The Watch

What Conductor holds

Orkes Conductor is a workflow orchestration control plane. It schedules and executes jobs against other systems, so its workers carry the credentials those jobs need: cloud role assumptions, database logins, CI tokens, artifact-signing material. A pre-authentication flaw here outranks the same flaw class in a web application because the attacker needs no account and no stolen key to reach a process that already holds every key. The Hacker News reports Fortinet confirmed exploitation in the wild. Fortinet did not publish affected version ranges, patch identifiers or indicators of compromise. Only the vendor advisory carries the version scoping for this wave.

Kernel local root moves to the front of the queue

Kernel local privilege escalation normally sits in a second-tier queue, on the assumption that the attacker lacks a foothold. Two disclosures this week supply one. CISA added three Linux kernel flaws to its Known Exploited Vulnerabilities catalog, and a researcher published working exploit code for four more, each granting local root. Either set combined with an unauthenticated entry point yields root on a node inside the orchestration and build tier, which stores CI credentials and cloud role assumptions.

The scoring gap that misroutes the ticket

CVE-2026-58138 scores 9.8 under CVSS v3.1 and 9.3 under v4. Many vulnerability management pipelines still key SLA tiers to a single scoring version, and any threshold near 9.5 routes an actively exploited pre-auth RCE into a slower queue. Teams mid-transition are taking the higher of the two values and checking which version the scanner feeds the ticketing system before trusting the tier it assigns.

Where the sources converge

The Hacker News frames these disclosures as a kill chain assembled from independent pieces. CSO First Look's reporting on network and identity infrastructure makes the complementary argument: research is concentrating on systems that are internet-reachable, rarely carry endpoint detection, and sit above the trust boundary. SolarWinds Access Rights Manager fits the pattern, with a hard-coded key enabling unauthenticated RCE in the product that governs who has access to what. Hard-coded key bugs are the fastest class to recover from a patch diff. Expect working exploits within days of the patch. Appliances in this class also rarely emit telemetry the owner controls, so evidence of a clean box may be logs an intruder could edit.

Residual risk after patching

Exploitation is confirmed. Patching closes the entry point; it does not remove an intruder already resident. Rotation comes before hunting: every service token, cloud role secret and database credential a Conductor worker can reach, then anomalous worker and task creation plus unexpected outbound traffic from orchestrator hosts. Behavioural signals hold across variants; payload signatures do not. The signals here are unexpected child processes from orchestrator services, new kernel module loads and setuid abuse.

Working exploit code for four kernel flaws is public, so every service-tier code execution finding in the backlog is a root finding on orchestration and build hosts.

What the device authorization grant is for

The OAuth 2.0 device authorization grant exists for interfaces that cannot take a typed password: printers, smart TVs, CLI logins on headless machines. The device displays a short code. The human enters that code in a normal browser and approves. GhostCode inverts the roles. The attacker starts the flow and the victim completes it, so the page the victim sees is Microsoft's own, the MFA prompt is real, and the approval is genuine. When the victim finishes, the attacker's polling client collects the access and refresh tokens, per CSO Update's reporting.

Why existing controls do not register it

• Authentication happens on legitimate Microsoft infrastructure. There is no malicious domain to block or report.
• Sign-in logs record a successful, MFA-satisfied login by the real user. The flow produces no failed-authentication signal.
• No credential is exposed. A password reset leaves the tokens the attacker holds fully valid.
• Persistence lives in device state. CSO Update reports the kit registers an attacker-controlled device in the tenant, which then presents itself to access policy as a normal enrolled endpoint.

Eviction takes two actions most runbooks omit

Closing this requires a Conditional Access change and a hunt, in that order. Blocking the device code flow tenant-wide with a small, named exception group is a configuration change measured in hours, and it removes the attack path outright. The hunt determines whether there is already an incident: query 90 days of Entra sign-in logs for device-code authentications and correlate each one against device registration events. Treat any device-code sign-in that cannot be tied to a genuinely input-constrained device as an incident. For each hit, revoke refresh tokens and deregister the device. Then harden the registration path: restrict registration to compliant or hybrid-joined devices, require MFA to register, and alert on first-seen registrations. Registration then fails unless the device is already compliant.

How much of this is confirmed

Be precise about confidence before briefing anyone. GhostCode is named in a single trade report, with no CVE, no affected build numbers and no published indicators. The underlying flow works as designed, so there is nothing for Microsoft to patch. Adjacent reporting points the same way, but the kit is still one trade report. CSO First Look describes threat groups stealing cloud inference API keys and running workloads inside victim tenants. The Hacker News describes researchers pivoting through AI SaaS accounts into an internal source repository. All three reports involve stolen tokens rather than stolen passwords. The controls that apply here are token lifetime and device registration policy.

Containment is revoking the refresh tokens and deregistering the device.

What survives an offboarding you already signed off

Walk the CrowdSec sequence backwards, because the privilege half of it is close to universal. An external npm compromise supplied the access; the still-live GitHub account of a departed employee supplied the reach. Version control identities are usually personal accounts granted organization membership, so disabling the identity provider user does nothing to them. Nor does it revoke personal access tokens, SSH keys, deploy keys, or OAuth and GitHub App grants issued under that account. Your HR termination record and your source control access list are two systems, and in most organizations nobody reconciles them.

The dependency half is not CrowdSec-specific

TanStack libraries are pervasive in React front ends, so "we are not a CrowdSec customer" is not a scoping answer, as The Hacker News points out. The work here is a query, not a project: search your SBOM for TanStack packages and transitive pulls, review build logs across the compromise window, and rotate any CI secret that was exposed to an affected pipeline. Revisit dependency alerts your teams closed in May while you are in there.

The disclosure gap is a contractual finding, not a technical one

Roughly 120 days passed between the theft and the September 18 disclosure. For anyone ingesting CrowdSec's threat intelligence feeds, that is four months of consuming data from a vendor with an unresolved source-code compromise. No control in your stack would have closed that gap. A breach-notification SLA with a defined window belongs in every security vendor contract you renew, because the alternative is discovering your intelligence supplier's incident a third of a year late.

The same identity gap runs through your AI tooling

The Hacker News reports that three researchers at Hacktron used Claude Opus 5 to chain two separate flaws into takeover of several OpenAI employees' ChatGPT and Codex accounts, then reached an internal OpenAI code repository. Read past the vendor rivalry and look at the mechanics. The target was a security-mature frontier lab, the exploit was a chain of two individually unremarkable flaws, and the team was three people. Two consequences follow for your program. First, AI-assisted chaining has collapsed the effort your AppSec triage assumes when it defers medium findings for low exploitability — re-weight findings by chainability rather than isolated severity. Second, AI SaaS accounts are an identity path into source code. If ChatGPT, Codex, Claude or Gemini access exists outside SSO with SCIM deprovisioning, you have an unmanaged route into your monorepo that identity threat detection does not cover.

The uncomfortable pattern

The compromised parties in this reporting are a security vendor and a frontier AI lab — organizations with better-than-average programs and real security staff. Security maturity is not immunity, which is the right discount rate to apply to any vendor trust narrative that arrives without measured results attached.

An offboarded employee's source control account is a standing credential with no owner, no expiry and no alert attached to it.