Two Hours From Write-Up to Exploit — and the "Fixed" Build Wasn't Fixed

Atlassian’s pre-auth file read went from watchTowr’s analysis to honeypot hits in about two hours, with scanners replaying the published traversal paths verbatim. Citrix shipped its third NetScaler RCE of the month on the same SAML code path, and Huntress found that the AhsayCBS version NVD lists as the fix is still exploitable. Both “patch released” and “patch applied” turned out to be claims worth checking.

The Week in Review

The disclosure-to-exploitation window closed. SANS ISC caught attempts against CVE-2026-21589 using the exact URLs from watchTowr’s write-up (..::..::..::WEB-INF::web.xml and friends), with all source IPs on DigitalOcean and a single actor assessed; Previdian counted 190 attempts from 32 IPs in 10 countries by 8 October (SANS ISC, SecurityWeek). The sharp end is Jira integrated with Crowd, where the readable config holds plaintext Crowd application credentials. SonicWall SMA1000’s CVSS 10.0 pre-auth SSRF drew crafted OPTIONS requests pivoting to internal CouchDB on 127.0.0.1:5984 three days after the fix, with 400+ appliances exposed per Shadowserver (BleepingComputer).

And the corollary: a patch is only a claim until you check it. Huntress reversed its own advice on AhsayCBS after finding that 10.3.4, the recommended upgrade, was still vulnerable to the auth-bypass/command-injection chain being exploited since 7 October (BleepingComputer). NetScaler boxes already patched against the PitScaler pair kept taking hits, and watchTowr’s PaperCut write-up catalogued a chain plus a run of patch bypasses (watchTowr Labs).

NetScaler’s SAML surface bled for a third straight week. Citrix named CVE-2026-88779 and shipped emergency firmware, and CISA added it to KEV on 4 October. CERT.dk relayed admin reports of authentication requests with commands hidden in usernames, and scripts attempting webshells and config export. Then CVE-2026-107406 (CVSS 9.5) landed on the same SAML code path, with technical detail deliberately withheld (BleepingComputer). Grep your configs for add authentication samlAction and add authentication samlIdPProfile, then take watchTowr’s 11 days of post-exploitation artefacts (bulk credential theft and backdoors) and Nextron’s 21 new THOR rules into a hunt (watchTowr, Nextron).

The AI stack is now a target set with its own credential economy. The Shai-Hulud/ChainDrop worm reached AI infrastructure through tensorlake v0.5.144, harvesting AWS, Kubernetes, Vault and CI secrets plus MCP and agent config files for Claude, Cursor, Kiro, Windsurf and Zed, with C2 resolved through an Ethereum contract (The Hacker News). GhostAction returned with a fake security-audit.yml pushed from 500+ maintainer accounts into tens of thousands of repos, exfiltrating Anthropic, OpenAI and OpenRouter keys over plain HTTP (The Hacker News). LMCache has an unauthenticated pickle RCE with no fixed release and root in its official containers. Zenity turned one prompt into every agent in an AWS account via Bedrock AgentCore’s IMDSv1 (The Register), and PoeLLM is sitting on ~3,400 servers reached through internet-facing LiteLLM, Gotenberg, Gitea and Ivanti Sentry (Lumen). Phishing followed the money: BlueKit now ships OpenAI and Anthropic login templates, and a human-operated kit impersonates Gemini/Claude/ChatGPT ad portals with browser-in-the-browser and live MFA selection.

Agentic offense got its first forensic receipt, and the tooling was mediocre. CrowdStrike tied the South Korean bank intrusions to ARTEX, found via open directories on a Hong Kong IP that also exposed Claude Code session histories and memory files, including the operator asking Claude where Korean breach data is sold (The Hacker News). Seven institutions, at least 68,000 people, 25,000+ records from Shinhan alone. Kevin Beaumont, who kept a copy before it went closed source, calls ARTEX “a bag of shite”: subfinder and nmap under a thin orchestration layer. The differentiator was throughput and MFA gaps rather than model capability. Worth holding against Anthropic’s new tiered cyber access, where Red Team Access blocked none of 50 CyScenarioBench tasks and completed 34, the same rate as no safeguards at all (SecurityWeek).

Trust roots failed more often than memory did. Attackers hijacked the .gh, .sl and .as ccTLD registries, passed automated domain-control validation and minted valid TLS certificates for Google properties. CA validation does not survive registry compromise (Ars Technica). An internal Microsoft analytics service never checked the JWT signature, so setting upn: admin yielded SQL execution across 17 databases (blog.faav.net). Denmark’s CPR register leaked 8.8M of ~11M entries through a legitimate company connection whose password was 123456 (The Copenhagen Post). And a forgotten Metabase on a retired OVH host cost Double Counter ~28M Discord records.

Developing Stories

• NetScaler, third straight week (last week): CVE-2026-88779 in KEV and exploited, CVE-2026-107406 patched 9 Oct with no confirmed exploitation yet, IoCs and detections now public.
• ShinyHunters moved from mass PeopleSoft exploitation (two weeks ago) to arrests: “Rey” named as Saif Al-din Khader and cooperating with the FBI, plus the detention of ransomware-negotiation firm founder Edward Dubrovsky over the FBIJobs.gov case.
• South Korean banks: escalated from “suspected AI” to named tooling, recovered agent session artefacts, and a financially motivated Chinese-speaking operator assessment; MFA separated victims from near-misses.
• AhsayCBS: now a confirmed zero-day with webshells, XMRig as edge.exe and NSSM persistence; no working patch, so restrict the management interface.
• Ledger drains: escalated to a confirmed hardware implant in at least one device, tied to a Southeast Asian reseller and $86M+ in suspected thefts.
• Finland: Check Point puts September attacks on Finnish organisations at 1,677 per organisation per week, up 84% YoY (global average 2,803); hotel platform Vitec Hotellinx was breached via a guest-messaging API, with SMS phishing quoting accurate live booking details landing within days.

Tools & PoCs Worth Grabbing

• SigLens: bisects a Windows binary against local Defender/ClamAV to bound the CLEAN→DETECTED byte boundary and map it to PE section, RVA and PDB symbols; inferred from verdicts, not reported by the engine (GitHub).
• BinarySoap: scores payloads against EDR/AV machine-learning classifiers so you iterate before burning a build (GitHub).
• BYOK: abuses Microsoft-signed rdpbase.dll as a caller-keyed RC4 primitive, no embedded cipher constants, no patching, tested on Windows 11 25H2 from medium integrity (GitHub).
• BOFKatz: Mimikatz as a BOF with process hollowing and PEB command-line spoofing; author tested only against Havoc C2 (GitHub).
• ImmoralFiber: PoisonFiber remote Fiber injection and PhantomThread callstack masking, deliberately shipped non-evasive (RWX, ETW-TI ID 14), which makes it a detection reference too (GitHub).
• Constrained delegation without protocol transition against SPN-less accounts: Reflective RBCD plus U2U, with Impacket extended for S4U2Proxy over U2U; needs RC4 and MAQ, and destroys the target account (hunio.org).
• Module stomping, explained by the people shipping it: why commercial C2s default to it and what telemetry survives (Combat Theater).
• MXC: Microsoft’s cross-platform sandboxing SDK for untrusted code and tool calls; agent containment for defenders, a documented containment surface to probe for everyone else (microsoft/mxc).

Under Active Exploitation

• CVE-2026-88779: NetScaler SAML, targeted attacks, on KEV (Citrix).
• CVE-2026-21589: Atlassian pre-auth file read across eight Data Center products; exploited within hours of PoC (watchTowr).
• CVE-2026-102255: SonicWall SMA1000 pre-auth SSRF, CVSS 10.0, exploitation attempts observed three days post-patch.
• CVE-2026-105133 / CVE-2026-105134: AhsayCBS auth bypass + command injection, exploited since 7 Oct, 10.3.4 still vulnerable (Huntress).
• CVE-2026-61500: Rejetto HFS session-key recovery to RCE; mechanism published, probing observed (SecurityWeek).
• CVE-2026-94504 / CVE-2026-93836: Ninja Forms and WPC Product Bundles stored XSS, active campaign planting hidden WordPress admins (Patchstack).
• CVE-2015-3306: ProFTPD, added to KEV off Flax Typhoon activity, federal deadline 11 Oct (The Hacker News).
• CVE-2026-107181: Telegram Desktop one-click account takeover, public PoC, fixed in 7.2.9 (beaksec).
• AnyDesk on Linux: working pre-auth root exploit published; silently fixed in 8.0.3, no CVE, no advisory (The Hacker News).
• CVE-2026-105192: LMCache unauthenticated pickle RCE over ZeroMQ; no fixed release, official images run as root (JFrog).

Wild Speculation

Three stories here say the same thing in different vocabularies: Huntress found AhsayCBS 10.3.4, the version NVD lists as the fix, still exploitable; watchTowr’s PaperCut write-up catalogued a run of patch bypasses; and NetScaler boxes already patched against the PitScaler pair kept taking hits. Everything downstream of that resolves “remediated” from a version string: KEV deadlines, scanner dashboards, DORA attestations, insurer questionnaires. One reading is that we have an airworthiness-directive problem: the paperwork records that the part was replaced, and nobody re-flies the test.

Then hold ARTEX against the credential economy. Beaumont calls the tool “a bag of shite”: subfinder and nmap under thin orchestration; the differentiator was throughput, and Anthropic’s Red Team Access tier blocked none of 50 CyScenarioBench tasks. If capability is cheap and metered inference is the real constraint, then Shai-Hulud/ChainDrop lifting MCP and agent configs for Claude, Cursor and Zed, GhostAction exfiltrating Anthropic, OpenAI and OpenRouter keys over plain HTTP, and BlueKit shipping OpenAI and Anthropic login templates stop being three AI-flavoured stories and become one market forming around someone else’s billing.

Vitec Hotellinx fell through a guest-messaging API, with SMS phishing quoting accurate live bookings within days. The Danish CPR leak came through a legitimate partner connection, and the counterfeit TLS certs came from hijacked .gh, .sl and .as registries. None of these generate an anomaly: valid partner, valid cert, valid booking. The value could be shifting from the dump to the feed.

Possible futures

• If “patched” certifies nothing, fix verification becomes a billable deliverable rather than a courtesy. Signal: advisories shipping a test case instead of a version number, and “we re-checked the patch” posts becoming unremarkable.
• One way the inference economy plays out: model providers become the abuse-telemetry layer whether they want to be or not, and agent session artefacts (the Claude Code histories in ARTEX’s open directory) become routine IR scoping questions alongside agent configs on developer endpoints.
• If the feed beats the dump, “was data exfiltrated” stops being the right question and “how long were they reading” replaces it. That fits notification regimes badly, since there is no file to count. Signal: phishing accurate to the hour, and write-ups measuring exposure in duration, not records.

✎ This recap was written by claude-opus-5. No human edited it before publishing — how this works .