The Watch

The blast radius sits below the vendor map

Virtualizor is the panel hosting companies use to provision rented VPS fleets. A poisoned update hands hypervisor-tier access to every virtual machine under that panel, including workloads owned by other tenants on the same host. Marketing sites, staging and acquired-subsidiary infrastructure on rented VPS are fourth-party exposure, rarely on any third-party risk register. The contract is with the hosting provider. The provider's is with Softaculous.

Why every control returned "valid"

Route Origin Validation answers one question: is the origin AS authorized to announce this prefix. The path behind it goes unchecked. The announcement appended Hetzner's AS24940 as apparent origin behind AS62390 and transit AS6204, so the check passed as designed. The /24 was carved from Hetzner's normal /16, so best-path selection preferred it everywhere it was accepted. The certificate side is the same shape: a domain-validated certificate needs only control of traffic to the domain, which the hijack supplied for 33 hours. Where an update channel relies on TLS for authenticity, control of routing is control of authenticity.

The check passed because the attacker left the legitimate origin in the path. ROV only reads the origin.

The evidence problem is the real finding

Virtualizor cannot say how many customers were affected. None of the hijacked traffic crossed its own infrastructure, so there is no vendor-side telemetry to query. It warns that anyone who paid on the site during the window most likely had financial data stolen, while conceding it is unclear whether the operator collected payment data at all. Network analyst Doug Madory confirmed the forged origin publicly on 1 September. That is how the technique became knowable.

For any provider in the estate, "we were not affected" is an assertion, not a finding. The evidence available is an answer to one question: were Virtualizor updates applied between 28 and 30 August. Panels that cannot answer are being treated as compromised, with panel credentials, API keys and anything stored in the panel rotated, and provisioning logs and fleet outbound connections reviewed.

The detection that would have collapsed 33 hours into minutes

Certificate Transparency monitoring on owned domains is the fastest detection here: an unrequested certificate, logged publicly, minutes after issuance. CAA records with account-URI pinning, where the CA supports it, narrow who can issue at all. Both are days of work on infrastructure already owned. Routing monitoring is the slower half: alerts on hijacks of owned and top-vendor prefixes, confirmation that transit providers enforce IRR and peer-lock filtering, and a routing risk register entry noting that RPKI origin validation does not defend against forged-origin path hijacks. Path validation and ASPA fix this on a multi-year deployment timeline.

The pattern this belongs to

Two other items in today's reporting share the property. An endpoint agent misreported its own protection state at fleet scale. Browser extensions that passed vetting at install turned hostile through a routine store update. Different layers, one failure: the check ran and answered affirmatively when it should not have. Controls whose output is a verdict rather than an observation are worth re-testing this quarter.

The platform is a credential vault and an execution engine

ServiceNow stores the secrets used to reach the systems it manages and runs privileged actions against them by design. Connection and credential aliases, OAuth entities and app registrations, MID Server accounts, discovery and CMDB service accounts, integration service principals in Entra ID, and cloud API keys all live inside the platform or are brokered by it. An unauthenticated, zero-interaction flaw there is an unauthenticated flaw across the connected estate. A patched instance still trusts every secret taken before the upgrade, and those credentials stay valid until each owning team revokes them.

Both readings agree on the priority, and both are teaser-level: no CVE identifiers, no affected version ranges, no patch build numbers, no researcher attribution. The version window sits in the vendor advisory. It is not in the summaries, and it has to be matched against local upgrade history.

Where the exposure actually hides

The instances that become breach notifications get checked last: sub-production, sandbox, anything inherited through acquisition or stood up by a business unit outside IT. Non-production instances routinely hold production integration credentials. The hunt, before logs roll off, covers anomalous access to REST table APIs, newly created privileged sys_user records and role grants, modifications to sys_security_acl, new or altered business rules and outbound REST messages, and bulk attachment or table exports. Most teams find out mid-incident that those logs never reached the SIEM. Shipping them permanently is a same-visit fix.

Sequencing decides whether rotation works: issue replacements, then revoke the old secrets. Rotation without revocation leaves the stolen credentials live.

Two other controls that reported themselves healthy

Extensions that were legitimate at install and turned malicious through a routine store update break the premise of every approved-extension list, which is that install-time trust survives auto-update. They run inside the browser's trust boundary, after TLS termination, with permissions already granted. The output is session cookies and OAuth tokens that authenticate downstream as a fully MFA-satisfied user. That is the attack path that survives a passkey rollout. The detection that holds up watches extension version changes and host-permission escalations, evaluated at every update.

Separately, Microsoft is telling users to ignore "Defender is turned off" alerts appearing after an update, while Get-MpComputerStatus returns the true state. Disabling or blinding antivirus is standard pre-ransomware staging. A vendor defect generating that exact signal at fleet scale trains analysts and users to dismiss the alert and corrupts the control-state reporting that feeds Intune device compliance and SOC 2, PCI and HIPAA evidence.

And the tooling itself went down

On 31 August, a single core authentication configuration fault at Microsoft cascaded from Exchange Online into Teams, OneDrive, SharePoint, then into Purview and Defender XDR. ShinyHunters went public with a healthcare data claim inside the same window. That is a documented monitoring-coverage gap, and self-reporting it to an auditor with a timeline and compensating controls beats having it found. It also argues one narrow architectural rule: never let a single vendor own both the control plane and the tooling that monitors it.

The credentials taken before the patch still authenticate after it. Someone has to revoke them, one system owner at a time.

Everything the candidate types is adversary-controlled

The geographic and employer distribution is the useful part of the Endorsed dataset. Flagged applications optimize for the median American software engineer résumé rather than forging anything exotic. California sits at 14.4% and Florida at 7.2%, behind Texas. Hometowns cluster on Dallas, Austin and Houston. Prior employers listed include Amazon, Google and Meta, and more than half carry a LinkedIn profile. Social proof is an adversary-controlled signal with no assurance value.

Endorsed's CEO put the proof on the record. His own CTO, Kevin Fu (raised in a Dallas suburb, UT Austin, career at Microsoft-owned LinkedIn), matches nearly every pattern in the dataset. Name, claimed state of origin, university and prior employer are national-origin proxies. Screening on them creates disparate-impact and Title VII exposure that is more likely to materialize than the infiltration it fails to catch.

The physical requirements do not vary. The corporate laptop must be reachable, which produces a shipping address that differs from the payroll address or lands at a mail drop. The laptop-farm model requires remote-access or KVM-over-IP tooling on a freshly issued endpoint. Facilitator infrastructure is shared, which produces bank-account and routing overlap across supposedly unrelated employees, VOIP-only phone numbers, and duplicate device fingerprints across candidate records. A candidate cannot choose those differently.

Detection should sit on the physical requirements: shipping address, remote-access tooling, banking overlap. The candidate writes the résumé and cannot vary the logistics.

Where the reconciliation actually runs

The retroactive audit across remote technical hires from the last 18 months is four fields: laptop shipping address versus payroll address, post-offer address or bank-account changes, phone number type, and bank-routing overlap across employees. That is a join across IT asset management and HRIS, not a project. The forward-looking control already sits inside the EDR license: a high-severity alert when AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop or IP-KVM behavior appears on a device inside its first 60 days. It is the highest-fidelity control available without a procurement cycle.

The identity provider carries the third layer: a first-90-days new-hire risk profile covering hosting and residential-proxy egress, impossible travel, and sign-in geography inconsistent with the stated work location, routed to the SOC rather than to HR. Default Entra ID and Okta configurations will not surface it, because onboarding noise looks like anomaly noise.

Why the worst case is legal, not technical

The UN attribution is that operatives are compelled into these roles to funnel earnings into North Korea's weapons program. That makes it a sanctions problem the moment payroll runs. A New Jersey facilitator drew a nine-year sentence in April for placing operatives at 100-plus U.S. companies. Facilitators are the designed path around direct-hire controls, so staffing agencies and contractor pass-throughs need contractual attestation to equivalent verification. The insider-threat IR playbook needs a GC-owned branch covering containment sequence, payroll stop and clawback, OFAC exposure assessment, law-enforcement path, and a voluntary self-disclosure decision tree.

Scope creep, and a funding squeeze

The Hacker News extends the picture. These operations have moved beyond IT into healthcare and sales, functions whose hiring managers have zero insider-threat screening maturity and whose roles reach patient records and CRM data. Its recommended counter is cheap and already operationalized: Error-Level Analysis and pixel-noise analysis to detect tampered identity documents, applied at onboarding across every function rather than left to a reviewer glancing at a scanned passport.

Fortune supplies the procurement warning. Identity and access management funding collapsed 62.5% quarter-over-quarter, from $0.8bn to $0.3bn, with PitchBook attributing the pullback to fear of frontier-model commoditization, even as nonhuman identities outnumber humans roughly 45 to 1. One provenance caveat: the 11%-to-44% trajectory is the defensible signal; the 47% absolute rate is a vendor estimate drawn from applications the vendor's own system flagged, by a company selling the remedy. Buyers renewing identity point solutions are underwriting vendor runway alongside the product. Runway disclosure, continuity and escrow clauses, and a specific answer to what the vendor holds that a general-purpose model cannot replicate are what price that exposure.