The Watch

Check the build banner

A vendor shipping a second emergency fix for the same attack chain narrowed the exploit rather than removing the primitive. The Hacker News reports a PaperCut release adding hardening beyond the original patch. Remediation status recorded in the earlier cycle now describes a state that no longer exists. Confirmation is the build banner on the host plus an external scan showing no PaperCut admin interface (typically ports 9191 and 9192) answering from the internet.

Hunt as though the host was exposed

Print servers run at high privilege and reach most of the domain. Monitoring rarely reflects that. Treat any PaperCut host that was internet-reachable and unpatched as compromised until telemetry says otherwise. Artifacts worth pulling:

• Child processes from the PaperCut or Java service: cmd.exe, powershell.exe, sh.
• New local accounts and scheduled tasks registered on the print server.
• Outbound connections from print servers to anything other than a vendor update endpoint.

ownCloud carries a KEV due date

A KEV listing sets a federal remediation due date. Auditors and prime contractors ask about that date later. The Hacker News ties the flaw to the theft of nuclear records from a Philippine research body, attributed to a Chinese-speaking actor. Espionage-grade outcomes now come from n-day exploitation of commodity file-sync software, so triage cannot keep "boring middleware" in a lower tier. And patching does not evict an actor who already holds valid credentials. Rotate every app password, token, and admin credential, then check access logs for anonymous WebDAV access and bulk retrieval volumes no user workflow explains.

Nineteen extensions, same failure, different store

Eighteen Chrome extensions and one Edge extension carried wallet-secret exfiltration and active drainer logic, surviving official store review for roughly six months. The primitive matters more than the target: all-URLs host permissions plus clipboard access read whatever the browser reads, including SSO session cookies. Wallet theft in one campaign is session theft in the next. The control that holds is an allowlist with sideloading blocked. Anomalous session reuse shows up first in the identity provider log.

Where the reporting converges

Set these three items against the containment argument from Microsoft's Igor Sakhnov, carried in both CSO digests: reduce exposure before patches land. The exploited assets here were privileged, internet-adjacent, and running software with a mass-exploitation history. PaperCut and ownCloud sit in the class of repeat offenders that get compensating controls: removed external reachability and hard segmentation, rather than a faster patch SLA.

Not in the reporting: CVE identifiers, affected build ranges, CVSS scores, or the KEV remediation due date. Scope built on summaries will be wrong in both directions. The vendor advisory and the KEV entry make the work auditable, and pulling them is a ten-minute task.

A patched inventory is a claim about an earlier cycle. The build number on the host is the only field that can dispute it.

Where per-task filtering fails by design

A guardrail that evaluates one invocation at a time carries no state between invocations. An operator who keeps each individual step innocuous never crosses a threshold, because no threshold spans the sequence. That holds for hostile operators and merely misaligned ones alike. The corrective pattern in the same research set is accumulated-risk accounting: a persistent monitor that holds state across sessions and enforces a per-identity budget of irreversible actions (writes, deletes, payments, configuration pushes, external sends), hard-failing at the cap. This is an authorization control, and it lives in a different team's backlog than prompt filters do.

The four bodies of reporting give three different answers on where the control belongs

The disagreement decides sequencing, which is why it is worth naming. One line of reporting puts the fix in network containment. Another puts it in a pre-deployment governance gate with a named accountable owner. The empirical papers put it in an authorization budget. Two accounts of agent incidents put it in non-human identity inventory. For operational technology, segmentation wins on one property alone: physical damage does not restore from backup, so the control with a guaranteed ceiling is the one that removes reachability.

The inventory that produces the answer

The inventory covers every service account, CI runner, automation host, and MCP or tool-calling server with a routable path to PLC, HMI, or historian VLANs. Isolation diagrams go stale. Shops that have actually bounded this run a path test from the agent's own network position and compare the result to the diagram. Where a path is required, it gets brokered through a jump host with human approval and full command logging on write operations. This is unglamorous asset work. It is also the only item on this list that bounds a physical-damage scenario.

Containment speed is the second number

CSO's reporting calls the traditional 24-hour incident response model dangerously slow against agents operating at machine speed and proposes a 15-minute containment target. Separate accounts of agent incidents argue the real measurable is time-to-halt, with a named owner and a documented authorization path. Both land in the same place operationally. If revoking one agent identity's tokens and tool scopes requires a bridge call to assemble, what exists is an escalation procedure wearing a kill switch's label. The teams that know the difference have timed a single-command revocation against one production agent identity and written the number down.

Discount where discounting is due: these are papers surfaced ahead of peer review, with no CVE, no vendor advisory, and no independent reproduction. Treat it as pre-CVE attack-surface intelligence. It is actionable because the mitigation is architectural. No patch cycle will deliver this one; the work is design work, and it is available now.

Physical damage does not restore from backup, which makes reachability rather than prompt filtering the only agent control with a guaranteed ceiling.

The failure mode is silent, not broken

A control that loses its input does not alarm. URL filtering, network data-loss prevention, TLS-inspection policy, and guest Wi-Fi enforcement all read the plaintext server name in the TLS handshake to decide what a connection is. Encrypt that field and the rules keep evaluating, keep passing their health checks, and match nothing. No ticket, no failed policy, no dashboard change. The gap surfaces months later in an incident review, when someone asks which destination a host actually talked to. The Hacker News reports that Android 17 makes Encrypted Client Hello an operating-system default, which puts a clock on that, because adoption follows a device-refresh curve rather than a decision you get to make.

The second removal arrives with a business case attached

Exponential View's telemetry shows open-weight models taking 62% of daily tokens on Vercel, up from 28% two months earlier, with Chinese-origin weights as the default substrate. Thomson Reuters built its first in-house model on Qwen explicitly to cut cost. Bridgewater, working with Thinking Machines, fine-tuned an open Qwen model that beat every frontier model it tested on internal information filtering, with roughly 30% fewer errors at about one-fourteenth the inference cost. At that ratio the decision lands in a pull request, not a vendor review. The security consequence is an inversion most AI policies never encode: self-hosting weights removes the cross-border transfer and the egress log at the same time, while importing an unsigned binary that executes code on load.

Local inference produces no network event at all

A 27b model now runs offline on a desktop Mac. Every AI data-loss control most teams own — forward proxy, CASB, prompt logging, inline inspection — assumes egress at the moment of prompting. Source code, customer records, and unannounced deal material can be summarized and restructured with no network event, no vendor log, and nothing to subpoena during an investigation. For a departing engineer, that is the cleanest exfiltration primitive to appear in years, and it is a free download.

Where enforcement has to move

Here is the connection worth holding: the fallback control everyone reaches for — egress policy governing which inference endpoints a host can reach — is exactly what ECH degrades. The evidence that endpoint reachability, not vendor policy, is the real boundary comes from a documented case in the DevOps reporting: an individual spent $266 across four models over five months to defeat a Fire HD kiosk lockdown. Claude refused on safeguard grounds, so the author routed through Kimi K3, GLM-5.2, and GLM-5.3 until one surfaced the unpatched GPU path, CVE-2022-38181, and produced root. Model refusal produced vendor substitution, nothing more.

1. Write EDR detections for ollama, llama-server, lm-studio, mlx_lm, and text-generation-webui execution, plus file-write alerts on single files over 4GB with .gguf or .safetensors extensions in user profile directories, routed to insider-risk triage rather than the general queue.
2. Require safetensors, block .bin, .pt, and .pth artifacts at the gateway, verify publisher hashes, and load new weights only in an isolated build stage. Pickle deserialization is arbitrary code execution by design, mapping to MITRE ATLAS AML.T0011 for unsafe machine-learning artifacts.
3. Name an endpoint or identity-layer replacement for every control that currently keys on SNI or DNS inspection, and record it before the fleet refresh, not after.

Nothing was hacked here: a phone default and a cheaper model each removed an observation point, and your policies will keep reporting healthy while enforcing nothing.