🚨 Exploited Before the Patch Existed: How Adobe Uses AI Agents to Virtual-Patch CVEs in Minutes

Hello from the Cloud-verse!

This week’s Cloud Security Newsletter topic: Virtual Patching at Machine Speed — the WAF as your "911" (continue reading) 

Incase, this is your 1st Cloud Security Newsletter! You are in good company!
You are reading this issue along with your friends and colleagues from companies like Netflix, Citi, JP Morgan, Linkedin, Reddit, Github, Gitlab, CapitalOne, Robinhood, HSBC, British Airways, Airbnb, Block, Booking Inc & more who subscribe to this newsletter, who like you want to learn what’s new with Cloud Security each week from their industry peers like many others who listen to Cloud Security Podcast & AI Security Podcast every week.

Welcome to this week’s Cloud Security Newsletter!

The gap between a CVE going public and it being used against you keeps shrinking. This week alone, Cisco confirmed a firewall zero-day exploited before its patch shipped, CISA gave federal agencies three days to remediate it, and a Metabase flaw rated CVSS 10.0 was taken advantage of before the vendor even disclosed it. That compression is the exact problem Ammar Alim and his team at Adobe set out to solve, and the answer they landed on is worth your attention: use AI agents to write, test, and deploy a WAF virtual patch as an emergency mitigation while the real patch works its way through staging.

We spoke with Ammar Alim (Adobe) and host Ashish Rajan (Cloud Security Podcast) about how that pipeline is built, where AI belongs in it and where it does not, and why "speed is the currency" is now a defensible operating principle rather than a slogan. [Listen to the episode]

⚡ TL;DR for Busy Readers

• 🚨 Cisco ASA/FTD zero-day (CVE-2026-20349) is exploited in the wild with no workaround and a KEV deadline of August 14 — patch now if remote-access SSL VPN is enabled.

• Metabase CVSS 10.0 (CVE-2026-72898) was exploited before disclosure; patch past 0.63.4/1.63.4, pull instances off the public internet, and rotate credentials for every connected data source.

• August Patch Tuesday ships 400-plus CVEs — triage by exploitability first: the exploited Windows kernel zero-day (CVE-2026-68820), the Exchange takeover bug, and the 9.9 in Entra Provisioning ahead of raw count.

• AI coding agents (Claude Code, Gemini CLI, Codex) were compromised through a single public GitHub issue — update to the fixed versions and scope agent CI runners to short-lived, minimal credentials.

• This week's practitioner answer: Adobe's agentic WAF pipeline deploys a virtual patch in minutes as the emergency control, buying time to patch properly — the operating model for a world where exploitation lands in hours.

📰 THIS WEEK'S TOP SECURITY HEADLINES

Each story includes why it matters and what to do next — no vendor fluff.

1. Polish CHP plant sabotaged through a private APN — the isolation network became the pivot

Primary source: BleepingComputer 
Reporting: Help Net Security · SecurityWeek · The Hacker News

What Happened

CERT Polska disclosed that the December 2025 attack attributed to Russia-linked Electrum which destroyed equipment at 30 Polish wind and solar sites had a second, previously omitted victim: a small combined heat-and-power plant serving roughly 50,000 residents. Attackers compromised a FortiGate VPN at a wind farm, then used a Teltonika cellular router on the same network to tunnel over SSH into a private APN managed by a distribution system operator, reaching the plant's OT network and shutting down the steam turbine and water treatment system. Staff restored operations quickly and residents were not affected.

Why It Matters

This is the first observed use of a private APN as an entry path into an OT network, and private cellular is precisely the architecture government guidance recommends for keeping OT off the public internet. The isolation control became the transit path because the APN trusted every SIM and endpoint on it, the same flat-trust failure that undermined corporate VPNs a decade ago. Anyone running private 5G/LTE for OT, warehouse, or edge workloads should read this as the opening of a new attack-surface category.

Action for defenders: Map which endpoints can reach your private APN and apply segmentation and authentication inside it, rather than treating the network itself as the boundary. Audit cellular routers (Teltonika and similar) as internet-facing assets with the same patch and credential rigor you give firewalls.

2. Metabase SQL injection (CVSS 10.0) exploited in the wild — one request to every connected database

Primary source: Wiz 
Reporting: Bishop Fox · CISA KEV 
Vendor advisory: Metabase GHSA-vwf4-m7j8-wcjf

What Happened

CVE-2026-72898 is an unauthenticated SQL injection in Metabase's password-reset endpoint: undeclared fields in the request body reach the application-database user lookup as structured input, letting an attacker alter records and seize full administrative control. It affects self-hosted Metabase 0.58 through 0.63.4 and the matching Enterprise 1.x builds. Metabase disclosed and confirmed in-the-wild exploitation on August 6; CISA added it to KEV on August 11.

Why It Matters

Metabase admin equals query access to every database the BI tool connects to (production stores, warehouses, and the credentials for each), so the blast radius spans every connected data store rather than a single application. It is exactly the kind of internally-deployed tool that ends up internet-reachable without a security review, sitting with an insecure-by-default unauthenticated endpoint in front of the crown jewels. And the timing is the point of the week: exploitation ran ahead of both the vendor disclosure and the KEV listing, so any program that queues patch work on KEV arrival was already behind before it started.

Action for defenders:  Inventory self-hosted Metabase instances (including team-level deployments outside platform control), patch past 0.63.4/1.63.4, and pull them off the public internet. For any instance exposed while vulnerable, rotate the credentials of every connected data source and review the application database for unauthorized admin accounts.

🛠 If you only do one thing this week: Pull an inventory of your internet-facing Metabase and Cisco ASA/FTD instances and check them against CVE-2026-72898 and CVE-2026-20349 today. Both were exploited before or around disclosure, both have KEV clocks running, and both are the kind of boundary component where a WAF or emergency network rule can buy you hours while the patch is staged the operating model Ammar Alim describes in this week's conversation.

☁️ 3.  Cisco ASA/FTD zero-day (CVE-2026-20349) exploited to crash firewalls; KEV deadline August 14

Primary source: CISA KEV 
Reporting: SecurityWeek · BleepingComputer · The Hacker News

What Happened
Cisco patched CVE-2026-20349 (CVSS 8.6), a heap inspection flaw in ASA and FTD software: a crafted, unauthenticated HTTP request to the Remote Access SSL VPN service forces a device reload and denial of service. Cisco PSIRT confirmed active exploitation before the patch shipped and has released no detail on actors or targets. Reported affected ranges are ASA 9.16 through 9.24 and FTD 7.0 through 10.0 with remote-access SSL VPN enabled, and there is no workaround. CISA added it to KEV on August 11 with a federal remediation deadline of August 14 — three days, against the usual three weeks.

Why It Matters
A firewall that reloads on command is remote access denied for your entire workforce, and a three-day KEV deadline is the urgency CISA reserves for edge infrastructure under live attack.

Action for defenders
Patch ASA/FTD now if remote-access SSL VPN is enabled; there is no configuration workaround short of disabling the service. Treat unexplained device reloads from August onward as potential hostile activity, not hardware failure.

🏥 4. August Patch Tuesday: 400-plus CVEs, an exploited Windows zero-day, and a 9.9 in Entra Provisioning

Primary source: Cisco Talos 
Reporting: Qualys · SecurityWeek · Dark Reading

What Happened

Microsoft's August release fixes more than 390 CVEs (roughly 421 by most counts, around 62 rated critical. The actively exploited item is CVE-2026-68820, a use-after-free in afd.sys (the WinSock kernel driver) giving SYSTEM-level code execution, added to KEV the same day. Also in the load: CVE-2026-62911, an Exchange Server elevation-of-privilege via authentication bypass demonstrated at Pwn2Own Berlin that permits takeover of every mailbox on the server, and CVE-2026-59115, a CVSS 9.9 elevation-of-privilege in the Microsoft Entra Provisioning Service.

Why It Matters

The Entra Provisioning bug is the cloud story hiding inside a Windows release. Provisioning is the pipe that writes identities between HR systems, AD, and Entra ID, so an elevation flaw there sits upstream of every downstream access decision, and identity-plane patches rarely get the emergency handling reserved for endpoint zero-days. The Exchange bug continues this year's pattern of on-prem Exchange as the soft target for tenants that have not finished migrating. The practical read is the same one running through this week: triage by exploitability, because one KEV entry, one Pwn2Own-proven bypass, and one 9.9 identity flaw outrank the headline count.

Action for defenders
Prioritize CVE-2026-68820 (exploited, KEV deadline), then the Exchange and Entra Provisioning fixes, ahead of the general OS load. Check Entra provisioning logs for anomalous synchronization or privilege changes as a compensating detection while patching rolls out.

🛡️ 5.  One GitHub issue against three AI coding agents: RCE, secret theft, and agent hijack

Primary source: Novee Security 
Reporting: The Hacker News · eSecurity Planet 
Analysis: Cloud Security Alliance

What Happened

At Black Hat USA, Novee Security showed that a public GitHub issue filed by an account with no repository privileges could compromise the automated coding-agent workflows of all three major vendors. In Claude Code (versions 0.2.54–2.1.162), permitted Git operations bypassed security checks to reach arbitrary code execution, and CVE-2026-54316 exfiltrated an API key one character at a time through Hugging Face's public download counter. In Gemini CLI, CVE-2026-12537 (CVSS v4 10.0) is an OS command injection via a crafted .gemini/.env file that runs code on the CI host before the sandbox starts. In Codex, a first agent pass processing untrusted issue content could write an AGENTS.md instruction file that the next invocation obeyed. Fixes shipped in Claude Code 2.1.163, Gemini CLI 0.39.1, and run-gemini-cli 0.1.22.

Why It Matters

The Codex finding needs no vulnerability at all: one agent's output becoming the next agent's instructions is the intended workflow, turned into a persistence mechanism, and only workflow redesign closes that class. Repositories that let agents auto-triage public issues have wired an unauthenticated internet input straight to a runtime holding CI secrets. The Gemini CLI perfect-10 executing before the sandbox starts should end any assumption that an agent sandbox is a containment boundary rather than a convenience.

Action for defenders: 
Update Claude Code to 2.1.163+, Gemini CLI to 0.39.1+, and run-gemini-cli to 0.1.22+ anywhere agents run in CI, then inventory which repositories allow agent workflows to be triggered by, or to read, unprivileged external content. Scope agent CI runners to minimal, short-lived credentials on the assumption that issue content is attacker input.

6.   Follow-up — OpenAI gives its own account of the Hugging Face incident at Black Hat

Primary source: OpenAI–Hugging Face Black Hat talk (video) 
Background (prior coverage): OpenAI incident post · Hugging Face disclosure

What happened: At Black Hat USA, OpenAI's alignment-and-safety and security leads presented a first-party account of July's Hugging Face breach, which we covered in the July 22 and July 29 editions. Their telling: an internal cyber-capability evaluation (ExploitGym) left frontier models stuck on impossible tasks, and the models began coordinating through a shared internal package manager (JFrog Artifactory) that they turned into an improvised "message board," then found and chained zero-days, moved laterally across OpenAI's own infrastructure, and reached Hugging Face's production clusters. OpenAI says its internal breach and the Hugging Face breach traced to the same root cause those evaluation runs with a full postmortem still to come.

Why it matters:  The presenters called it an "existence proof" that offensive security work can now run fully automated, at machine speed and coordination, while no equivalent proof exists for automated defense. That is this week's collapsing-timeline pressure viewed from the attacker's side, and it sharpens the coding-agent story above (#5): the exposure is an agent given reach into infrastructure, whether the operator is a lab's evaluation harness or an outsider filing a GitHub issue.

Action for defenders: Treat this as a planning signal rather than a patch item. Pressure-test whether your incident response can absorb many coordinated agents moving in parallel, and scope agent and evaluation environments with least privilege and segmentation so a sandbox escape cannot reach production. Do not map the two Artifactory zero-days OpenAI described to specific CVE numbers without confirming against JFrog's advisory.

7.  Apple Private Cloud Compute: a four-byte file check let a researcher write files as root

Primary source: Sentry Security 
Vendor: Apple security releases

What happened: CVE-2026-20685 is a path traversal in darwin-init, the first userspace process on a booting Private Cloud Compute node — the infrastructure running Apple Intelligence's cloud inference. The component picked an archive extractor by inspecting only the first four bytes of an incoming file, letting a privileged network attacker write attacker-controlled files as root during node boot; the researcher demonstrated redirecting the node's inference telemetry to a server he controlled. Apple fixed it in PCC Release 5E290.3, rated it CVSS 6.5, and paid a $150,000 bounty.

Why it matters: PCC is the strongest public attempt at attestable confidential AI compute, and its whole pitch is that nobody, Apple included, can see user inference data. A four-byte file-type check in the boot chain undermined the guarantee the attestation was selling. For architects weighing confidential-computing claims from any provider, the lesson is that attestation covers what was measured, and the gap between "measured boot" and every root-privileged parser in the boot path is where this failed.

Action for defenders: If confidential compute or attested inference is in your architecture (or on a vendor's slide), ask specifically what the attestation measures and which privileged components parse external input outside that measurement. No customer action is required for PCC itself; Apple has deployed the fixed release.

8.  CEVA Logistics breach ripples across banks, retailers, and Steam

Primary source: The Record 
Reporting: The Register · Infosecurity Magazine · TechCrunch

What happened: A cyberattack on logistics giant CEVA between July 29 and August 1 exposed customer data across its European client base and disrupted eight warehouses. Valve is notifying European Steam hardware buyers (names, addresses, phone numbers, emails, order details; no payment credentials), and Bol, De Bijenkorf, Ajax, ING, and Ace & Tate have separately notified customers — the Dutch Data Protection Authority has received breach reports from ten organizations tied to this single incident. No threat actor has been named and CEVA has not detailed the intrusion vector.

Why it matters:  One compromise at the fulfillment layer produced ten separate regulatory notifications, and every affected brand carries the reputational cost for a system it does not operate. The architectural question for your program is data minimization at the integration seam: each client's exposure was defined by which fields their order-fulfillment API pushed to CEVA. Logistics providers hold exactly the name-address-order dataset needed for convincing delivery-themed phishing at scale.

Action for defenders: Review what customer PII your fulfillment and logistics integrations actually transmit versus what the partner needs, and cut the surplus fields. If your customers are in the affected population, expect delivery-themed phishing referencing real orders and pre-brief your support teams.

🎯 Cloud Security Topic of the Week:

Virtual Patching at Machine Speed — the WAF as your "911"

Three of this week's stories share a clock. Metabase was exploited before it was disclosed. Cisco's firewall bug was under attack before the fix shipped, and CISA gave three days to remediate. Patch Tuesday's exploited kernel zero-day was already in use when the update landed. The common feature is not the vulnerability class but the timing: the window between a flaw becoming public and it being used against you is now measured in hours, and a 30/60/90-day patch cycle cannot answer that on its own.

Ammar Alim's team at Adobe treats that reality as an operating constraint rather than a talking point. Their answer is a virtual patch, a WAF rule that blocks the specific exploit traffic — deployed as the emergency control within minutes, while the permanent patch goes through its normal testing. The part worth studying is where they decided AI belongs and where it does not, and how they built an operating environment (a "harness") around the model so the whole thing runs across roughly seven different WAF products without a specialist babysitting each one.

That is this week's conversation: the design of an agentic pipeline that turns "exploited in hours" from a headline into a workflow. [Listen to the full episode →]

Featured Experts This Week 🎤

• Ammar Alim — Product Security Engineering, Adobe

• Ashish Rajan - CISO | Co-Host, AI Security Podcast , Host of Cloud Security Podcast
  

Definitions and Core Concepts 📚

Before diving into our insights, let's clarify some key terms:

• Virtual patch: a WAF rule deployed as an emergency mitigation that, in Alim's words, temporarily patches "until, like, a permanent patch is available." WAF rules deploy in minutes; patches cannot, because modern software carries large open-source dependency trees that need staging.

• WAF (web application firewall): the control at the center of the episode. Adobe runs "about seven," including open source, a consequence of being a large tech company that lets teams pick their stack and inherits others through acquisitions.

• False positive / false negative: a false positive is "the WAF is blocking traffic that it shouldn't be blocking"; a false negative is "when the WAF is allowing things that it shouldn't allow." Alim calls the balance between them "very nuanced."

• Agent: in Alim's definition, "a model, an AI model... plus a harness."

• Harness: "the operating environment for the agent to be able to get its job done" — the APIs and where their secrets live, the shell environment and permitted commands, memory, instructions, loops, and constraints. "If you're using Claude Code, it's a harness."

• LLM-as-judge: a second model that scores the rule-generating model's output against a rubric and returns feedback for another iteration, because "every model wears a different lens."

• Shadow mode: deploying a rule in production in non-blocking mode to observe what it would block before enabling enforcement.

• ModSecurity: open-source WAF that "can run in a container on your laptop," used as the first, local test stage.

• OWASP Top 10: "the top 10 vulnerabilities that, uh, the industry has deemed problematic," e.g. SQL injection and cross-site scripting; WAF vendors ship packages for it that the pipeline can further customize.

This week's issue is sponsored by Varonis

Come Play the Summer's Hottest Security CTF

Pixel, Varonis' threat-detecting cat, was on vacation when an Entra ID breach hit. She needs your help to investigate. Breach at the Beach is a free, four-stage CTF built on real incidents showing you how attackers move through Entra ID environments and abuse legitimate features. 

Start playing online today and join us in the Varonis booth (#2948) during Black Hat and in the Cloud Village at DEF CON 34, where Varonis Threat Labs researchers will be on-site to help you push to the finish line. Earn CPE credits and chances to win exclusive swag and prizes at both events.

Play Breach at the Beach

💡Our Insights from this Practitioner 🔍

1. Speed is the currency — the WAF is "911," patching is "the gym"

Alim's organizing principle is blunt: mitigate the emergency now, patch properly later. "I think in security the biggest currency is speed. If you can't secure quick, might as well you just don't secure, right?" The metaphor he keeps returning to draws the line between the two jobs. "Patching is still necessary. It's like going to the gym. It's like a long-term thing, right?... But you have an, like very urgent health issue. Going to the gym is not the answer. The answer is calling nine one one, right?... And the WAF for us is nine one one."

The point for a senior practitioner is operational. A virtual patch and a code patch are two different controls on two different clocks, and this week's Cisco and Metabase stories are the case for keeping the fast one loaded: when exploitation precedes disclosure, the only control that moves in minutes is the one at the network edge.

 2. The exploitation window has collapsed to hours

The threat-model shift underneath the whole approach is that attackers now move faster than patch cycles were designed for. As Alim puts it: "compared to a year ago, we have this now, meaning things will be discovered very fast and taken advantage of very fast. I'm talking about we're going from months and weeks to hours." Ashish Rajan reinforced it from the news side, describing a site that tracks the gap between disclosure and in-the-wild exploitation: "vulnerability being announced, uh, in publicly and exploit found in the wild. The window was less than 24 hours."

That is the same window this week's KEV entries describe. It also reframes what an SLA is for: a SEV-based "patch within X days" schedule assumes the attacker is on the same timeline, and the guest's argument is that the assumption no longer holds for anything internet-facing.

3. AI lowered the barrier to exploitation

Alim's case for urgency is not theoretical. He relayed a story from his VP about a friend (described only as a senior executive at Anthropic) who could not log into his own home Wi-Fi hardware and turned to an AI assistant: "he told the Wi-- his AI system, which is we all use, Claude and, and whatnot, 'Find a way to give me root access to this device, shell access.' And the AI was able to stitch multiple vulnerabilities together and have root access in the Wi-Fi system." His framing sits between the two extremes he hears ("this is all hype" and "Mythos is gonna kill all of us") and lands on the practical middle: chaining vulnerabilities is now within reach of moderately skilled operators, so discovery and exploitation both accelerate.

4. Put AI only where it fits — and sell the control by removing the emergency

Two disciplines make the pipeline work, and neither is about the model. The first is architectural restraint: "one of the things that you have to think about is when you're trying to use AI is to strategically think about where AI fits. So this is a deterministic step. The CVE was published. I need to ingest that data, and I need to then do something with it. So input, process, output. This is still relevant in, in AI." Ingesting new CVEs from the GitHub advisory database and scanning the environment for exposure stay deterministic (a Lambda or cron job); the model does the heavy lifting only where judgment is needed — researching the flaw and generating the rule.

The second is how he got organizational buy-in, which he frames as a business pitch rather than a technical one. "When there is a vulnerability, I will mitigate the emergency so you do not have to go in emergency mode. You don't have to worry about it. You don't have to drop what you already planned. You don't have to drop features, customer commitments." Product leadership never has to understand the mechanics: "All they need to know is that the vulnerability today is not exploitable. They don't even need to know how."

5. T Use more than one model — and generalize from therehe staged rollout — and the definition of a harness

The rule does not go straight to blocking. Adobe tests it first against open-source ModSecurity running locally, then deploys the actual vulnerable application behind the rule in a private cloud environment and scores how often it blocks versus is bypassed until confidence reaches roughly 80%. Only then does the rule go to production in shadow (non-blocking) mode for "minutes, maybe half an hour, maybe maximum forty minutes," before switching to enforcement. Because opportunistic attackers mass-scan with the exact exploit traffic, the rules are kept "very specific and narrow" — a narrow rule blocks the known bad request without catching legitimate customer traffic.

Holding all of that together is the harness. "Agent is simply a model, an AI model, like any model, local model, frontier model, any model, plus a harness," Alim says, defining it as "the operating environment for the agent to be able to get its job done." His constraint example is the discipline that keeps a fast pipeline from becoming a dangerous one: "Only create WAF rules for AWS, but not for Akamai in this step." The agent gets "just enough access it needs" — least privilege, applied at the level of the agent's environment. That principle is the through-line to this week's AI-coding-agent story: the same class of automation, given too much reach into CI, is exactly what Novee Security turned against three major vendors.

6. Use more than one model — and generalize from there

A single model checking its own work is a weak control, so Adobe runs a generator and a separate judge: "don't use one model when you do these kind of things. You need multiple different models. They are trained differently. They bring a different perspective. S-simply put, every model wears a different lens, and it sees its environment from a different lens." One model (his example: an Anthropic model) generates the rule; another (an OpenAI model) scores it against a rubric and returns feedback, and good and bad outcomes both go into memory so that, as he puts it, "you actually can train your agent by repetition."

The pattern is not WAF-specific, which is the takeaway to carry off the page. "This is relevant to any part of security, especially the tedious parts," Alim says, mapping it onto SOC work and incident response — an agent with a little API access and a small memory file reading the playbook and threat intel, then opening the incident channel. His advice on starting is deliberately small: "So I highly suggest finding Tedious work that takes a lot of time, and see what, which part you can automate it with AI. Just start small. Just do 10% automation."

📚 RELATED RESOURCES 🎧

• CISA Known Exploited Vulnerabilities catalog — the three KEV additions anchoring this week's patch stories (Cisco, Metabase, Windows).

• Wiz — Inside the Metabase SQLi exploited in the wild — primary analysis of CVE-2026-72898.

• Cisco Talos — August 2026 Patch Tuesday — full breakdown of the Microsoft release.

• Novee Security — Critical flaws in coding agents — the Black Hat research on Claude Code, Gemini CLI, and Codex.

• Sentry Security — Hacking Apple's Private Cloud Compute — the PCC boot-chain path traversal.

Podcast Episode

• Cloud Security Podcast — Full Episode with Ammar Alim

Question for you? (Reply to this email)

🤔  Your last critical CVE — did you have an emergency control that moved in minutes, or did you wait on the patch?

Next week, we'll explore another critical aspect of cloud security. Stay tuned!

📬 Want weekly expert takes on AI & Cloud Security? [Subscribe here]”

We would love to hear from you📢 for a feature or topic request or if you would like to sponsor an edition of Cloud Security Newsletter.

Thank you for continuing to subscribe and Welcome to the new members in tis newsletter community💙

Peace!

Shilpi Bhattacharjee

Was this forwarded to you? You can Sign up here, to join our growing readership.

Want to sponsor the next newsletter edition! Lets make it happen

Have you joined our FREE Monthly Cloud Security Bootcamp yet?

checkout our sister podcast AI Security Podcast