Security daily

Edition 2026-05-15 · read as Security

NGINX,Traefik,PraisonAI:ThreeCriticalRCEsDisclosed

Sources
36
Words
1,185
Read
6min

Topics Agentic AI AI Regulation LLM Inference

◆ The signal

Three issues, disclosed today. NGINX rewrite module: an 18-year-old unauthenticated RCE, pre-auth, edge-facing, present on a meaningful share of the public internet. Traefik: a CVSS 10.0 auth bypass that exposes everything downstream. PraisonAI CVE-2026-44338: weaponized within four hours of disclosure. Mass scanning is the base case for the next 24-48 hours. If NGINX or Traefik sits at your edge, the change window is tonight, not the weekend.

◆ INTELLIGENCE MAP

  1. 01

    Multi-Front Edge Infrastructure Emergency

    act now

    NGINX's 18-year unauth RCE, Traefik's CVSS 10.0 auth bypass, MOVEit's 9.8 auth bypass, and PraisonAI's 4-hour exploit window all dropped simultaneously. Authentication bypass dominates — EDR won't catch these. Patch tonight or assume compromise tomorrow.

    4 hours
    disclosure to exploit
    3
    sources
    • NGINX age
    • Traefik CVSS
    • MOVEit CVSS
    • PraisonAI time-to-exploit
    • Argo CD CVSS
    1. Traefik10
    2. MOVEit9.8
    3. PraisonAI9.8
    4. Argo CD9.6
    5. NGINX9.5
  2. 02

    AISI Validates AI Full Network Takeover — Offensive Parity Arrives

    monitor

    UK AISI confirmed Anthropic's Mythos executes end-to-end network takeover autonomously — a step function above prior 'advanced persistence' ceiling. Microsoft's MDASH now outperforms Mythos on CyberGym. Google TAG confirmed a threat actor using AI to build a cybercrime tool. The n-day window is collapsing toward zero.

    6/10
    Mythos range success rate
    8
    sources
    • AISI ranges cleared
    • MDASH agent count
    • Vuln discovery (PAN)
    • Patch SLA pressure
    1. Prior gen (adv. persistence)40
    2. GPT-5.5-cyber70
    3. Mythos (full takeover)95
  3. 03

    Agentic AI Crosses 59% of Traffic — Production Incidents Begin

    monitor

    Agentic workloads hit 59% of all AI token volume. An agent (OpenClaw) wiped a user's entire inbox. Claude Code /goal enables unattended autonomous coding with no human review. x402 payments ship inside AWS Bedrock. Bot detection fails against agents 81% of the time. The attack surface is no longer 'emerging' — it's the majority surface.

    59%
    AI traffic now agentic
    9
    sources
    • Bot bypass rate
    • Persona drift onset
    • Claude SMB connectors
    • Alexa agent actions
    1. Agentic workloads59
    2. Human-interactive41
  4. 04

    Anthropic Infrastructure Shift to xAI's Colossus + Vendor Concentration

    monitor

    Anthropic overtook OpenAI in enterprise spend (34.4% vs 32.3%) while routing inference onto xAI/SpaceX's Colossus 1 — infrastructure owned by a hostile competitor. Silent account bans and 80x demand vs 10x capacity. Claude is now both the majority enterprise AI provider and the most volatile dependency in your stack.

    34.4%
    Anthropic enterprise share
    8
    sources
    • Anthropic share
    • OpenAI share
    • Colossus GPUs
    • Demand vs plan
    1. Anthropic34.4
    2. OpenAI32.3
  5. 05

    Geopolitical Escalation: Taiwan Arms + China-Nexus APT Cycle

    background

    Xi labeled the $14B Taiwan arms package 'extremely dangerous' — language that historically precedes Volt Typhoon/Salt Typhoon surges against US critical infrastructure. Chip-for-rare-earths brinkmanship may delay hardware refresh cycles including security appliances. Expect 30-90 day elevated activity window.

    $14B
    Taiwan arms package
    3
    sources
    • Arms deal value
    • Expected APT surge
    • Target sectors
    • Key groups
    1. Arms announcementNow
    2. APT surge expected30-90 days
    3. Rare earth impact6-18 months
    4. Hardware refresh delays12-24 months

◆ DEEP DIVES

  1. 01

    Edge Perimeter Under Simultaneous Assault: NGINX, Traefik, MOVEit, and the 4-Hour Window

    The Multi-Front Emergency

    Three critical perimeter vulnerabilities disclosed in the same window exceed the emergency change capacity of most shops. This is a class of failure across the entire edge layer, not a single-vendor problem.

    The Lineup

    ProductCVECVSSTypeStatus
    NGINX rewrite modulePending~9.5Unauth RCE18 years undetected; PoC imminent
    TraefikCVE-2026-35051 / -3985810.0Auth bypassDisclosed; everything downstream reachable
    MOVEit AutomationCVE-2026-46709.8Auth bypassCl0p pattern match; mass exploit likely
    PraisonAICVE-2026-443389.8Auth bypassActive exploitation within 4 hours
    Argo CDCVE-2026-428809.6Missing authzRead-only users exfil K8s Secrets

    The PraisonAI 4-hour figure is the tempo to internalize. Disclosure to working exploit inside a single shift is the new baseline for AI-adjacent infrastructure, driven by automated disclosure-to-exploit pipelines. Monthly patch cycles do not survive contact with that threat model.

    Why This Cycle Is Different

    The common thread across all five is authentication bypass. The bug class is access control, not memory corruption or races. EDR will not catch these because there is no malicious binary to flag; the ingress said yes when it should have said no. The follow-on:

    • Traefik bypass exposes every downstream service that delegated auth to the ingress.
    • MOVEit's 2023 Cl0p campaign ran for months before victims noticed. Same product line, same bug class.
    • Argo CD's flaw lets any user with 'read' access extract plaintext Kubernetes Secrets, with no EDR signature available.
    • NGINX has been edge-facing and pre-auth for eighteen years with no detection layer behind it.
    Five actively-exploited perimeter CVEs, a Netlogon preauth RCE on every domain controller, and a 10.0 ingress bypass that makes Traefik auth-delegation fictional. Most shops will patch Netlogon first and MOVEit last. Cl0p will work the list in reverse.

    The Windows Zero-Day Complication

    Two unpatched Windows zero-days from the same anonymous researcher add pressure: a BitLocker bypass that defeats full-disk encryption on patched Windows, and a CTFMON LPE. There are no patches and no vendor timeline. Every SOC 2, HIPAA, and GDPR narrative that says "data at rest is encrypted via BitLocker" now carries an asterisk. Compensating controls only.

    Action items

    • Stage NGINX emergency patch across all instances (edge, internal, sidecars, ingress controllers) and deploy WAF rules blocking rewrite-module payloads within 24 hours
    • Audit all Traefik deployments and identify downstream apps relying on Traefik for authentication enforcement; deploy app-layer auth as compensating control today
    • Patch PraisonAI CVE-2026-44338 immediately or take instances offline; pull auth logs for the last 48 hours on any exposed instance
    • Patch MOVEit Automation to 2025.1.5/2025.0.9/2024.1.8 and begin board-level product replacement discussion
    • Enforce TPM+PIN pre-boot auth and disable sleep/hibernate on high-value Windows endpoints as BitLocker bypass compensating control

    Sources:SANS AtRisk · The Hacker News · TLDR InfoSec

  2. 02

    AISI Validates Full Network Takeover: The Patch Window Just Collapsed

    The Capability Statement

    The UK AI Security Institute has empirically confirmed that Anthropic's Mythos and OpenAI's GPT-5.5-cyber complete full network takeover chains autonomously. This is a government evaluator's finding, not a vendor claim. Mythos cleared both of AISI's hardest tests. GPT-5.5-cyber cleared one. The prior generation topped out at "advanced persistence." AISI is already building harder evaluations because current benchmarks are saturating.

    Separately, Microsoft's MDASH — a 100-plus agent system that scans code, debates exploitability, and constructs proof-of-concept attacks — now outperforms Mythos on the CyberGym benchmark. And Google TAG confirmed a threat actor using AI to build a functional cybercrime tool. That is the first public validation that AI-assisted malware development is operational, not theoretical.

    What This Changes Operationally

    Defensive AssumptionPre-Validation RealityPost-Validation Reality
    Critical CVE patch SLA7-30 days acceptableHours-to-days; n-day behaves like 0-day
    Pentest cadenceAnnual or semi-annualContinuous; AI-augmented baseline
    Attacker dwell timeHours to days (human)Minutes (autonomous agent)
    Vendor vuln backlogRisk-rank and deferBacklog is attacker inventory

    The convergence is the story. AISI validates the offensive ceiling. MDASH demonstrates defender-side tooling at the same tier. Google TAG confirms threat actors are already shipping it. Three independent sources, one direction: AI-speed exploitation is production-ready on both sides of the fence.

    Congress is steering Mythos access toward NSA over CISA, signaling offensive/intelligence prioritization over civilian defensive distribution. If NSA is the priority recipient, civilian critical-infrastructure uplift is delayed. Budget as if no government help arrives at AI parity.

    The Detection Gap

    Full network takeover chains compress the attacker tempo most SOC playbooks assume. SIEM correlation windows built for hours of dwell time will miss minutes-long chains. Identity primitives — Kerberoasting, token theft, consent phishing — are what agentic chains exploit faster, not smarter. The gap is temporal, not technical. Velocity-based analytics tuned against human operators produce false negatives against machine-speed adversaries.

    Mozilla's deployment of Mythos Preview against Firefox surfaced 271 previously-unknown bugs, including sandbox escapes and UAFs. The offensive capability translates to real codebases, not just CTF ranges. The researchers noted that harness design matters more than model choice. Defenders can pilot without paying for the top-tier model.

    Action items

    • Commission a red-team exercise using a frontier model against your crown-jewel segment, measuring time-to-first-finding versus current pentest baseline, within 60 days
    • Compress critical internet-facing CVE patch SLA from 30 days to 7 days and high-severity from 90 to 30; implement virtual patching on disclosure day
    • Pressure-test SIEM correlation windows and MTTD baselines against sub-hour attacker dwell time; rebuild velocity-based analytics for machine-speed lateral movement
    • Pilot defensive AI vulnerability discovery against one critical internal codebase, budgeting for harness engineering not just API cost

    Sources:CyberScoop · The Information AM · AINews · Martin Peers · Bloomberg Technology · TLDR AI

  3. 03

    Agentic AI Hits Majority Traffic — First Destructive Incident, Autonomous Payments, and No Detection Coverage

    The Numbers That Define the Surface

    Agentic workloads now account for 59% of all AI token volume. This is the majority surface, not an emerging one. The first real destructive incident is on the board: an agent framework, OpenClaw, wiped a user's entire email archive without human approval. Classic confused deputy. The agent held a legitimate OAuth grant with modify and delete scope and either misread its instructions or took someone else's. Both readings end at the same archive.

    This week's shipped capabilities move the floor lower:

    • Claude Code /goal + Auto Mode: Anthropic shipped fully autonomous multi-turn coding sessions with no token cap and no per-tool human approval. The agent picks what to invoke and when to stop. A non-human developer identity with commit rights, running unattended.
    • x402 payments inside AWS Bedrock: machine-to-machine payments are now a default capability of Bedrock agents. A successful prompt injection now moves funds, not just data. Blast radius equals whatever wallet the agent holds at the moment it is persuaded.
    • Gemini Intelligence on Android: starting summer 2026, the Samsung Galaxy S26 and Pixel 10 ship an on-device agent that reads screens, navigates apps, autofills forms, and completes purchases. Every item on that list maps to a classic RAT objective. The difference is it ships by default, signed by the OEM.

    Where Controls Break

    SurfaceWhat BrokeDetection Gap
    Agent OAuth scopesOpenClaw mass-delete (real incident)No human-in-loop on destructive verbs
    Agent payments (x402)Prompt injection → USDC transferDLP/CASB cannot inspect x402 traffic
    Bot detection81% bypass rate against legacy controlsCAPTCHA and behavioral fingerprinting useless
    Code autonomy (/goal)Haiku evaluator reads transcript only — cannot verify realityNo detection for runaway agent sessions
    Mobile agents (Gemini Intelligence)Indirect prompt injection via screen contentNo MDM coverage for agent-driven flows
    Agents act with user OAuth tokens. Downstream systems see legitimate users. Every detection tuned to human behavioral baselines will produce false negatives against agent traffic operating at machine speed with human identity.

    The Pricing Change Is a Security Event

    Anthropic now bundles $200 of API credits inside a $200 subscription, usable via Agent SDK, claude-p, and GitHub Actions. A developer on a personal plan can run autonomous agents against company code through a personal GitHub Actions runner with zero enterprise telemetry. Entra ID conditional access, CASB, and DLP need signatures for these CLI and SDK fingerprints. The shadow-AI surface is now subsidized.

    Claude for Small Business ships pre-built connectors into QuickBooks, PayPal, HubSpot, Google Workspace, and Microsoft 365. SMB vendors in the supply chain will turn this on without telling anyone upstream. Purchase orders and contracts then move through Anthropic as an undisclosed subprocessor.

    Action items

    • Inventory every OAuth grant and API token issued to agent frameworks (OpenClaw, Claude tool use, ChatGPT connectors, MCP servers) and remove modify/delete scopes where only read is needed, this week
    • Deploy SIEM rules for high-volume delete/modify operations from agent user-agents or service principals (Graph API mass-delete, Gmail batch-delete, S3 bulk-delete, Git force-push)
    • Audit AWS Bedrock AgentCore deployments for x402 payment capability; block outbound wallet interactions for agents that don't explicitly need them
    • Push managed Claude Code settings via MDM with allowManagedHooksOnly; prohibit /goal and Auto Mode in repos touching production credentials or regulated data
    • Deploy egress and CLI-fingerprint detections for claude-p, Claude Agent SDK, and OpenAI Codex CLI on managed endpoints; alert on personal-account auth to AI providers from corporate networks

    Sources:TLDR · Daily Dose of DS · TLDR IT · TLDR AI · Techpresso · ben's bites

◆ QUICK HITS

  • Android ADB bypass (CVE-2026-0073) affects every device since Android 11 (Sept 2020) — OEM factory-test misconfigurations left in production firmware; block TCP/5555 egress and query MDM for devices with ADB enabled

    Risky.Biz

  • Google Gemini is leaking real phone numbers from training data — not injection, not jailbreak, just architectural memorization surfacing PII in normal queries; enable output-side PII DLP scanning on all Gemini touchpoints and file a DPIA addendum

    The Download from MIT Technology Review

  • Grok 4.3 ships voice cloning as a standard feature while TML-Interaction-Small hits 0.40s full-duplex latency — the gap between 'something feels off' and 'indistinguishable from real' just closed; mandate out-of-band callback for all voice-initiated financial requests

    Simplifying AI

  • Anthropic inference confirmed routing through xAI/SpaceX Colossus 1 (220K+ GPUs owned by a hostile competitor) — prompts and source code may transit infrastructure operated by a party that publicly called Anthropic 'evil'; request updated sub-processor list

    The Pragmatic Engineer

  • Update: Shai-Hulud framework MIT-licensed on GitHub with active forks — lowering supply-chain attack skill floor to 'motivated undergrad'; hunt forks via GitHub code search and rotate all long-lived npm publish tokens to OIDC short-lived this week

    TLDR Dev

  • Update: RubyGems suspended new signups after 500+ malicious packages hit the registry targeting developers with XSS and data theft — freeze gem additions in CI for 72 hours and audit any new gem installed this week

    Risky.Biz

  • Claude for Small Business ships connectors into QuickBooks, PayPal, HubSpot, M365 — SMB vendors will enable this without disclosure; issue vendor-risk addendum asking whether Claude connectors touch shared tenants holding your data

    TLDR AI

  • DuckDB's new Quack protocol ships with no SSL and localhost binding by default — same insecure-default pattern as Redis, Elasticsearch, MongoDB before their breach waves; add DuckDB to software inventory and detect non-localhost bindings

    TLDR Data

  • AI liability regime fight between absolute-liability and user-liability proposals will determine whether open-weight models stay viable and whether prompt logs become legal evidence — pressure-test vendor contracts for liability-shift clauses this quarter

    a16z AI Policy Brief

◆ Bottom line

The take.

An 18-year-old NGINX RCE and a CVSS 10.0 Traefik auth bypass hit the edge on the same day that AISI validated AI models completing full autonomous network takeover and an agent framework wiped a user's inbox without asking — the perimeter, the patch window, and the trust model for autonomous tooling all broke simultaneously, and the 4-hour disclosure-to-exploit timeline on PraisonAI is the new clock your change management process is racing against.

— Promit, reading as Security ·

Frequently asked

Why patch NGINX and Traefik tonight rather than during the regular weekend window?
Mass scanning is expected within 24-48 hours of disclosure, and both flaws are pre-auth and edge-facing. The NGINX rewrite RCE has been latent for 18 years on a meaningful share of the public internet, and the Traefik CVSS 10.0 auth bypass exposes every downstream service that delegated authentication to the ingress. Waiting until the weekend means patching after exploitation has likely already started.
What does the 4-hour PraisonAI exploitation timeline mean for patch SLAs more broadly?
It establishes a new baseline where disclosure-to-working-exploit fits inside a single shift, driven by automated exploit pipelines and AI-assisted tooling. Monthly or even weekly patch cycles cannot survive that tempo for internet-facing systems. Critical CVE SLAs need to compress from 30 days toward 7 days or less, with virtual patching deployed on disclosure day as a bridge.
Why won't EDR catch this wave of vulnerabilities?
The common bug class across NGINX, Traefik, MOVEit, PraisonAI, and Argo CD is authentication bypass, not memory corruption or malware execution. There is no malicious binary to flag — the ingress or application simply said yes when it should have said no. Detection has to shift to identity, authorization, and anomalous access patterns at the application layer.
How should teams treat the unpatched Windows BitLocker bypass in the meantime?
Treat any compliance attestation that relies on BitLocker for data-at-rest encryption as carrying an asterisk until Microsoft ships a fix. Compensating controls include enforcing TPM+PIN pre-boot authentication, disabling sleep and hibernate on high-value endpoints, and tightening physical access controls. There is no patch and no vendor timeline, so the mitigation has to be operational.
Which downstream services are most at risk from the Traefik bypass?
Any backend application that delegated authentication enforcement to Traefik is reachable as if no ingress existed. That typically includes internal admin panels, dashboards, APIs, and microservices that assume the edge handled identity. The immediate compensating control is enabling app-layer authentication on those services today, before the patch window closes.

◆ Same day, different angle

Read this day as…

  1. 37 shared

    Disclosed today: an 18-year-old pre-auth RCE in NGINX's rewrite module, affecting every deployment of NGINX Plus and Open Source — edge, ingress controllers, API gateways.

    An 18-year-old NGINX RCE, a Traefik CVSS 10.0 auth bypass, and a MOVEit 9.8 all dropped in the same cycle that AISI confirmed frontier AI co…

  2. 35 shared

    Three edge-facing, unauthenticated bugs disclosed inside a 48-hour window: an 18-year-old pre-auth RCE in NGINX's rewrite module, a CVSS 10.0 auth bypass in Traefik, and a 9.8 auth bypass in MOVEit.

    Three edge infrastructure auth bypasses demand emergency patching tonight — NGINX (18 years old, pre-auth, everywhere), Traefik (CVSS 10.0),…

  3. 35 shared

    NGINX shipped an unauthenticated RCE in the rewrite module that has been sitting there for eighteen years.

    Your perimeter is bleeding from three directions simultaneously — an 18-year NGINX RCE, a Traefik CVSS 10.0, and a MOVEit 9.8 that Cl0p affi…

◆ Recent in security

Keep reading.