ClarityBeta

Security & Threat Intelligence

The Watch

8 min read · 1,533 words · 3 moves to watch
The Signal

CVE-2026-93616 lets unauthenticated attackers rewrite Check Point firewall policy.

Directory traversal into script upload on the Security Management Server. Perimeter logs will look clean. The artifact is 30 days of policy pushes, so the retention setting on your change history decides whether this is investigable at all. F5 and Arista management gear came under active attack the same day, which puts three management planes in the same morning's queue.

In Play

  1. Three Perimeter Appliances Exploited At Once

    Unauthenticated zero-days in Check Point, F5 and Arista management gear are under active exploitation, alongside new Veeam and Zyxel KEV entries — today's first deep dive has the patch sequencing and hunt queries.

    Ask Clarity
    Try

  2. Signed And Attested Code Became The Delivery Layer

    A Microsoft-attested kernel driver, the first malware on the Terraform registry and an npm payload hidden in a library function all cleared signature and install-hook checks — see the deep dive on attested code as a delivery layer.

    Ask Clarity
    Try

  3. AI Coding Clients Are Shipping Whole Repos Offsite

    Z.ai's ZCode client packaged a developer's commercial project, full Git history included, into an encrypted archive bound for vendor-controlled cloud storage — the deep dive covers detection, scoping and rotation.

    Ask Clarity
    Try

  4. Revoking The Token Does Not End The Incident

    TLDR IT describes implants that atomically replace their whole credential set and swap OneDrive command-and-control identity from one remote task: the app registration and its client secrets, not the token, are the durable object of compromise. CyberScoop adds that Microsoft's EvilTokens takedown seized 50 sites and 175+ domains after 12,000+ mailboxes across 10,000+ organizations were hit — but roughly 1,000 criminal customers were never arrested and are shopping for successors.

    Ask Clarity
    Try

  5. Redundancy And Control Inheritance Nobody Verified

    Morning Brew reports the FAA's New Jersey backup air-traffic radio system was already dead from an accidental fiber cut, and nobody knew until the Philadelphia primary failed — five airports degraded and 430+ flights cancelled. The Information separately reports Anthropic is in early talks to lease up to 1GW directly from Apollo-owned Stream Data Centers, which would break the hyperscaler control inheritance most Claude vendor assessments quietly rest on.

    Ask Clarity
    Try

Deep Dives

The Management Plane Is The Target, And Your Severity Feed Is Lying

Four appliances that terminate access or hold policy are being exploited, while a vendor-assigned 6.5 and a patch that shipped before exploitation show where triage itself failed.

Order the patch queue by what the attacker gets, not by CVSS. On Check Point's Security Management Server, unauthenticated directory traversal leads to script upload and execution on the system that authors and pushes your firewall policy. That is not a perimeter bypass; it is the ability to write the rules. F5's BIG-IP APM flaw is config-dependent — it requires an access policy with an OAuth profile configured — so a single enumeration query separates an emergency from a non-event. Arista's on-prem VeloCloud Orchestrator grants unauthenticated access to internal functions across the SD-WAN fabric.

All three share the property that makes them attractive: they rarely run EDR, they hold broad internal reachability, and their logs are reviewed only during change management. Patching closes the door but does not evict anyone.

Where the reporting converges

Risky.Biz frames this as a perimeter emergency across security and networking appliances. The Hacker News shows the triage layer breaking: Microsoft initially classified a SharePoint Server flaw as a spoofing issue at CVSS 6.5, and researchers then published details proving authenticated remote code execution — and on SharePoint, "authenticated" usually means any domain user. CSO Update adds the pattern signal: two critical Cisco zero-days landed in a single week, which reads as concentrated offensive research on identity and network-access products rather than coincidence.

The most damning item operationally is the Zyxel GS1900 entry in CISA's KEV catalog, because the vendor fix already existed when exploitation was confirmed. That is deployment latency, not vendor negligence — and access-layer switch firmware is exactly the inventory most teams cannot produce on demand.

The backup platform problem

Veeam flaws under active exploitation delivering SYSTEM-level access deserve separate treatment because they invalidate an assumption, not just a control. Every ransomware recovery plan presumes the backup platform survives the incident. A backup server that can delete its own restore copies is a single point of failure wearing the costume of resilience. The test is narrow and answerable now: is there one immutable restore copy the backup server itself cannot delete, and has anyone restored from it?

What the smart move is

Sequence by blast-radius reduction per hour of effort. Check Point is first because policy-plane compromise is self-perpetuating. The F5 enumeration query is second because it is cheap and may scope you out entirely. Arista's management interface belongs behind an admin-only segment regardless of patch state, validated by an external scan rather than a config file. Then pull SharePoint out of whatever medium-severity bucket a 6.5 routed it into and retro-hunt w3wp.exe spawning cmd.exe or powershell.exe across every farm — you now need to prove nothing happened during the deprioritization window.

Three of the appliances bought to defend the perimeter are being exploited through it, and a vendor severity score is what kept one code-execution bug in a ninety-day queue.

The durable fix is a policy change, not a patch cycle: document that vendor CVSS is one input alongside independent exploitability research, reachability, asset criticality and KEV status, with an auditable override path. These events will be cited in your next assessment either way.

What to do

  1. Patch Check Point Security Management Server for CVE-2026-93616 today, then audit the last 30 days of policy pushes for changes with no matching change ticket.

  2. Enumerate every BIG-IP APM access policy with an OAuth profile configured before end of day, patch matches for CVE-2026-94127, and decouple the OAuth profile where a patch window slips past 48 hours.

  3. Re-triage the SharePoint Server flaw as authenticated RCE this sprint and hunt w3wp.exe spawning command shells across all on-prem farms.

A Microsoft-Attested Driver Turned Your EDR Into A Policy

Publisher signatures, install-hook scanning and agent dashboards all reported healthy while a commodity kit disarmed endpoints from kernel mode and a library function carried a payload past dependency review.

The execution chain matters more than the malware family. Every stage abused a trust primitive most programs still treat as a control. LastPass's TIME team caught the kit on August 13, through brand monitoring, not a product flaw, after a fraudulent GitHub organization impersonating LastPass Authenticator was SEO-boosted into search results. The download was a 148 MB Zip, large enough to discourage sandbox submission. Inside sat a legitimately signed copy of the Microsoft Visual Studio debugger, renamed to sideload a malicious vsdbg.dll.

Next stage, defense evasion: Alinubx.sys, a Microsoft-attested kernel driver that registers itself as the NVIDIA NvFSFIler service. It terminates 145 antivirus and EDR processes from kernel mode and re-kills any agent that reactivates after reboot. Two controls failed at once. Publisher-signature allowlisting passed the loader. EDR stopped being a source of ground truth because it was killed from below.

The same evasion logic appears in three ecosystems

Aikido found the first known malware on the Terraform registry: two providers and two Go modules. The implant is a Go port of February's Graphalgo npm implant, using a Slack channel as command-and-control per Risky.Biz. Terraform providers are the highest-privilege code path in most organizations, running with cloud-admin credentials on engineer laptops and CI runners. The C2 is Slack, which egress filtering almost never blocks.

CSO Update and Computerworld both report a malicious npm package that reached 2M+ weekly downloads by moving its payload out of the install script and into an ordinary library function. That is a deliberate response to the defensive consensus. --ignore-scripts, npm 11 defaults and Renovate hardening all inspect the wrong lifecycle phase. Download count failed as a trust signal too.

Detection engineering is the only lever. None of the three ship a fix.

The compromise is visible only as absence. The observed signals are an EDR agent on a workstation that stops reporting, and a CI build container that opens an outbound connection with no history behind it. Most SOCs treat "agent stopped checking in" as an asset-inventory ticket. On these facts, silence is the alert.

A Microsoft-attested driver with zero VirusTotal detections terminated 145 security processes on real endpoints. Hosts that ran an unvetted official installer should be treated as silently disarmed.

Teams already working this are making absence page-worthy and extending supply-chain controls past npm. Terraform providers and Go modules get pinned and hash-locked, mirrored through an internal registry, with retro-hunts across build-agent egress for Slack-webhook traffic. On the endpoint side: HVCI with the Microsoft vulnerable-driver blocklist, movement toward an explicit third-party driver allowlist, and Sysmon Event ID 6 driver-load events shipped into the SIEM against a baseline. The driver carried a Microsoft attestation signature and scored zero detections on VirusTotal.

What to do

  1. Hunt fleet-wide today for Alinubx.sys driver loads, a service named NvFSFIler, unexpected vsdbg.dll sideloads, and Visual Studio debugger binaries running outside developer install paths.

  2. Make EDR silence a P1 this sprint: alert on agent heartbeat loss and tamper-protection events, then validate by stopping an agent in a lab segment and measuring time-to-alert.

  3. Replace install-hook blocking as the primary npm control this quarter with default-deny egress on CI runners plus process-spawn alerting from build containers.

Your Developers Installed The Exfiltration Channel Themselves

Two vendors in twelve months shipped clients that silently uploaded whole repositories, and the newest agent features move uncommitted working trees and untrusted instruction files into the same trust boundary.

The 313MB archive of the developer's commercial project was encrypted with a private key held only on Z.ai's backend, per Pivot 5. Neither the developer nor the client can decrypt it. That is the forensic property separating this from an ordinary breach. Z.ai says uploaded data is destroyed once a Wiki page is generated, a claim that is unverifiable by design. There is no evidence base for scoping or containment, so the response is worst-case assumption and full-history rotation.

The data class matters. The bundle included full Git history, not just the working tree. Git history retains every secret ever committed and removed in a follow-up commit, so HEAD-only secret scanning misses all of it. Pivot 5 documented 564 upload retries with no backoff. High-count, identical, failed outbound attempts from a single developer process is the most transferable detection signature in the material, and none of it surfaced in the client UI.

Where the sources agree, and where the pattern widens

The Information AM supplies the precedent. xAI's Grok Build was caught doing the same thing earlier in 2026. Both vendors remediated the same way, by open-sourcing the client. Open-sourcing the client says nothing about what the server does.

Claude Code 2.1.277 reads AGENTS.md when no CLAUDE.md exists in the folder path, per Unwind AI. The read is a fallback; the two files are never combined. A Markdown file in any cloned third-party repository therefore becomes governing policy for an agent holding filesystem and shell access, and review pipelines classify Markdown as documentation. Cognition's Devin /handoff pushes local context, the branch and uncommitted changes, meaning .env files, onto a vendor VM that keeps running after the laptop closes. ben's bites reaches the same conclusion from the tooling side: agent config is executable configuration that nobody reviews.

What actually detects this

Content inspection does not reach this traffic. The DLP saw a signed developer binary sending an encrypted blob to a cloud endpoint, which is what every legitimate dev tool looks like. The signals that survive are volume and destination: novel outbound endpoints from IDE and AI-assistant process lineages, anomalous upload volume from developer subnets, and the repeated-failure retry pattern.

The measurable control is whether encrypted uploads from a signed developer binary are detectable. For most teams they are not.

A confirmed install counts as a source-code disclosure of unverifiable scope, and rotation has to run against full history rather than HEAD. The procurement gap closes only on a gate set that can be verified: documented telemetry scope, opt-in indexing only, customer-held or local keys, documented egress endpoints, and audit rights, with enforcement sitting in application control.

What to do

  1. Sweep every developer endpoint for ZCode and Grok Build via EDR and software inventory this week, and push DNS and proxy denies for both vendors' upload endpoints.

  2. Run full-history secret scanning and rotate every credential, API key, signing key and token ever committed to any repo present on a host that ran an affected client.

  3. Add AGENTS.md, CLAUDE.md and agent skill paths to CODEOWNERS with mandatory security review this sprint, and alert on any diff across all repos.

The bottom line

The same defect recurs across today's items: provenance was accepted as proof of safety. A signature, a registry listing, a vendor severity rating and an agent dashboard were each technically accurate, and each described something other than the security outcome. That breaks the assumption underneath most remediation reporting — that a control's stated state and its enforced state are the same claim. Spend this week proving enforcement instead of configuration: take your ten most load-bearing controls and demand one enforcement event apiece from the last thirty days, starting with whatever would have told you an endpoint agent went quiet.