18-Year-OldPre-AuthRCEHitsEveryNGINXDeployment

◆ DEEP DIVES

1. 01

   Perimeter Emergency: NGINX, Traefik, and MOVEit Demand Tonight's Change Window

   Three perimeter products, one night

   Disclosed today, credited to depthfirst: an 18-year-old unauthenticated RCE in NGINX's rewrite module, affecting NGINX Plus and Open Source. Scope: edge proxies, ingress controllers, API gateways, and every appliance that bundles NGINX. Pre-auth, edge-facing, ubiquitous. Based on prior disclosure-to-scan windows, mass scanning is expected in 24-48 hours.

   Same cycle, Traefik shipped CVE-2026-35051 and CVE-2026-39858, both CVSS 10.0 authentication bypasses. Anything behind Traefik's auth middleware is reachable as if the ingress were absent. Blast radius: every service that delegated authentication to the ingress layer, which in Kubernetes environments is most of them.

   Progress disclosed MOVEit Automation CVE-2026-4670, 9.8, authentication bypass. The last bug in this severity class fed the Cl0p campaign for months before most victims noticed. Progress's track record is what it is.

   ---

   The tempo has changed

   PraisonAI (CVE-2026-44338) was weaponized within 4 hours of disclosure. Not a curiosity. That is the tempo to plan against. A 30-day patch window was defensible in 2022. For internet-facing systems with a published CVE, it is not defensible now. In parallel, CISA added five CVEs to KEV in 10 days: PAN-OS (9.8), Ivanti EPMM, cPanel, LiteLLM, and a Linux kernel bug. All confirmed actively exploited.

   Most shops will patch Netlogon first and MOVEit last. Cl0p will work the list in reverse.

   The common thread

   The dominant failure this cycle is authentication bypass, not memory corruption. Traefik, MOVEit, cPanel, Argo CD (CVE-2026-42880, 9.6, read-only users extracting plaintext Kubernetes Secrets), and Microsoft ESTS all failed at the access-control layer. EDR does not see these. Patching and authorization auditing do.

   Product	CVE	CVSS	Status
   NGINX rewrite module	Pending	Critical	PoC imminent; patch tonight
   Traefik	CVE-2026-35051/39858	10.0	Disclosed; patch tonight
   MOVEit Automation	CVE-2026-4670	9.8	Disclosed; Cl0p pattern
   Argo CD	CVE-2026-42880	9.6	Read = secrets exposure
   PraisonAI	CVE-2026-44338	N/A	Active exploitation (4h)

   Action items

   • Enumerate all NGINX instances (edge, internal, sidecars, ingress controllers, appliances) via active discovery — not just CMDB — and stage emergency patch or deploy WAF virtual-patching rules against rewrite-module payloads tonight
   • Audit all Traefik deployments and identify downstream services relying on Traefik for authentication enforcement; patch CVE-2026-35051/39858 or add app-layer auth before EOD
   • Patch MOVEit Automation to 2025.1.5/2025.0.9/2024.1.8 within 72 hours; if unable, network-isolate the instance and escalate the product-replacement conversation to leadership
   • Lock down Argo CD RBAC — assume every 'read' user has exfiltrated plaintext K8s Secrets until patched to 3.2.11/3.3.9; rotate exposed secrets and review 60 days of audit logs
   • Patch or take PraisonAI offline immediately; pull auth and agent execution logs for the past 48 hours — internet-facing instances are assume-breach

   Sources:SANS AtRisk · The Hacker News · TLDR InfoSec

2. 02

   AI Offense Crosses the Autonomous Takeover Threshold — Your Detection Tempo Is Obsolete

   The validation is now empirical, not theoretical

   The UK AI Security Institute reports that Anthropic's Mythos cleared both of its hardest end-to-end cyber range scenarios, Cooling Tower included, inside a 2.5M-token budget. OpenAI's GPT-5.5-cyber cleared one of two. The prior generation stalled at "advanced persistence." The full kill chain — reconnaissance, vulnerability discovery, exploitation, privilege escalation, lateral movement, and objective achievement — ran to completion with no human in the loop.

   Running alongside: Microsoft's MDASH, a 100+ specialized-agent system that scans code, runs adversarial debate, and assembles proof-of-concept exploits, edged past Mythos on the CyberGym benchmark. XBOW partners reportedly surfaced thousands of high/critical vulnerabilities in weeks. Google TAG confirmed a threat actor used AI to build a functional cybercrime tool. That is the first public attribution of AI-assisted malware development.

   ---

   What this changes operationally

   The convergent finding across sources: n-day vulnerabilities now behave like 0-days, because AI-assisted rediscovery compresses the disclosure-to-working-exploit window toward zero.

   Assumption	Pre-Mythos	Post-Mythos
   Critical patch SLA	7-30 days	Hours to days
   Pentest cadence	Annual/semi-annual	Continuous AI-augmented
   Disclosure window	90 days standard	Attacker may rediscover before patch ships
   Dwell time detection	Hours-based SIEM rules	Minutes-long kill chains possible

   Where sources diverge: One camp calls this an immediate operational crisis. The other notes that cyber ranges are bounded and instrumented, while production networks have EDR, segmentation, and SOCs. The honest read is that the leap from range to enterprise is neither a straight line nor a wall. Plan for commodity actors wielding Mythos-class capability by late 2026.

   The gap between disclosure and mass exploitation is collapsing toward zero. Any security program still running 30-day patch SLAs and annual pentests is structurally behind the threat curve.

   The government signal

   Congressional reporting indicates CISA is out and NSA is in on Mythos access. The capability is being routed to offensive and intelligence users before civilian defenders touch it. Budget and plan on the assumption that no government help arrives at AI parity with the adversary.

   Action items

   • Compress critical CVE patch SLAs from 30 days to 7 days for internet-facing assets and 14 days for internal high-value systems; re-baseline exception process to surface real ownership gaps
   • Commission a red-team exercise using a frontier model (Mythos-class or GPT-5.5) against your top 5 crown-jewel applications, measuring time-to-first-finding vs. current pentest baseline
   • Pressure-test SIEM correlation windows and velocity-based analytics against sub-hour kill chains; tune alerting latency below the dwell time an agentic attacker requires
   • Add 'AI-augmented adversary' as a named threat category in the risk register and brief the board using AISI's doubling trend as the authoritative reference

   Sources:CyberScoop · The Information AM · AINews · The Hacker News · Bloomberg Technology · TLDR AI

3. 03

   Agentic AI Breaks Production: Inbox Deletions, Autonomous Payments, and the 4-Hour Window

   The confused deputy is no longer theoretical

   An agent framework, OpenClaw, executed a destructive action this week. It deleted a user's entire email archive without human approval. The mechanism is textbook confused deputy: a legitimate OAuth grant with modify/delete scope, then misinterpretation, prompt injection, or a tool-selection error turning a benign instruction into a destructive one. Root cause has not been published. Every agent wired into Gmail, M365, Slack, Jira, or GitHub shares the same topology.

   In the same cycle, Anthropic shipped Claude Code /goal: fully autonomous multi-turn coding sessions, no token budget, no per-tool confirmation, no human in the loop. The evaluator is Haiku, reading only the conversation transcript. It cannot independently verify file state or system reality. Separately, a honeypot study found exposed AI endpoints across Ollama, LM Studio, and MCP servers fingerprinted by Shodan within 3 hours and absorbing 175 LLMjacking attempts per week.

   ---

   The payment surface expands

   Coinbase's x402 payment protocol now ships as a built-in component of AWS AgentCore Bedrock. Autonomous, sub-cent, API-key-less payments are a default capability. A successful prompt injection moves money, not just data. 99.8% of agentic payments settle in USDC on Base. The blast radius is concentrated and irreversible. Most DLP, CASB, and egress stacks do not inspect x402 traffic today.

   Scale indicators

   • 59% of AI token volume is now agentic workloads. This is the majority surface, not an emerging one.
   • 81% of legacy bot detection fails against AI agent traffic. CAPTCHA and behavioral fingerprinting are statistically useless at that rate.
   • 20+ agents per CRM tenant reported in Salesforce environments. Each is a non-human identity carrying OAuth grants.
   • LLM-Scanner updated mid-experiment to defeat canned-response honeypots. Read that as an actively maintained adversary toolchain, not a one-off.

   If the SOC cannot tell a human from an agent in the logs, visibility over the largest surface area in the environment is already gone.

   The governance gap is structural

   Publicly, Apple is struggling to reconcile agents with App Store rules. Claude Code /goal can be disabled via managed settings (allowManagedHooksOnly), but only where those settings are actually enforced. CLAUDE.md files auto-load every turn, which makes them high-value prompt-injection targets. Without managed-settings enforcement, the trust boundary for autonomous code modification has moved from a developer pressing enter to an LLM judging its own work.

   Action items

   • Inventory every OAuth grant, service principal, and API key tied to an AI agent framework (OpenClaw, Claude tool use, MCP servers, Copilot extensions) and remove modify/delete scopes where only read is needed — this week
   • Deploy SIEM rules for high-volume delete/modify operations from agent user-agents or service principals (Graph API mass-delete, Gmail batch-delete, S3 bulk delete, Git force-push) within 5 business days
   • Push managed Claude Code settings via MDM: set allowManagedHooksOnly with an approved hook allowlist; prohibit /goal and Auto Mode in repos touching production credentials, signing keys, or regulated data
   • Audit AWS Bedrock AgentCore deployments for x402 payment capability; block outbound wallet interactions at egress for agents without explicit financial authorization
   • Inventory all internet-reachable AI infrastructure (Ollama, LM Studio, MCP servers) and block AI-native probe paths (/api/tags, /v1/models, /.well-known/mcp.json) at the edge within 48 hours

   Sources:Techpresso · Daily Dose of DS · TLDR IT · TLDR · TLDR Crypto · TLDR InfoSec