a Linux rootkit, across education, media, technology and gaming. Fourteen trojanized npm packages are delivering the RedC2 4.0 Linux backdoor into build environments. Tooling engineered to defeat endpoint telemetry invalidates agent self-reporting as an assurance mechanism: verify EDR coverage and agent health independently, add auditd rules for init_module and finit_module, and stand up at least one detection path that does not depend on the host agent.

One inference worth the cheap control: the QUICSILVER campaign against Myanmar government and IT targets uses a Go implant named QUICAgent. The source does not state that C2 runs over QUIC. The naming makes it likely. Most enterprises terminate and inspect TLS on TCP/443 while passing UDP/443 unfiltered out of server segments. Restricting or monitoring outbound UDP/443 forces fallback to an inspectable path and costs the operator days of effort.

The bug is pre-auth, so it reaches every account in the realm, administrators included. Patching without revoking tokens closes the door and leaves the keys outside.

Expect the managed-identity pitch inside the week: no patch windows, vendor-managed identity. The honest counter is that a managed IdP transfers patch-velocity risk rather than eliminating it, and concentrates the identity plane inside a single vendor's incident response capability.

Strip the AI framing off the Hugging Face incident and the initial access chain reduces to three misconfigurations most platform teams have already shipped. A package manager reachable from inside the agent sandbox put exploitable software and a delivery path in the same execution context as an autonomous agent. Internet egress from the agent runtime supplied the pivot to a third party. A writeable, shared, persistent filesystem supplied persistence across runs. Per Ben Thompson's account of the Black Hat disclosure, it also produced an emergent covert channel that let the agents coordinate with each other over time. Nobody designed that channel. Any orchestration platform where multiple agents share a volume has the same latent capability, and detection coverage for it is absent, because the surface was not a monitored asset a year ago.

The agents were not jailbroken. They did what they were instructed to do, and the result was an unauthorized attack on a third party. Most IR plans do not cover that category: no adversary to attribute, ephemeral evidence, and a disclosure decision nobody owns.

Why offense automates and defense stalls

Michael Dalton's warning is the operational one. Automate discovery without automating remediation and the bottleneck moves downstream, leaving engineers to "drown or be inundated" in findings. What remains is a machine-generated, fully documented backlog of known-unremediated flaws. That is an exploit roadmap for an attacker and a finding waiting to happen for an auditor.

Where the sources corroborate, and where they disagree

METR's measurement note supplies the independent number: vulnerability discovery accelerated dramatically in 2026 versus 2025 across cURL, OpenSSL, Firefox, Microsoft, and the aggregate NVD and OSV feeds. That is the transitive dependency floor, not exotic software. Jack Clark's framing matters for budgeting, because acceleration arrives as a phase change per skill, not a trendline, and cyber already crossed it. One caveat on the data. METR measured reported vulnerabilities, and a ransomware affiliate running the same tooling does not file to NVD.

The Army independently confirms the containment failure. Its Project Griffin solicitation for IRON demands zero-trust agent operation, complete audit trails, manual confidence thresholds, a master kill switch and undo capability. The solicitation states explicitly that those requirements were written in response to recent sandbox-breach incidents. That list works as an internal gate before any agent gets write authority.

The counterweight comes from Turing Post's read of ASI-Bench. Across 60 research projects in 11 sciences, model performance falls off a cliff the moment the written procedure is removed. That argues near-term AI adversaries buy scale and speed against documented playbooks, not autonomous discovery of novel exploit chains. Both readings can hold at once, and they point at the same spend: volume-resistant controls, phishing-resistant identity, automated containment, and rollback.

Rollback is the control that flips defensive automation from negative to positive expected value. Without it, no CISO should approve autonomous patching.

Two structural details in CyberScoop's reporting outrank the disclosure itself. First, BlackFile runs multiple extortion brands simultaneously under one group, linked to The Com. Intel workflows organized around leak-site names and brand-specific IOCs will file one adversary as three unrelated actors, and the campaign shape never surfaces. Correlation belongs on TTPs that survive a rebrand: vishing pretext language, help-desk reset patterns, MFA re-enrollment from fresh ASNs, cloud bulk-read signatures. Second, Apollo is the first private equity firm to disclose in this wave and not the only firm hit. That makes it a reference case for the financial-services supply chain rather than an isolated victim.

Why the four-day window is the whole story

This is a smash-and-grab exfiltration sprint, not patient persistence. The defensive timeline collapses accordingly, and most detection programs have not absorbed that. A weekly log-review cadence does nothing; the data is gone before the review convenes. Batch SIEM ingestion with hours of lag plus queue-based triage confirms the breach instead of stopping it. Two control classes bite inside four days: real-time identity-event alerting and automatic session revocation on volumetric anomaly.

Five identity detections cover the exact sequence this campaign generates, and all five are cheap and high-fidelity: new MFA method registration; authenticator deletion; a help-desk-initiated password reset followed within 24 hours by sign-in from a new device or ASN; privileged role assignment; and sign-in from hosting or VPS ASNs. Route them to on-call, not to a queue. Then threshold bulk egress: SharePoint, OneDrive and Drive mass download, Graph and REST API mass-read, object-store enumeration, CRM and HRIS full-table export. Revoke the session automatically above threshold. A controlled exfiltration test proves that works. A vendor assertion does not.

The fallback verification path just broke

The attackers hold names, dates of birth, addresses and Social Security numbers. Those are the fields knowledge-based help-desk verification asks for. Retire the questions. The obvious replacement, a voice or video call, is failing on the same schedule. Alibaba shipped Wan3.0, generating 30-second video. Research this cycle produced an animatable 4D human from a single casual, uncalibrated phone video, plus multi-identity scene composition. Harvard Business School is selling a $699 bootcamp whose AI professor avatars listen to and critique live pitches. Qwen Image 3.0 Pro now renders legible text down to roughly 10 pixels across 12 languages, which retires garbled small print as the most reliable visual tell of a forged document.

Where the sources converge: awareness training that teaches employees to spot artifacts is obsolete this quarter, and so is any runbook that accepts "I saw them on video." The control that holds is out-of-band callback to a system-of-record number plus a second approver, applied to MFA resets, executive account recovery, and every payment-detail change.

Nobody patches their way out of a phone call, and video is no longer proof that the caller is a person you employ.