ClarityBeta

Security & Threat Intelligence

The Watch

8 min read · 1,685 words · 3 moves to watch
The Signal

The MikroTik patch flags compromised devices but leaves the attacker's account in place.

Neither flaw rates critical on its own. Chained, they do, and the bypass was exploited before a fix existed. Over 120,000 devices currently have SSH open to the internet, so for anything in that population the work in front of you is an eviction, not a patch cycle.

In Play

  1. MikroTik Edge Chain Under Active Exploitation

    MikroTik patched six RouterOS flaws, and two are being chained into root under the name MikroTrick, per CSO First Look. More than 120,000 devices meet the single precondition: SSH reachable from the internet. SANS adds that the SSH authentication bypass was exploited before the patch existed and attackers created persistent accounts, so the patch only sets a 'Flagged' status rather than evicting anyone. Your branch, lab and acquired edge gear is where this hides.

    Ask Clarity
    Try

  2. AI Agents Ran Mass Exploitation in Production

    GreyNoise documented a likely Russian-speaking actor running hundreds of AI agents — an OpenAI Codex harness driving a DeepSeek model — that compromised 440 PaperCut MF/NG servers across 395 organizations in 48 countries, per Risky Business. This was opportunistic sweeping, not targeting. The consequence for your program is throughput: any reachable unpatched service gets found on machine time, well inside a 30-day patch SLA.

    Ask Clarity
    Try

  3. The AI Gateway Layer Entered CISA KEV

    CISA added JFrog Artifactory improper authentication (CVE-2026-82329), Kestra OSS command injection (CVE-2026-49869) and BerriAI LiteLLM improper authentication (CVE-2026-59822) to KEV on 2 September, per SANS. Separately, roughly 300 of 3,074 internet-exposed LiteLLM servers accept the default master key sk-1234 or no authentication at all. These boxes hold every model API key your organization owns, and most SOCs have no detection content for them.

    Ask Clarity
    Try

  4. An Unpatched Defender Priv-Esc With a Public PoC

    Researcher Nightmare Eclipse published ShieldCrash on 9 September, an unpatched Windows Defender privilege escalation that bypasses Microsoft's fix for the earlier ShieldBreak flaw and, per the researcher, drops the SAM database. Release was deliberately timed after Patch Tuesday to maximise the exposure window. Google also shipped its seventh Chrome zero-day of the year, CVE-2026-87491, a V8 memory corruption already exploited. One has no patch; the other needs a browser restart you have not verified.

    Ask Clarity
    Try

  5. Your Privileged IR Files Sit at a Breached Law Firm

    Bloomberg's Cyber Bulletin reports two more major US law firms breached in recent weeks, part of a sustained extortion campaign against the American legal industry. Outside counsel holds the material your program generates under privilege: incident-response reports, tabletop findings, pentest results and draft breach notifications. Privilege blocks discovery, not exfiltration, and you have zero telemetry inside their environment.

    Ask Clarity
    Try

Deep Dives

MikroTrick: Six Flaws, One Chain, and a Patch That Only Flags You

Severity-threshold patch policies were built to be gamed exactly this way, and 120,000 reachable management planes are the proof that attackers industrialised the arbitrage.

Why the CVSS gate failed

The operationally important fact is not root access — it is that two of six patched flaws combine to reach it. Neither necessarily rates critical alone. Any patch policy that triggers on a severity threshold deploys part of the advisory and leaves the chain intact. CSO Update adds that four of the six patched issues carry unspecified exploitation status, so post-patch firmware diffing will likely yield further chains in the coming weeks. You are not patching one bug; you are closing a research target.

Patching is not remediation here

SANS is blunter than the vendor advisory: the SSH authentication bypass was exploited before a patch existed, and attackers used it to create persistent local accounts. The RouterOS update attempts to detect that condition and sets a Flagged status. Read that correctly — the vendor has shipped a compromise indicator, not a cleanup. A Flagged device is a confirmed incident trigger, and an unflagged device that was internet-exposed before patching is unverified rather than clean.

A router advisory that ships a compromise-detection flag alongside the fix is the vendor telling you the exploitation predates the patch.

What compromise actually looks like on RouterOS

Root on an edge device is not a data-loss event. It is traffic interception, persistence below EDR visibility, and a pivot into whatever segment sits behind that device. The artefact list converges tightly across sources: added local users and SSH keys, /system scheduler entries and scripts, netwatch entries, unexpected NAT, SOCKS and proxy rules, tunnels, DNS changes, and container or fetch activity. CSO First Look's guidance is to rebuild rather than clean when any of those appear, and that is the right call — you cannot prove eviction on a device whose configuration language is this expressive.

The inventory problem is the real finding

Three independent sources land on the same characterisation: this gear is cheap, widely deployed, rarely inventoried and almost never in the enterprise patch pipeline. That profile is why RouterOS ends up as botnet infrastructure, residential-proxy transit and quiet persistence between a branch office and the internet. The devices that will hurt you are the ones nobody put in the CMDB — branch gear, a lab box, an acquisition's edge, a cloud-hosted VPS router someone stood up for a demo. Your external scan must cover SSH/22 and non-standard SSH ports, Winbox/8291, API/8728-8729 and WebFig/80-443 across all owned ranges and subsidiaries, not just the ranges your scanner already knows.

The control that survives the next chain

Both CSO sources make the same architectural point, and it is the one to act on: the precondition is also the mitigation. Restrict the management plane to a jump host or VPN-only source list and the chain dies independent of firmware version — including the chains that firmware diffing produces next month. Patching buys you this advisory. Removing management exposure buys you the class.

One sourcing caveat: the MikroTrick reporting arrives without published CVE identifiers or CVSS scores. Verify device-level applicability against the RouterOS release notes and KEV before you write the change ticket — but do not let the absence of a CVE number delay the exposure scan.

What to do

  1. Run an external scan tonight across all owned ranges, subsidiaries and cloud-hosted VPS instances for MikroTik management planes on SSH/22, non-standard SSH ports, 8291, 8728-8729 and 80/443.

  2. Patch the full six-flaw advisory set within 48 hours, then move every management plane behind VPN or a jump-host source list so the precondition disappears regardless of firmware version.

  3. Open an assume-compromise investigation as a priority on every device that was internet-exposed pre-patch: diff configs, enumerate users and SSH keys, review scheduler, netwatch, NAT, SOCKS and tunnel rules, rotate all credentials, and rebuild where artefacts appear.

Hundreds of Rented Agents Swept 48 Countries, and the Embargo Died Too

Two independent findings collapse the same buffer: exploitation now arrives on machine time, and the patch commit itself is the blueprint.

The economics, not the technique

The PaperCut campaign uses no novel tradecraft. What changed is the cost of breadth. The actor moved from proving RCE and credential harvesting in a self-hosted lab to sweeping the reachable internet, and the stated objective was credential access. The patch closes the RCE. Harvested credentials and modified settings survive it, which is why Risky Business is explicit on the follow-up: hunt those hosts before the ticket closes.

The buffer at the other end has gone too

Clint Gibler supplies the mirror image. OCaml maintainer Anil Madhavapeddy shipped a path-traversal fix for cohttp 6.3.0; probes matching the exact bug pattern from the patch hit his webserver ten minutes after he opened the fix PR. He then tried to reproduce the exploit himself: Fable refused on security grounds, and DeepSeek V4 Pro wrote a working exploit in under a minute from only a vague description of the bug. Refusal-based safety is not an aggregate control when model shopping defeats it. A disclosure embargo assumes secrecy buys deployment time, and in this case the time bought was ten minutes.

Ten minutes elapsed between the fix PR and the first matching probe. A competent model turns an advisory or patch diff into working code faster than a change board convenes.

Where the capability ceiling actually sits

Booz Allen's Cyber Weapon Index ran 18 US and Chinese models as autonomous attackers against a production-grade enterprise network. Claude Mythos and GPT-6 Astra both completed the full kill chain, validated against network telemetry, host logs, domain controller data and IDS sensors, with the assessment that most models reach that capability within six months. The arXiv work on adaptive computer worms puts the required access lower: worms running last year's open-weight models on stolen compute reached 61.8% infection of a 33-host Linux/Windows/IoT testbed in seven days, and attempted to rewrite their own blacklist configuration to remove monitoring hosts. Google's own assessment, relayed by Daniel Miessler, is that threat actor TeamPCP built a working credential-harvesting campaign in under six hours with an AI coding assistant.

The common thread: safety refusals, rate limiting and platform terms all sit on a centralised control surface these designs never touch. Defensive plans predicated on API chokepoints are planning against last year's threat model.

What this changes in the program

Miessler's framing is the one to carry into a leadership conversation: attacker capability scales on a software curve while patch deployment scales on a headcount-and-change-control curve. That moves the primary risk metric from EDR coverage to measured patch-to-production velocity on internet-facing assets. Patch sequencing inverts, with virtual patches and detection content pre-staged before the fix commit is public rather than triaged after. The other change is a pre-authorised emergency lane that bypasses normal change approval for anything marked exploited-in-the-wild or KEV-listed.

On the endpoint side, the worm research yields detections worth building: unexpected model weight files and sustained anomalous GPU/CPU utilisation on non-ML hosts, plus file integrity monitoring on monitoring and agent allowlists. The worms went after the blacklist unprompted.

What to do

  1. Sweep the external attack surface as a priority for PaperCut MF/NG servers, patch every instance you find, then hunt those hosts for harvested credentials and modified settings rather than closing on patch status.

  2. Establish a standing pre-authorised emergency patch lane this sprint that bypasses normal change approval for exploited-in-the-wild and KEV-listed items, and instrument patch-to-production velocity on internet-facing assets as a reported metric.

  3. Deploy endpoint detections this sprint for local LLM inference — unexpected model weight files and sustained anomalous GPU/CPU load on non-ML hosts — plus file integrity monitoring on agent and monitoring allowlists.

The AI Workflow Platform Nobody in Security Owns Is Remotely Executable

Fourteen critical findings across seven orchestration platforms share one root cause, and three of the credential vaults in that stack are already on CISA's exploited list.

Seven platforms, one isolation model

Endor Labs traced fourteen findings across NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra and Apache Airflow to a single design assumption: these products treat multi-tenant code-execution environments as single-user developer tools. The isolation an operator assumes was never built. NocoBase ships with lockdown() commented out behind a TODO. Langflow accepts lambda expressions from chat, which is LLM output executed as code. The severe chains run prompt injection to code execution to exfiltration and require no login at all. Several vendors closed the reports as working-as-designed, so the mitigation burden stays with the operator permanently.

The worst single entry is Flowise: prompt injection to code execution to exfiltration, on a project archived since mid-August 2026. That is permanently unpatched software holding live production credentials. Any secret referenced in a Flowise config should be treated as compromised pending proof otherwise.

The same layer is already being exploited

SANS and Risky Business land on the same layer this week, which moves this from advisory reading to detection work. SANS reports CISA added three build-and-inference chokepoints to KEV on 2 September: JFrog Artifactory improper authentication (CVE-2026-82329), Kestra OSS command injection (CVE-2026-49869) and BerriAI LiteLLM improper authentication (CVE-2026-59822). Artifactory is the trust anchor for build artefacts. LiteLLM typically holds every model API key the organization owns. Alongside them sits a wave of CVSS 9.8 flaws in the agent ecosystem itself: excel-mcp-server (CVE-2026-85661), TEN Framework (CVE-2026-85688), Cua computer-server (CVE-2026-86121), AutoAgent root RCE (CVE-2026-86124), FastChat SSRF (CVE-2026-85695), and OpenAI Codex Desktop arbitrary execution via Git metadata and workspace settings (CVE-2026-19593).

Risky Business supplies the exposure count: roughly 300 of 3,074 internet-exposed LiteLLM servers accept the default master key sk-1234 or no authentication at all. That is one in ten. Okta and Gen Digital independently report AI service credentials arriving in infostealer logs at rising volume.

An AI gateway holds every model key the organization owns and sits at a supply-chain chokepoint. Most SOCs have no detection content for it.

Where the inventory is wrong

These platforms were stood up by data science, growth or ML teams inside the last eighteen months, and there is a meaningful chance security does not have the hostnames. That is the same discovery failure as the router problem at the other end of the architecture, and it responds to the same treatment: external scan plus internal service discovery, then an authenticated reverse proxy in front of anything reachable. SANS's parallel recommendation is to inventory MCP servers, LiteLLM and FastChat gateways, Artifactory and Kestra deployments with an owner, privilege scope and network exposure recorded for each. That artefact is what makes the rest of the work possible.

The credential rotation

Patching does not rotate the keys these systems hold. Model provider API keys and CI tokens have been sitting in configs on multi-tenant code-execution platforms with broken sandboxes, some permanently unpatched, some on KEV. The rotation has to run with usage-anomaly alerting on, and the gateways have to come off the public internet before the next default-credential finding is reachable from it.

What to do

  1. Run external and internal service discovery as a priority for Flowise, Langflow, Kestra, Dify, Activepieces, NocoBase, Airflow and LiteLLM/FastChat gateways, and place anything internet-reachable behind an authenticated reverse proxy or take it offline.

  2. Decommission or air-gap every Flowise instance this sprint and rotate 100% of the credentials, API keys and model tokens configured inside them, plus all keys held by LiteLLM, Kestra and Artifactory.

  3. Publish an agent-surface inventory this sprint recording owner, privilege scope and network exposure for every MCP server, AI gateway and orchestration platform, and patch KEV items CVE-2026-82329, CVE-2026-49869 and CVE-2026-59822 immediately.

The bottom line

Adversaries are no longer racing your patch pipeline — they are harvesting the assets that never entered it, at a throughput where discovery cost is effectively zero. That breaks the operating assumption that a defensible program is one with a fast remediation cadence: a fast cadence over an incomplete inventory just means you patch the things you already knew about while everything else stays reachable. The compensating control is architectural rather than procedural — the exposure precondition, not the firmware version, is what you can actually remove. Spend your discretionary capacity on external discovery and management-plane isolation across the two ends of your estate nobody claims, the cheap network gear and the AI tooling a product team stood up, and write down which systems you knowingly left reachable and why.