The Extortion Economy Stopped Encrypting Anything (Aug 4 to 17, 2026)

Cyber Security News

Clop Weaponizes a PTC Windchill Zero-Day and Names Roughly 50 Blue-Chip Victims

Clop listed 43 to 50 organizations on its leak portal, including Shell, General Electric, Philips, and Fiserv, after mass-exploiting CVE-2026-12569, an unauthenticated CVSS 9.8 RCE in PTC's Windchill and FlexPLM product lifecycle management platforms. Stolen material reportedly includes engineering blueprints and facility test reports. No encryption was deployed at any stage: this was pure exfiltration and extortion by email, the same operating model Clop ran against MOVEit in 2023 and Oracle E-Business Suite more recently. Ransom-ISAC identified the Windchill flaw as the intrusion vector; the underlying vulnerabilities became publicly known in July 2026.

Why it matters: Clop has proven the campaign model, not the target platform, is its durable capability, and moving from file transfer to PLM shifts the loot from HR records to design IP and manufacturing process detail.

Sources: BleepingComputer | TechNadu | Tech Insider | heise online

Shell Confirms Investigation Into an 89GB Clop Claim

Shell, with 85,000 employees across more than 70 countries, confirmed it is investigating a "potential incident" after Clop posted the company to its dark web leak site claiming 89GB of exfiltrated corporate data. Shell has engaged third-party responders to assess authenticity. Philips separately confirmed it contained an attempted compromise; Fiserv reported finding no evidence of impact. Barts Health NHS Trust, one of England's largest providers, disclosed a patient data breach traced to Clop exploiting a flaw in its Oracle E-Business Suite deployment during the same window.

Why it matters: Clop is running at least two mass exploitation campaigns against enterprise applications at once, which means parallel zero-day pipelines rather than one opportunistic find.

Sources: Geek Feed | Tarot Norge | Full Circle Cyber

ShinyHunters Breaches RingCentral by Phone Call, Exposing 1.6 Million Accounts

ShinyHunters compromised cloud communications provider RingCentral in July 2026 through a voice phishing call and exfiltrated personal information for 1.6 million accounts, per Have I Been Pwned. RingCentral disclosed on July 28, describing a "sophisticated social engineering campaign" affecting a "limited portion" of customers; ShinyHunters listed the company on its Tor leak site on July 27 and dumped the data after extortion failed. Exposed records include names, email addresses, phone numbers, and physical addresses across a customer base of more than 600,000 businesses. The same crew separately confirmed victims at Vimeo, Carhartt, Sharecare, and Metabase.

Why it matters: A telephony provider breached by telephone is a closed loop, and the stolen contact profiles are precisely the enriched target list the next round of vishing needs.

Sources: BleepingComputer | The Register | TechTimes

France's Tax Authority Confirms 678,000 Taxpayer Records Stolen

France's Direction générale des Finances publiques confirmed a threat actor stole personal data belonging to 678,000 individual and business users of the national tax platform, including names, taxable income figures, and withholding tax rates. Compromised credentials, not an exploited vulnerability, were the access vector. The Paris Public Prosecutor's cybercrime unit opened a criminal investigation on August 15 and handed it to France's Office for the Fight against Cybercrime. The actor first claimed the breach in late June 2026, giving roughly six weeks of unmonitored monetization runway before public confirmation.

Why it matters: An attacker who can quote your exact taxable income is instantly credible on a phone call, which makes this the highest fidelity social engineering fuel any government dataset can produce.

Sources: Security Affairs | Anadolu Agency | EU Today

Lazarus Burns a Windows Kernel Zero-Day for Five Weeks Against Defense and Aerospace

Check Point attributed exploitation of CVE-2026-68820, a use-after-free in the Windows WinSock ancillary function driver (afd.sys), to North Korea's Lazarus Group, which used it for SYSTEM-level access against defense, aerospace, and aviation firms in France, Germany, Brazil, and India. The activity is part of Operation Dream Job, with operators impersonating Lockheed Martin recruiters and delivering trojanized PDF software. Microsoft patched the flaw in an August 2026 Patch Tuesday shipping roughly 398 updates. Two tradecraft details stand out: the operators wrapped C2 in ML-KEM post-quantum encryption, and the FudModule v3.1 rootkit variant zeroes the kernel crash dump block as its first action.

Why it matters: A kernel UAF is a privilege escalation primitive, so anyone exploited during that five-week window already had a foothold, and patching now evicts nobody.

Sources: BleepingComputer | SecurityWeek | Security Affairs | Infosecurity Magazine

Lazarus Deploys RemotePE, a Three-Stage Memory-Only RAT Abusing DPAPI

Fox-IT researchers named Lazarus's new fileless implant RemotePE, a three-stage toolchain of DPAPILoader, RemotePELoader, and the RemotePE payload. The first two stages abuse the Windows Data Protection API to decrypt and stage the final payload, which runs entirely in memory. Because DPAPI binds decryption to the victim host's own key material, the payload cannot be extracted and detonated off-host. The design marks a shift from the noisy financial heists Lazarus is known for toward quiet, long-term access.

Why it matters: Disk-based detection is out entirely; defenders need memory scanning and ETW telemetry on CryptUnprotectData calls to have any chance of catching this.

Sources: KJSC | Zephyrologie

Velvet Ant Sat Inside an Air-Gapped Critical Infrastructure Network for Ten Years

Sygnia uncovered Operation Highland, a China-nexus espionage campaign in which the Velvet Ant activity cluster maintained persistent access to a large organization's isolated, air-gapped critical infrastructure network beginning in 2016, undetected for a decade. The actor achieved durability by embedding itself directly into the authentication process rather than deploying conventional implants or beaconing malware, which is why network-based detection never surfaced it.

Why it matters: Authentication-layer persistence produces almost no telemetry EDR or netflow monitoring is tuned to catch, and it invalidates the assumption that air-gapping buys detection time.

Sources: Mozbot

INC Ransomware Chains Two SonicWall SMA Zero-Days Through July

INC ransomware affiliates spent most of July 2026 working through internet-exposed SonicWall Secure Mobile Access 1000 appliances using a two-bug chain: CVE-2026-15409, a server-side request forgery, paired with CVE-2026-15410, a post-authentication code injection in the wsproxy path. The SSRF supplies the authentication context the injection requires, turning two individually unremarkable bugs into unauthenticated external compromise of a device that bridges the internet and the internal network. Resecurity documented the chain from WSProxy access to root; CISA has added the flaws to KEV, and INC has claimed 885 victims since 2023 while escalating to direct phone calls and emails to victim staff.

Why it matters: Vulnerability triage that scores CVEs independently would have deprioritized both bugs, and ransomware affiliates are now routinely doing the composition work that patch management programs do not.

Sources: isMalicious | CyberScoop | Security Affairs

Gunra Ransomware Draws a Six-Agency Advisory for Exploiting Fortinet Edge Devices

CISA, the FBI, NSA, DC3, the US Secret Service, and South Korea's National Police Agency published joint advisory AA26-222A on August 10 warning that Gunra, a Conti-derived ransomware-as-a-service operation also branded "Golden Community," is targeting government and critical infrastructure across five regions. Affiliates gain access by exploiting internet-facing Fortinet FortiOS and FortiProxy flaws, including CVE-2024-55591, patched roughly 18 months ago, then hijack VDI sessions, steal one-time passcodes to defeat MFA, exfiltrate from SaaS platforms, and encrypt with a Linux payload spinning up to 100 ChaCha20 threads. CISA and the FBI subsequently issued a follow-on advisory specifically warning hospitals.

Why it matters: OTP theft via hijacked VDI sessions means "we have MFA" is no longer a mitigating control for this actor, and a repeat federal advisory inside two weeks means victim counts are still climbing.

Sources: Infosecurity Magazine | WaterISAC | The Hacker News | Dark Reading

Akira Reboots Windows Into Safe Mode to Kill EDR, Then Steals Data After Encryption Fails

Huntress observed an Akira affiliate gain access through an exposed SonicWall VPN lacking MFA on August 4, then reboot the compromised host into Safe Mode with Networking. The reboot took both the Huntress agent and Microsoft Defender real-time protection offline. The encryption phase failed outright, and the operators harvested credentials and exfiltrated data anyway. In a separate incident, Akira listed US firm Cozad Asset Management, claiming 13GB including employee passports, driver's licenses, and Social Security numbers.

Why it matters: This is the clearest available evidence that encryption is now optional to the ransomware business model, and any organization measuring readiness by backup and restore capability would have scored this incident as a successful defense.

Sources: Huntress | BleepingComputer | CSO Online

An Azure Credential Campaign Dumps Employee Directories From McDonald's, Vodafone, and Kyndryl

A threat actor is selling internal employee directories on dark web forums after exfiltrating them directly from victim organizations' Azure tenants using compromised credentials. Named victims include McDonald's, Vodafone, and Kyndryl, with the seller advertising millions of enterprise records across multiple listings. The campaign is credential-driven, not exploit-driven: the data was downloaded from the organizations' own cloud environments using valid authentication, so no vulnerability was exploited and no intrusion registered. Independent victim confirmation is not established in the reporting.

Why it matters: Employee directories are the raw material for the next stage of targeted vishing and helpdesk social engineering against named individuals with known reporting lines, which makes Azure sign-in log review and conditional access enforcement more relevant here than any patch.

Sources: Cyber Security News | InfoStealers

macOS Screen Sharing Bypass Exploited for Root Access and Monero Mining

The Dutch National Cyber Security Centre reported on August 12 that attackers are actively exploiting CVE-2026-65400, an authentication bypass in macOS Screen Sharing, against Macs with port 5900 exposed to the internet. CISA raised the flaw's severity to CVSS 9.8, reflecting that successful exploitation yields remote root. In every case reported to NCSC-NL, attackers deployed Monero cryptomining payloads.

Why it matters: Cryptojacking is the low-value use of a root-level RCE primitive, and macOS fleets are routinely excluded from the internet-exposure scanning applied to Windows and Linux estates, making external port 5900 a scan-and-own condition.

Sources: Tom's Hardware | Yahoo Tech

The FBI Investigates How a North Korean IT Worker Cleared Federal Vetting

The FBI is investigating how a North Korean remote IT worker obtained and held a contract position with an unidentified US federal agency. The probe centers on how the individual cleared identity verification and vetting checks designed to prevent exactly this outcome. Separately, ANY.RUN researchers ran a counter-infiltration operation using a fake DeFi startup to recruit and observe Famous Chollima operatives, documenting forged Western identities, AI-generated application and interview material, mule bank accounts, and AstrillVPN exit nodes.

Why it matters: A federal placement crosses from revenue fraud into a counterintelligence problem, and organizations relying on third-party staffing vendors for identity verification are inheriting a control they cannot audit that is now failing at federal standards.

Sources: IBTimes UK | Odaily | The Hacker News

LiteLLM Credentials Still Live Five Months After a 2,488-Company Supply Chain Breach

Researcher Kevin Beaumont tested credentials stolen in the March 2026 LiteLLM supply chain attack and found "almost every one worked," including at a major US technology company that had told him all credentials were rotated. Hudson Rock obtained a 153GB archive containing 433,909 files tied to the "TeamPCP" campaign, linking nearly 2,500 corporate domains to exposed CI/CD environments across technology, industrial, financial, and telecommunications firms. Beaumont validated the keys under the target's published responsible disclosure policy before reporting on August 13.

Why it matters: LiteLLM is an LLM proxy, so the stolen keys are not just LiteLLM credentials but the downstream provider keys, internal service tokens, and cloud credentials it brokers, and this documents a verified gap between remediation as reported and remediation as performed.

Sources: TechTimes | Ars Technica | CyberInsider

Jewelbug Runs Government Espionage and Crypto Theft From One Control Panel

Symantec's Threat Hunter Team tracks Jewelbug as a China-linked mercenary group running government espionage across the Middle East, South Asia, and Southeast Asia while simultaneously defrauding Chinese-speaking cryptocurrency users from the same administrative dashboard, on the same servers, with the same small team. One operation hit 15 government ministries. The toolset centers on the XG-Web control panel driving the Antino backdoor, a malicious "PDF Viewer" browser extension for credential and wallet theft, and the ClientKing implant targeting Linux systems and routers; the victim database logged over a million implant records. The group is also tracked as Earth Alux, REF7707, and CL-STA-0049.

Why it matters: A crypto-theft indicator on a government network may in fact be a state collection foothold, which collapses the analytic separation most triage playbooks still rely on.

Sources: TechTimes | TechNadu

APT36 Routes the PATCHCORD Backdoor Through Google Sheets

Acronis' Threat Research Unit documented PATCHCORD, a previously undocumented backdoor deployed against Afghan telecom operators and South Asian and Indian critical infrastructure. Delivery relies on fake VPN installers impersonating Afghan Telecom and other sector-specific lures, with command and control routed through Google Sheets. Attribution to APT36 is assessed as suspected rather than confirmed. In parallel, the Project CAV3RN espionage framework targeting Israeli entities moved its C2 into Google Apps Script.

Why it matters: Two separate espionage operations converged on Google-owned domains for C2 in the same window, defeating domain reputation and newly-registered-domain controls outright, and leaving per-user baselining as the only viable detection since blocking is not an option.

Sources: Security Affairs | Cyber Warriors Middle East | Securelist

AI News

OpenAI Ships Cross-Model Delegation in Codex So Sol Can Route Work to Luna

OpenAI shipped cross-model delegation in Codex's Multi Agents v2 system, letting a model assign work to any supported model including the cheaper, faster GPT-5.6 Luna. The intended pattern is a hierarchy: an expensive reasoning model like GPT-5.6 Sol stays as orchestrator while bounded subtasks route down. The tension is visible in OpenAI's own numbers, where Sol scores 83.0% on FrontierMath v2 Tier 4 against Luna's 58.5%, meaning delegation works only if the orchestrator correctly classifies which tasks are genuinely bounded.

Why it matters: Routing has been productized as a first-class runtime primitive rather than a developer-side optimization, which makes routing competence a differentiator between agent products built on identical models.

Sources: RuntimeWire | OpenAI

OpenAI's Builder Guide Puts a 25x Number on Routing Architecture

OpenAI published "The builder's guide to GPT-5.6" on August 13, collecting production lessons from startups running its models. The headline finding: a naive design handing every step to the top-tier model costs $33.27 to reach a given search-benchmark accuracy, while a properly routed architecture reaches the same accuracy for $1.33. The guide also documents reasoning-effort inversion, where GPT-5.6 Sol at low effort outperformed GPT-5.5 at high effort on Agents' Last Exam.

Why it matters: A 25x cost delta at identical accuracy means architecture, not model selection, is the dominant variable in agent economics, which is the opposite of how most procurement conversations are framed.

Sources: claypier | OpenAI | AI Cost Check

Gemini 3.7 Flash Zero-Shots a Playable Game Its Predecessor Could Not Compile

Google launched Gemini 3.7 Flash on August 12 at $0.75 per million input tokens, three weeks after Gemini 3.6 Flash, with token pricing cut 50% through December 31. The model card frames it as post-training and algorithmic refinement of 3.6, not a new pretraining run. It now produces fully playable video games from a single text prompt, three weeks after its predecessor reportedly could not produce a working file for the same task, and reports gains on the DeepSWE v1.1 debugging benchmark. Google pushed it into Search AI Mode within 24 hours of the developer release.

Why it matters: The delta from "no working file" to "zero-shot playable game" without a new pretraining run is evidence that long-horizon code generation is now movable through post-training alone.

Sources: Google Blog | Crypto Briefing | Decrypt | The Verge

GLM-5.3 Reports a 50% Coding Jump From Post-Training on an Unchanged Base

Z.ai launched GLM-5.3 on August 14, reporting a 50% jump on its internal Code Bench and an 84.5% CyberGym score, and stating explicitly that the base model is unchanged and the gains come entirely from post-training. The architecture is a 753-billion-parameter mixture-of-experts design with a 1-million-token context window, identical to GLM-5.2. The model has reportedly already surfaced a serious vulnerability in Cursor.

Why it matters: An 84.5% CyberGym score in an open-weight release from a Chinese lab puts security-relevant capability outside any downstream access control, and the same-base-model framing mirrors Gemini 3.7 Flash exactly.

Sources: Memeburn | SiliconANGLE

DeepSeek's Top-Ranked V4 Flash Completes Only 53.8% of Real Agent Tasks

Composio ran DeepSeek's V4 Flash through eight agent harnesses including Claude Code, Codex, and OpenCode, on 30 deliberately difficult multi-step tasks spanning live Gmail, GitHub, and Slack integrations. The model, which had topped leaderboards and been called a "total monster" by developers, completed 53.8%. Its prices have also been rising. This is the second independent instance of the pattern for DeepSeek: its open-sourced coding agent harness, released August 13 under MIT license alongside V4-Pro going GA, also failed to reproduce its self-reported benchmarks under a neutral harness.

Why it matters: The eight-harness design rules out "bad scaffold" as the explanation, which means leaderboard position and agent-harness completion rate are close to uncorrelated at the top of the distribution.

Sources: VentureBeat | DEV Community

An Eval Harness Finds Models Are Most Confident Exactly When They Are Wrong

A team building LLM-assisted tooling ran a systematic eval harness over a development step most teams skip because it is tedious and produces no user-visible results. The harness surfaced a pattern that qualitative review had missed entirely: model confidence peaked on the cases where the model was wrong. Separately, Vals AI closed a $40 million Series A at a $400 million valuation led by a16z on the finding that frontier models top out at roughly half of professional financial analyst tasks, and Atomicwork's ITSMBench found the best model completed 50.56% of real IT service requests.

Why it matters: Inverse confidence calibration breaks the most common production safeguard, because routing low-confidence outputs to a human passes exactly the wrong cases through.

Sources: TechieTricks | TechTimes | Physical AI News

Researchers Decode Encrypted Reasoning Traces Across Every Major Provider

Researchers from ELLIS Institute Tübingen, Max Planck Institute for Intelligent Systems, MATS Research, University of Tübingen, and Snyk demonstrated that the step-by-step reasoning leading LLM providers deliberately conceal can be reconstructed from API outputs. Follow-up work established the technique is not vendor-specific: OpenAI, Anthropic, and Google APIs are all affected, and a weaker model can decode a stronger model's hidden reasoning via encrypted block replay. Separate analysis of 315,320 reasoning blocks scraped from public repositories recovered 367 PII artifacts and 182 credentials, including 62 live API keys and 33 passwords.

Why it matters: Any pipeline that logs, caches, or ships reasoning blocks is now a credential-leak surface existing secret scanners do not inspect, and hidden chain-of-thought is no longer a confidentiality boundary.

Sources: arXiv | The Hacker News | Yahoo Tech | Latent.Space

Gowers and Sarnak Call LLMs Strong Calculators and Weak Creative Thinkers

Mathematicians Timothy Gowers and Peter Sarnak credited large language models with serious mathematical skill while drawing a hard line at genuinely new ideas. Gowers argues current models are good at combining known methods and trying many search paths but lack the intuition to pick the few productive routes in a vast search space. Sarnak agrees AI can derive results but stops short of originating them. The critique lands alongside the first large-scale measurement of autonomous AI research: 153 runs of the nanoGPT optimizer speedrun across 18 frontier models, multiple seeds each, some lasting up to eight days on 8xH200s.

Why it matters: The diagnosis is architectural and falsifiable rather than a complaint about scale, and it complicates GPT-5.6 Sol's 83.0% on FrontierMath v2 Tier 4, because solving posed problems and choosing which problems to pose are different capabilities.

Sources: The Decoder | Measuring Autonomous AI Research

Anthropic Ran 133 Million Contractor Chats With Bioweapon Classifiers Disabled

Anthropic's Risk Report published August 14, covering the period to July 15, disclosed that the company ran 133 million contractor chat sessions with its bioweapon-related classifiers switched off. The disclosure appeared alongside the more widely covered misalignment rating change, raised from "very low" to "low" for catastrophic harm in high-stakes settings, and in the same document as the unreleased Model 2 revelation. The classifier gap concerns the human-feedback data pipeline rather than a deployed product surface.

Why it matters: The industry's safety story rests heavily on classifier coverage at inference time, and this is a large sanctioned carve-out inside the training-data collection loop where policy attention rarely reaches.

Sources: The Next Web | SiliconANGLE

The EU AI Office Issues Its First Fines, Totaling 47 Million Euros

The EU AI Office levied its first penalties under the AI Act's high-risk provisions, fining three companies a combined €47 million: a hiring platform €18M, a credit scoring firm €14M, and a retail chain €15M. The fines landed immediately after the August 2 enforcement deadline with no grace period. The European Commission separately published a cybersecurity and AI action plan acknowledging that of roughly 3,000 AI systems surveyed, only 30 are European, and none currently meet EU standards.

Why it matters: The targets are hiring, credit, and retail rather than frontier labs, and the Commission's admission that zero European systems meet its own standards means Europe is enforcing rules against a market it does not supply.

Sources: AI Unfiltered | DigitalShield

Anthropic Explains How Its Watermark Works and How to Break It

Anthropic detailed the mechanics of its Claude text watermark, confirming it works essentially like the MirrorMark method: the watermark is the randomness pattern of generation itself, mirroring the sampling randomness used to produce text. There are no embedded Unicode characters or hidden glyphs, contrary to widespread claims. The company also described how the watermark can be defeated, and shipped a public detection API letting third-party developers plug Claude text detection into their own applications. Anthropic is applying the EU-mandated watermarking to Claude output worldwide, not just in Europe.

Why it matters: Sampling-based watermarks degrade under paraphrase and heavy editing, so the signal is probabilistic provenance rather than proof of authorship, and any regulator reaching for watermarks as an enforcement primitive is relying on a tool that fails gracefully rather than reliably.

Sources: Search Engine Journal | The Decoder | Euronews

Samsung Runs Claude Code in Chip Design and Hits the Containment Problem

Samsung has been running Anthropic's Claude Code in semiconductor design and verification work over several months, reporting that some engineering tasks dropped from weeks to days. The company also documented failures: unintended changes and attempts to modify code outside the scope of an assigned task. Those errors have kept Samsung's engineers in a supervisory posture rather than allowing autonomous operation.

Why it matters: The specific failure mode is out-of-scope edits, which is a containment problem rather than a capability problem, and it is the same boundary that has agent platforms shipping control planes instead of smarter models.

Sources: TechSpot

NIST Asks Whether AI Should Run the Vulnerability Database That AI Is Flooding

On August 12, NIST opened a request for guidance on the future of the National Vulnerability Database and how far AI should be integrated into managing the service and enriching software-flaw data. The trigger is volume: AI-augmented vulnerability research and scanning have driven a sustained surge in disclosed flaws that the existing enrichment pipeline cannot absorb. Palo Alto Unit 42 separately documented what it calls the industrialization of autonomous zero-day discovery in open-source software.

Why it matters: An AI-enriched NVD inherits model error into the authoritative source every downstream scanner and compliance regime treats as ground truth, and the remedy is structurally circular.

Sources: Dark Reading | Unit 42

House Democrats Press Anthropic and OpenAI on Rogue Agents

House Democrats sent inquiries to Anthropic and OpenAI regarding rogue AI agents, in an action Forkast frames as exposing the federal regulatory vacuum beneath the issue rather than filling it. The pressure lands alongside the Pentagon's Section 1512 obligation, a comprehensive review of how the department secures AI and ML systems covering current practices, gaps, commercial runtime-security options, framework alignment, and recommended authorities, due to Congress by August 31.

Why it matters: Congressional letters are the weakest available instrument, and the Section 1512 deadline is the one with an actual date attached and an actual buyer at the end of it.

Sources: Forkast | The Decoder

Active Exploitation Watchlist + Notable CVEs

The Edge

The single most important number this week is zero: the amount of encryption in the campaigns that mattered. Clop hit fifty blue-chip organizations through a PTC Windchill zero-day and never dropped a payload. ShinyHunters took 1.6 million RingCentral records with a phone call. The Azure directory campaign against McDonald's, Vodafone, and Kyndryl used valid credentials to download employee lists from the victims' own tenants. An Akira affiliate rebooted a host into Safe Mode, failed to encrypt entirely, and walked out with credentials and data anyway. Every one of those is a total loss for the victim, and not one of them would trip a control built on the premise that ransomware means files getting locked.

This is a measurement problem before it is a defense problem. Most organizations still score their ransomware readiness on recovery time, backup integrity, and EDR coverage. Against this week's actual campaigns, all three metrics return a passing grade while the crown jewels leave through a legitimate API session. The Akira incident is the cleanest demonstration: by any backup and restore scorecard, that was a successful defense. The lesson defenders keep half-learning is that egress volume, not file entropy, is now the signal that matters, and almost nobody instruments it. Trulite lost eight terabytes and nobody noticed the transfer.

Here is the uncomfortable part. The attack surface producing these losses is not the endpoint, and it is not really the network either. It is the seam where identity meets trusted infrastructure: an RMM console, a PLM server, an analytics platform holding live database credentials, an LLM proxy brokering every downstream API key. Look at what CISA catalogued in two weeks. N-able N-central twice, because the first patch was incomplete. TeamCity, Langflow, Metabase, LoadMaster, SharePoint three separate ways. These are not endpoints. They are the systems that hold credentials for everything else, and they are consistently outside the patch SLAs applied to firewalls and servers because someone classified them as internal tooling. Beaumont's LiteLLM finding is the whole thesis in one datapoint: five months after disclosure, at a company that formally certified rotation, almost every stolen key still worked.

Watch three things over the next month. First, whether Clop's next campaign targets another data-rich enterprise application rather than a file-transfer product, because the PLM pivot suggests the selection criterion is now data value rather than exposure count. Second, whether anyone in the vendor ecosystem ships egress-volume anomaly detection as a default rather than a tuning exercise, since that is the only control that catches an eight-terabyte transfer before it completes. Third, and most consequentially, watch what happens when GLM-5.3's 84.5% CyberGym score meets the SonicWall chaining pattern. The affiliates who composed an SSRF with a post-auth injection did research work that vulnerability management programs still refuse to do, and they did it by hand. The tooling to do it automatically shipped this week, with open weights, and there is no gate to close.