The Watch

A joint FBI and U.S. Secret Service alert, reported by CyberScoop, confirms the FortiBleed campaign is actively compromising credentials on Fortinet firewalls and VPN gateways, with more than 400,000 devices targeted. Attackers create new administrator accounts, lock out legitimate owners, and hand the access to ransomware crews. The compromised edge device is now your perimeter and your control plane in the attacker's hands at once — and patching alone won't remove an admin account that already exists.

The DNS root's key-signing key rolls to KSK-2024 on Sunday, October 11 — only the second root KSK rollover ever, flagged across reporting from TLDR IT, Techpresso and MIT Technology Review. Any DNSSEC-validating resolver still trusting only KSK-2017 (key tag 20326) will return SERVFAIL on every lookup — a total name-resolution outage, not a slowdown. The 48-hour root TTL means failures can surface Monday on returning staff. Verify trust anchors on self-run resolvers, appliances, golden images and DANE mail gateways before the weekend.

Dell patched 18 critical flaws in storage and server-management infrastructure — covering authentication bypass, root access, credential theft, token forgery and remote code execution, per CSO reporting — while Atlassian disclosed CVE-2026-21589, a CVSS 9.3 unauthenticated file read in Data Center products including Confluence and Bitbucket. Both sit beneath your endpoint detection, on the management and web-root planes. The shared trap: patching closes the door but leaves attackers holding any token or secret they already took.

The PoeLLM backdoor has compromised more than 3,400 self-hosted open-source AI servers since April, conscripting them into a botnet of 'AI-enabled proxies' for exploit scanning, crypto mining and remote code execution, per CyberScoop. Its command-and-control hides in a poem on GitHub: four words run through a hard-coded dictionary generate rotating C2 addresses, defeating network IOC blocking entirely. If you run any self-hosted LLM inference, netflow won't catch it — you need endpoint and egress-behavior detection.

The people building AI coding tools are now naming the control failures themselves. OpenCode's founder says engineers aren't reviewing AI-written code, which plateaus at an 80/20 AI/human split (The Information). A frontier agent run with --dangerously-skip-permissions reportedly formatted a developer's C: drive (The Pragmatic Engineer), and Kubernetes co-creators note desktop agents store session IP as JSONL files on disk and act under the developer's own identity (Latent.Space). Your SDLC attestations quietly assume a human read the diff.