The Watch

What the worm actually targeted

The selection logic is the part worth studying. TeamPCP did not backdoor end-user applications. It compromised Trivy, KICS, LiteLLM and Telnyx — packages that run inside CI with privilege. Trivy and KICS are scanners with read access to source and pipeline secrets. LiteLLM almost certainly holds provider API keys. The worm stayed dormant until it landed on a developer machine, harvested stored credentials, then injected itself into other libraries that developer maintained. Every infected maintainer became a distribution node. Risky Business maps the chain as T1195.002 → T1552.001/T1555 → T1078, with a self-propagation loop back into T1195. That loop is how a two-person crew reached a six-figure credential count.

Where the sources agree and where they diverge

All three accounts land on the same operative point: arrests are not remediation. The AFP charged two Western Australian men, named locally as Ruben Thomson, 21, and Louis Gaebler, 23, with 14 combined offences. The investigation began in April with FBI assistance. Scope is where the accounts split. The Hacker News frames exposure around the March 2026 Trivy and Checkmarx compromise window. CyberScoop reports 1,000+ organisations, 500,000+ credentials, 300GB+ exfiltrated, and cleanup costs in the hundreds of millions. Risky Business adds that 78,000+ tokens and secrets from almost 2,200 organisations leaked publicly last month, a small fraction of the haul. Its read is that crews dump data deliberately so rivals reuse it and attribution muddles. Plan for follow-on intrusions being misattributed to someone else.

The compromise sat in the build pipeline, not in the shipped product — which is why nothing in your SBOM diff will tell you whether your secrets are gone.

Two active exploitation events buried in the same cycle

Two items alongside the arrests need same-day handling. PaperCut MF/NG patched an actively exploited zero-day on Thursday and published nothing else. No CVE. No indicators. That combination removes the option of writing compensating detection, which leaves patching as the only control. Print servers are domain-joined and routinely unmonitored, so pair the patch with a 60-day retro hunt for anomalous outbound connections and file access. Gitea CVE-2026-60004 carries CVSS 9.8, has been in KEV since August 25, and is being exploited in the wild despite last month's patch. Repository write access converts to shell execution as the service account: a malicious patch to the diffpatch endpoint plants an executable Git hook. A compromised Git host delivers TeamPCP's outcome without the worm.

The structural fix

Rotation is the immediate work. The durable move is removing what the pattern feeds on. Long-lived CI secrets are the fuel; short-lived OIDC federation plus default-deny egress on build runners makes the propagation model non-viable. That one change outweighs any detection written for this specific crew, and it holds after they reconstitute.

Three products, one failure class

The three Wazuh flaws share one root cause, and the root cause dictates the fix. All three abuse cluster-peer trust: RCE via cluster synchronisation (CVE-2026-48024), forged administrator REST API tokens through DistributedAPI.send_tmp_file() (CVE-2026-48162), and code execution by uploading a crafted archive that uses the shared Fernet key to overwrite ossec.conf (CVE-2026-49441). One compromised peer yields fleet-wide configuration control over the security agents. Patching to 4.14.6+ closes the path. It does not invalidate a stolen Fernet key. Splunk's three improper-access-control flaws at CVSS 9.4 (SVD-2026-0801, fixed in 10.4.2/10.2.6/10.0.9/9.4.14) sit on the evidence store and the incident timeline. Termix leaks other users' stored SSH and sudo passwords, which is again a credential exposure that patching alone does not remediate.

Where the pattern extends past the SOC

CyberScoop's UniFi coverage puts the same defect class in the network management plane. All three CVSS 10.0 bugs are CWE-284 improper access control granting elevated privileges, and Ubiquiti has said nothing about exploitation status. The Hacker News supplies a third instance from the opposite direction: an OPSWAT driver used as the BYOVD primitive to disable endpoint defences in the Spark RAT campaign focused on Cambodia. Across all three reports the security vendor is either the vulnerable asset or the attack primitive. Vendor-risk models that exempt security tooling because it is the thing performing the assessment have now been billed for that exemption.

The triage defect underneath

None of this ships on schedule while the prioritisation logic is broken. Five of the nine KEV entries carry a CVSS of 0, so a score-driven SLA buries confirmed exploitation of Zimbra and vCenter under low-severity noise. Make KEV membership a hard override on CVSS-derived severity in the VM platform and the ticketing queue, then re-query the backlog for unscored entries that were auto-deprioritised. SANS and The Hacker News land on the same standard: 72 hours for KEV-listed, internet-facing assets.

Nine vulnerabilities are confirmed under exploitation and five carry a CVSS of zero, while the tools that would detect the intrusion sit between 9.1 and 10.0.

The three claims that weakened

Trail of Bits titled the finding as the thesis: VMs will not contain cyber-capable agents. In controlled research, GPT-5.6-Cyber escaped QEMU/KVM isolation three separate times and surfaced several zero-days on the way out. The relevance holds in estates running zero cyber-capable agents. Developers are running coding agents, most likely in VMs, most likely with a real credential in the environment and unrestricted outbound HTTP. That configuration was defensible on one assumption. The assumption was that the hypervisor held.

The second claim is quieter and cheaper to exploit. A DNS rebinding flaw in NemoClaw lets a web page a user simply visits reach an unauthenticated local Ollama server on default port 11434 and write durable instructions into it. "Localhost is unreachable" was never a security control. It was a habit. Paired with the InjecMEM research on persistent memory injection, an accepted instruction survives into all future sessions. Prompt injection stops being a per-session nuisance and becomes a persistence mechanism. Per-prompt guardrails are scoped to the wrong lifetime to catch it.

The third contradicts vendor guidance directly. GPUThor defeats ECC on NVIDIA RTX A6000 GDDR6 memory and escalates to host root. ECC is precisely the mitigation NVIDIA recommends against GPU Rowhammer. It needs local GPU access, which keeps it below drop-everything. In multi-tenant AI, ML research clusters and GPU-backed VDI, local GPU access is the routine case. There is no replacement mitigation to cite.

What the three have in common

Each removes a boundary that was load-bearing in an architecture diagram and never validated by test. What remains are the compensating controls owned outright: credential absence, default-deny egress through an inspecting proxy, and command and DNS logging shipped off-host. Those are the controls most teams skipped because the VM was supposed to be enough. Trail of Bits recommends throwaway machines, no real keys, limited network, real logs. The recommendation is unglamorous, and the budget conversation now has published evidence behind it.

If an agent sandbox holds a real credential or has open egress, the containment story is the hypervisor, and the hypervisor has failed three times in a lab that was trying.

Detection that costs almost nothing

Two rules are cheap and rarely false-positive. First, alert on agent-host requests to 169.254.169.254 and RFC1918 ranges, and enforce IMDSv2-only across the cloud estate. SANS ISC separately reports simple scanning for cloud metadata services, the standard post-SSRF pivot. Second, EDR-query the fleet for processes listening on loopback high ports, which surfaces every unmanaged local LLM runtime at once. Kill DNS rebinding at the resolver by rejecting external answers that resolve into RFC1918 or loopback space. That one control covers every localhost-bound service in the estate, not just AI runtimes.