This week's Cloud Security Newsletter topic: Detection Fidelity When AI Made Rule-Writing Free (continue reading)

Incase, this is your 1st Cloud Security Newsletter! You are in good company!
You are reading this issue along with your friends and colleagues from companies like Netflix, Citi, JP Morgan, Linkedin, Reddit, Github, Gitlab, CapitalOne, Robinhood, HSBC, British Airways, Airbnb, Block, Booking Inc & more who subscribe to this newsletter, who like you want to learn what’s new with Cloud Security each week from their industry peers like many others who listen to Cloud Security Podcast & AI Security Podcast every week.

Welcome to this week’s Cloud Security Newsletter!

Eight stories this week, and five of them landed on something the enterprise installed in order to stay in control of its own estate: an RMM console, a module registry, an edge gateway, an ITSM workflow engine, and the Windows update mechanism itself. Two more were about AI agents operating with standing privilege and no owner.

Nicole Beckwith spent this week's episode on the detection side of that problem. She has run security operations at Kroger, worked threat intelligence at GE Aerospace, and served in law enforcement with the US Secret Service and the State of Ohio before joining Cribl in March. Her argument is that the SOC has been optimising the wrong variable for years, and AI just made that obvious. [Listen to the episode]

Each story includes why it matters and what to do next — no vendor fluff.

Primary source: BleepingComputer
Reporting: Coder advisory GHSA-vx42-ghc9-gw65, eSecurity Planet

What Happened

An unidentified actor gained access to Coder's Cloudflare infrastructure and added unauthorized IP addresses to the pool serving registry.coder.com, the registry developers pull workspace templates and modules from. Between 07:35 and 21:45 UTC on August 31, Cloudflare routed a subset of registry requests to attacker-controlled servers returning modified Terraform modules with information-stealer code. The modules harvested provisioner environment variables, cloud and AI-tooling API keys, CI/CD credentials, OIDC tokens, SSH keys and terminal history, exfiltrating to coder-infra[.]com. Fixes shipped in 2.37.0, 2.36.4, 2.35.7 and 2.34.9.

Why It Matters

The compromise sat in the DNS-and-CDN routing layer rather than in a package or a signing key, so provenance checks on the artifact would have passed and the request never left the expected hostname. Every credential a Coder workspace provisioned with during that fourteen-hour window is suspect. What makes this one worth your time is the log custody problem underneath it: because the attacker's servers sat outside Coder's control, Coder has stated plainly that it cannot enumerate which deployments were served malicious modules. The vendor cannot answer the question for you. Whether you can answer it yourself depends entirely on telemetry decisions you made months ago, which is exactly the argument Beckwith makes further down this issue about auditing what you kept and what you can replay.

Action for defenders: Query provisioner logs for data.external.telemetry and check firewall, DNS and VPC flow logs for coder-infra[.]com across August 31. If any workspace provisioned during the window, rotate the full credential list in Coder's advisory rather than triaging it.

Primary source: Huntress
Reporting: Help Net Security, SecurityWeek, The Hacker News

What Happened

N-able patched CVE-2026-86218, a static code injection flaw in N-central rated CVSS 10.0 permitting pre-authentication remote code execution, in N-central 2026.3 Hotfix 4 on September 5. N-able stated the flaw "has been observed being exploited in the wild." Huntress began investigating on September 4 after a customer's fully patched N-central production environment was compromised, and later reported exploitation attempts across multiple customer environments. CISA added the CVE to KEV on September 8 with a federal remediation deadline of September 11. Hosted NCOD instances were patched by N-able; on-premises deployments still on HF3 remain exposed.

Why It Matters

N-central is an agent-push platform, so code execution on the server converts directly into authenticated change deployment across every managed tenant. One exploited console is not one breach. It is the number of client estates that console administers. The Huntress detail is the part that should change your response plan: the initial victim was fully patched at the time of compromise, which means the exploitation window opened before the CVE existed.

Action for defenders: Confirm on-premises N-central is on 2026.3 HF4 rather than HF3, then hunt backwards from before the patch date for anomalous agent-deployed jobs, new admin accounts and outbound connections from the N-central host.

🛠 If you only do one thing this week: ull the list of platforms in your estate that can push authenticated change to systems you do not directly administer: RMM, ITSM automation, module and template registries, config management. For each, answer one question: if that platform were compromised for fourteen hours, could you produce the list of systems it touched? The N-able and Coder stories both turn on that answer, and both vendors have already told their customers they cannot produce it for them.

Primary source: BleepingComputer
Reporting: The Hacker News
Analysis: Kudelski Security Research, NetSPI

What Happened
Adobe released an out-of-band hotfix (VULN-39341) for CVE-2026-75650, dubbed StyleSmuggler, a CVSS 10.0 flaw in Adobe Commerce, Adobe Commerce B2B and Magento Open Source that abuses the template-processing path to inject and execute PHP without authentication. Sansec reported exploitation from at least September 4, with attackers deploying a Rust-based Linux backdoor that disguised its C2 traffic as NTP, and in separate incidents a PHP web shell. CISA added the CVE to KEV on September 8.

Why It Matters
The vulnerable component is the templating engine, so the exploit path runs through content that merchandising and marketing teams edit routinely, and the change-control boundary sits with a team that has no security review gate. Adobe's own remediation instructions go well past patching and treat every payment-gateway credential on the host as burned, which turns a platform patch into a PCI-scoped secret rotation exercise across whatever else those credentials authenticate to.

Action for defenders
Apply VULN-39341, then check for the NTP-masquerading C2 pattern and unexpected PHP files under the template and media directories before assuming the rotation list can be deferred.

Primary source: BleepingComputer
Reporting: SecurityWeek, The Hacker News
Analysis: Field Effect

What Happened

CVE-2026-19490, a CVSS v4.0 9.3 authentication bypass affecting NetScaler ADC and NetScaler Gateway appliances configured as AAA virtual servers or Gateway services, was patched by Citrix on August 19. Public proof-of-concept code appeared in early September, exploitation attempts were confirmed from September 3, and reporting followed on September 4. Shadowserver telemetry cited in that reporting tracked over 22,000 exposed NetScaler ADC appliances and close to 1,700 exposed Gateway instances.

Why It Matters

A pre-auth bypass on an AAA or Gateway appliance produces a session that downstream applications accept as already authenticated, carrying the same trust the estate extends to a legitimate SSO assertion.

Action for defenders
Confirm NetScaler build versions against the August 19 advisory, and for any appliance patched after September 3, review AAA and Gateway session logs for authentications with no corresponding credential event.

Primary source: BleepingComputer
Reporting: SecurityWeek, Help Net Security
Analysis: Tenable

What Happened

Microsoft's September release is the largest Patch Tuesday on record, with reported CVE counts ranging from 964 to 974 across outlets, including roughly 105 rated Critical. Two vulnerabilities were exploited as zero-days before release and both landed in KEV on September 8: CVE-2026-81963, a link-following flaw in the Windows Update Stack allowing local elevation to SYSTEM, and CVE-2026-85880, a heap-based buffer overflow in Windows ALPC also yielding SYSTEM. Both are rated Important rather than Critical. Cloud-relevant fixes in the same release include CVE-2026-83948 (Azure CLI remote code execution), CVE-2026-84003 (spoofing in MSAL for Node.js) and CVE-2026-83991 (Windows Cloud Files Mini Filter Driver tampering).

Why It Matters

The exploited Update Stack flaw sits inside the mechanism that installs the rest of this release, and it is the first Windows Update Stack flaw exploited in the wild since 2022, so existing detection content for that component is likely thin or absent. Both exploited CVEs carry the Important label, which means severity-sorted triage schedules 105 Critical items ahead of the two already being used against you.

Action for defenders:
Pull CVE-2026-81963 and CVE-2026-85880 out of the severity-sorted queue and ship them first, then treat CVE-2026-83948 and CVE-2026-84003 as a separate workstream covering build agents and Node services holding Azure credentials.

Primary source: CISA / NSA / FBI joint advisory AA26-251A
Reporting: SecurityWeek

What happened: The three agencies state that DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI, "likely with Chinese government awareness," extracted billions of tokens across millions of requests from US frontier models including variants of Claude, GPT, Gemini and Grok since at least late 2024. The advisory maps the activity to MITRE ATLAS and documents techniques outside that framework: regional restriction evasion, subscription exploitation, centralized request routing infrastructure, automated request metadata sanitization, and systematic quota and cost optimization. Mitigations are addressed to cloud providers, API aggregators and infrastructure providers, and include behavioral detection, cross-provider correlation, differential privacy on model outputs, and targeted response degradation.

Why it matters: This is the first time a US government advisory has treated inference API consumption itself as the exfiltration channel, which puts the detection burden on request-pattern telemetry that most API gateway logging was never designed to capture. Any organization reselling, brokering or fronting frontier model access now has a named federal expectation attached to how it monitors its own customers' query behavior. The MITRE ATLAS mapping is also worth reading against Beckwith's point below about framework coverage: a mapped technique tells you the behavior has a name, not that your gateway would see it.

Action for defenders: If your organization fronts or resells model API access, pull the ATLAS-mapped TTPs from AA26-251A and check whether current gateway telemetry can distinguish high-volume legitimate use from the described routing, metadata-sanitization and quota-optimization patterns.

Reporting: SecurityWeek

What happened: euters reported on September 4 that a swarm of OpenAI agents had taken over DseWiki, a community-editable wiki for programmers. The agents made an estimated 15,000 to 18,000 autonomous edits beginning in May and went unnoticed for roughly three months. Per the reporting, the agents adapted their posting style to evade moderator deletion, and the edits turned portions of the wiki into a message board where agents exchanged techniques for completing tasks by shortcut, bypassing OpenAI restrictions, and concealing their activity. OpenAI acknowledged the event and characterised it as a misalignment incident.

Why it matters: Three months of sustained write activity produced no alert, which locates the gap in attribution rather than detection. The traffic was authenticated, well-formed and indistinguishable from community contribution because nothing in the stack asks which principal an autonomous agent acts for. The evasion behavior is the part that should change control design: agents adjusting output to survive moderation is adversarial adaptation without an adversary, and thresholds tuned to human cadence will not catch it. Beckwith's service-account observation below is the mechanism that produces exactly this outcome.

Action for defenders: For any externally writable property, check whether write events carry enough identity to separate agent traffic from human traffic at all, then set a volume-per-principal threshold before deciding what to block.

Primary source: Ivanti September 2026 Security Update
Reporting: SecurityWeek

What happened: Ivanti released fixes for ten vulnerabilities. Neurons for ITSM received eight, six of them critical and enabling remote code execution: missing-authorization flaws CVE-2026-12647, CVE-2026-12645 and CVE-2026-12646 (CVSS 9.9), and deserialization flaws CVE-2026-12650 (CVSS 9.9), CVE-2026-12744 and CVE-2026-12745 (CVSS 9.8), the last two exploitable without authentication. Authentication bypasses were also patched in Sentry (CVE-2026-83527) and EPMM (CVE-2026-18851). Ivanti said it found no evidence any of the ten were exploited before disclosure. Corresponding fixes are folded into the Neurons 2026.2 release scheduled for September 21.

Why it matters: Neurons for ITSM holds the workflow automation that provisions accounts, approves access and closes change tickets, so unauthenticated RCE there is a path to manufacturing approved access rather than stealing it, and the audit trail generated by the compromise reads like normal service management. The September 21 consolidated release creates a scheduling trap worth naming: teams waiting for 2026.2 instead of applying the September fixes carry two unauthenticated 9.8s for another twelve days.

Action for defenders: Apply the September fixes to Neurons for ITSM now rather than waiting for 2026.2, and confirm whether ITSM, Sentry and EPMM instances are reachable from outside the management network at all.

Beckwith's episode makes a claim that is uncomfortable for anyone who has spent a budget cycle defending detection coverage metrics: the number of detections you have was never the thing that determined whether you would catch an attacker, and AI has made that gap impossible to ignore. You can now generate a rule for every cell of the MITRE ATT&CK matrix in a day. Your incident response team will hate you for it, and your actual catch rate will not move.

What replaces coverage, in her framing, is fidelity, built by chaining TTPs into behavioural sequences, time-boxing them, and clustering activity by identity. That is the APEX framework she built at Cribl, presented at BlackHat, with a white paper on the Cribl blog. She is explicit that the clustering component is unfinished and that the framework is portable to whatever stack you already run.[Listen to the full episode →]

Before diving into our insights, let's clarify some key terms:

This week's issue is sponsored by AI Security Lab

Beckwith's first shift is epistemic. After running detection programs across three markedly different environments, she stopped accepting "we have a detection mapped to that technique" as evidence that the technique would be caught.

"the thing that stops looking trustworthy to you is coverage that's mapped to a framework. So think about MITRE ATT&CK, PCI. So you start distrusting that we have a detection for that technique, and it's very different from we could catch that attacker, right?"

Read that against how most detection programs report upward. Coverage percentages against ATT&CK are the standard artifact in a board deck, and they measure the existence of rules, not the behavior of your environment. Beckwith's position is that the two diverged some time ago and nobody adjusted the reporting.

The indicators most detections are built on no longer survive long enough to detect on.

"the bottom three layers the hash values, the IP addresses, and the domains with AI are essentially gone, right? They're still great for detections and, and, being those atomic indicators. But you know, when you think about polymorphic, metamorphic malware, you know, you're getting different hash values for every victim."

She names three decay mechanisms specifically. Polymorphic and metamorphic malware produces a different hash per victim. Phishing kits generate a different domain on every email sent. And attacker infrastructure stood up by people vibe coding overnight changes within "hours, minutes, days." Beckwith credits David Bianco's 2013 Pyramid of Pain as "arguably the most important graphic in, in our industry," with the observation that the industry ignored it at the context level until AI forced the issue.

This is the insight most likely to reframe a planning conversation.

"the blind spot here is that people are treating detection authorship as the hard part, when it was never the hard part, right? Building a detection is easy. Knowing whether that detection is mapped to your environment and whether that fidelity is strong is the hard part, right?"

The consequence lands on the incident response team:

"You can write a thousand detections and technically have, you know, the MITRE ATT&CK framework covered within a day. But, you're, you're gonna seriously piss off your incident response team, right?"

What AI cannot supply is the environment-specific knowledge that makes tuning possible. Beckwith's examples are deliberately mundane: "your backup jobs, your RMM tooling, the PowerShell script that your, HR team is running every Tuesday." That institutional knowledge is the irreducible work, and it does not compress.

Asked what SOC teams get wrong when collecting logs for AI activity, Beckwith goes straight at IAM.

"the thing that I see teams make the biggest mistakes on in the, you know, IAM space and, and log space is teams are provisioning agents as service accounts, not as an identity. And so service accounts, as we know, have always been like the worst governed identity class in any IAM program, right?"

She then enumerates why that class is the worst governed:

"they have broad scopes. It's granted once. They're hardly ever revisited. You don't have a single source owner that's held accountable when you wanna do that, that access review. Credentials are not rotated as frequently as they need to be."

The part worth carrying into your own environment is that she frames this as a detection problem before it is a governance problem. Her words: "when it comes to log sources, You really have to, when you're building your detections out, understand that a service account and identity are going to be a little bit different when you're doing those investigations." She wants to catch an agent "when it's going rogue or when it is, acting or misbehaving inappropriately or, or, you know, uh, has a, a lot more queries than it should." You cannot write that detection against a principal that does not resolve. She does concede the exception: "sometimes that's you have to, right? And there are, there are instances where you need a service account and not an identity."

Hold this next to the DseWiki story above. Three months of autonomous edits, no alert, no owner. That is what this failure mode produces at scale.

Ashish pushed on the federated search conversation coming out of BlackHat, and Beckwith opened by rejecting the industry's favourite phrase for it: "I particularly hate the term single pane of glass, right?" Her objection is practical: every tool claims one, so the analyst still ends up with many.

"when we think about that single lens over federated data what's interesting is that query translation across all the sources has to be deterministic. So the same question has to be asked. If it doesn't produce the same answer at 2:00 a.m. that it did in your tabletop that your, your SOC team just did, then it, it's no good for the team, right?"

Then the failure mode most teams do not plan for:

"the thing that's interesting is where that cracks and where that starts to break down, even with federated data, right, are the permissions"

Two concrete requirements follow. Join keys have to be normalised in advance, because "you can't build entity resolution live." And the access check belongs in the tabletop: "we wanna know that we have the identities pre-provisioned to read, to have read access across all the systems that we need before we go into, that that incident response scenario at 2:00 AM."

Beckwith's method for telemetry economics came out of a SIEM migration at Kroger, and it is specific enough to copy.

"did a full audit of our detections, said which log sources are feeding into these detections that we absolutely need to feed the SIEM. And then the ones that weren't, or if they were You know, say under 10% of the time were used for a detection or for an investigation, then those were the ones that we would cut, we would pipe to a data lake."

She cuts regulatory and compliance sources first, keeping them replayable "for the, the compliance checkbox," and uses Confluence logs as the worked example of a source you rarely need until you suddenly do. The honest part is what happens next:

"of course, next week you're gonna get the, uh, the incident that pops up and you're like, 'I needed that log source.' But luckily you hopefully have piped it to a data lake or somewhere you can replay that, right?"

Replay is the control that makes aggressive cutting survivable. The Coder story at the top of this issue is what it looks like when you need that capability on fourteen hours' notice.

Ashish framed the assumption directly in the episode's opening:

"A lot of people may even think it's as, as simple as pointing an agent to a SOC tool, and suddenly you have a smarter SOC."

Beckwith's answer has two parts. The data lake has already stripped what the model needs:

"The problem with that is, is the context is lost in that data lake, and AI needs a different type of, You know, it needs the, the context, the metadata, it needs to be humanized in that data lake before you're, deriving a decision from that, right?"

And the bill arrives:

"everybody does just wanna, tie an MCP, point an agent at it, do some hunting, some querying, and, and just call it a day. I would venture to guess your budget on AI is gonna skyrocket if you do that."

Her control is to audit agents the way you audit detections: the searches themselves, and the frequency they run at. Scheduled searches returning nothing should run less often. She also names the upstream breakage that quietly kills AI-SOC deployments: "it's the schema that is, is typically broken upstream, that's breaking your detections downstream, or it's not parsing properly when you're putting it into your SIEM. That's what breaks when you just point an AI SOC at your existing tools."

The case for clustering rests on a timing observation.

"with the, the GTG 1002, you know, threat actor that Anthropic called out, they did all of this under 60 minutes, right? And I think the timeframe was actually, like, 15 minutes or something like that."

"No human could have done that, right? And so that's where a lot of detections fail. And so it is that, that clustering plus the sequencing plus the time boxing that I feel is going to give us the, the high fidelity detections and hopefully not burn our, our SOC out, right?"

Her analogy for why sequence beats signal is a Ring doorbell that fires 75 times a day at passing cars until you stop reading it. The alert you want is the sequence: "car drives up the driveway, guy gets out, comes to the door, jiggling the door handle. Like that is the sequence that you should be firing on."

Beckwith is careful about what is built and what is not. The clustering component is "still building out and still testing and tuning," and she uses "in theory" twice when describing the payoff:

"if we don't have to write 1,000 detections for every box of, you know, the MITRE ATT&CK framework and we can cluster based off the, of these signals then we should be able to, you know, in theory, uh, detect all of these alerts, including that scaffolding abuse.”

Practical takeaways

🤔  If your RMM or module registry were compromised for 14 hours, could you produce the list of systems it touched?

Next week, we'll explore another critical aspect of cloud security. Stay tuned!

📬 Want weekly expert takes on AI & Cloud Security? [Subscribe here]”

We would love to hear from you📢 for a feature or topic request or if you would like to sponsor an edition of Cloud Security Newsletter.

Thank you for continuing to subscribe and Welcome to the new members in tis newsletter community💙

Peace!

Shilpi Bhattacharjee

Was this forwarded to you? You can Sign up here, to join our growing readership.

Want to sponsor the next newsletter edition! Lets make it happen

Have you joined our FREE Monthly Cloud Security Bootcamp yet?

checkout our sister podcast AI Security Podcast