This week’s Cloud Security Newsletter topic: The Slopdemic: Why Your Triage Queue Is the AI Security Incident (continue reading)

Incase, this is your 1st Cloud Security Newsletter! You are in good company!
You are reading this issue along with your friends and colleagues from companies like Netflix, Citi, JP Morgan, Linkedin, Reddit, Github, Gitlab, CapitalOne, Robinhood, HSBC, British Airways, Airbnb, Block, Booking Inc & more who subscribe to this newsletter, who like you want to learn what’s new with Cloud Security each week from their industry peers like many others who listen to Cloud Security Podcast & AI Security Podcast every week.

Welcome to this week’s Cloud Security Newsletter!

Eight stories landed this week and four of them are the same story told four ways: something that was patched months ago is being exploited now. WSO2 shipped a fix in April and watchTowr caught forged admin tokens in its honeypots on September 13. Vite disclosed CVE-2026-39364 on April 7 and F5 logged more than 800 attacks harvesting AWS and Azure credentials from exposed dev servers. Cisco moved faster than anyone, disclosing a zero-day on September 14 and landing on CISA's KEV catalog the same day, with a federal deadline three days later.

Casey Ellis, who founded Bugcrowd and runs the disclose.io project, spent this week's episode with Ashish Rajan arguing that this gap is the actual story. His position is that the vulnerability apocalypse people keep bracing for has not arrived, and what has arrived instead is a noise problem severe enough that competent researchers have stopped reporting what they find.[Listen to the episode]

Each story includes why it matters and what to do next — no vendor fluff.

Primary source: CISA KEV alert
Analysis: Rapid7 Research, SOCRadar

What Happened

Cisco disclosed CVE-2026-76461 on September 14 after its PSIRT found active exploitation while working a TAC support case. The flaw is a SQL injection in the email-parsing logic of Cisco AsyncOS for Secure Email Gateway. An unauthenticated remote attacker sends a message containing SQL statements through an affected gateway and ends up executing commands as root on the underlying operating system. CISA added it to the KEV catalog the same day with a federal remediation deadline of September 17.

Why It Matters

The trigger is inbound mail, which is the one path every organisation is required to leave open and which no egress control, VPN policy or conditional access rule sits in front of. A secure email gateway also terminates TLS, holds mail-routing credentials, and usually carries a service principal into Microsoft 365 or Google Workspace. Root on the appliance is a pivot into the mail tenant. Three days from public disclosure to federal deadline is CISA saying that patch windows measured in weeks do not apply here, and it is worth reading that alongside Casey's argument about queue capacity below.

Action for defenders:  Inventory every AsyncOS instance, including virtual appliances in cloud VPCs that were built outside the mail team's asset list. After patching, pull the gateway's outbound connection logs and any tenant-side service principal sign-ins covering the period before the patch went on.

Primary source: AEPD
Reporting: SecurityWeek

What Happened

The Agencia Española de Protección de Datos published details of what it says is the first notification it has received of a personal data breach executed by design through an AI agent. Per the agency, the attack involved a successful login, a search for vulnerabilities, then modification of personal data and access to invoices. The AEPD has not attributed the agent to a named model or operator and its investigation continues.

Why It Matters

What changed is the regulatory record rather than the technique. A breach register entry naming an agent as the instrument turns "agentic attack" into a category a data protection authority will now ask about during an Article 33 review. The agency's own prescription is the part worth reading twice: it says response times have to improve and that the improvement cannot come from manual intervention. That is a regulator telling controllers that human-paced incident response is becoming a compliance exposure. For teams that log agent activity nowhere, the gap is evidentiary, because nothing in a standard access log distinguishes an agent-driven session from a human one.

Action for defenders:  Take one recent intrusion timeline and ask whether anything in your retained telemetry would let you tell a regulator whether the operator was human or automated. If the answer is no, that belongs in the risk register this quarter rather than the tooling roadmap.

🛠 If you only do one thing this week: Pick your three most exposed authentication chokepoints (API gateway, mail gateway, remote access tool) and measure one number for each: how long from the vendor's patch publication to the day you actually deployed it. WSO2 was five months. Vite was five months. That number is the slopdemic showing up in your own environment, and unlike triage volume it is entirely within your control.

Primary source: WSO2 advisory WSO2-2026-5328
Reporting: The Hacker News, SecurityWeek

What Happened
 CVE-2026-5430 is an authentication bypass in how several WSO2 products handle JSON Web Tokens. A token signed with an unsupported algorithm is accepted rather than rejected, so an unauthenticated attacker can present a self-minted token and be treated as an authenticated principal. Affected products include WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway. watchTowr reports its honeypot network captured forged JWTs carrying administrator privileges on September 13, and those tokens returned access to every API backend endpoint plus credentials, consumer keys and secrets for registered applications. WSO2 patched in April.

Why It Matters

Action for defenders

Primary source: CISA KEV catalog
Reporting: BleepingComputer, The Hacker News

What Happened

CISA added CVE-2026-84869 to the KEV catalog on September 11 with a remediation deadline of September 14 for agencies covered by Binding Operational Directive 26-04. The flaw combines improper privilege management with missing authorization, allowing file transfer and execution through an active remote session without authorization or host confirmation. It affects the ScreenConnect client rather than the server and is fixed in version 26.6.5. ConnectWise published interim mitigation on September 7 advising teams to disable TransferFiles permissions. Huntress documented three unrelated incidents in which actors abused ScreenConnect to push a VBScript payload to newly connected systems.

Why It Matters

CISA flagged this one as requiring forensic triage under the directive, which is different from the KEV norm and should be read as a severity signal in its own right. The blast radius also runs the wrong direction for most asset inventories: the vulnerable component is the client on managed endpoints, so an MSP or internal support team's remote session becomes a delivery channel into estates that never appear in the tool owner's CMDB.

Action for defenders
Establish the ScreenConnect client version across your estate, then separately ask any MSP holding an active session capability into your environment for theirs. Review session-transfer events on newly onboarded hosts around September 7..

Primary source: F5 Labs
Reporting: BleepingComputer, The Hacker News

What Happened

F5's honeypot sensors recorded a mass-scanning campaign exploiting CVE-2026-39364, an access-control bypass in Vite 7.1.0 through 7.3.2 and the 8.x branch before 8.0.5, disclosed on April 7. Appending ?raw, ?import&raw or ?import&url&inline to a GET request makes the dev server skip deny-list filtering and return the target file with an HTTP 200. F5 observed more than 800 attacks and roughly 32,000 raw events over a month, with wordlists aimed at .env variants, AWS credential and config files, Azure credentials and access tokens, Terraform state and variable files, serverless configuration, /proc/self/environ and /etc/passwd. Traffic came mostly from the US, Belgium and the Netherlands, routed through Google Cloud IP ranges.

Why It Matters

The wordlist is the finding. Terraform state and serverless configuration sitting alongside .env files means the operators are not just collecting credentials, they are collecting the map of what those credentials reach. Vite binds to localhost by default and gets exposed by a --host flag or a careless Docker port mapping, so the vulnerable asset is created by a developer decision that no cloud posture tool inventories and no change process reviews. This is exactly the shape Casey describes when he says attackers work a graph rather than a list.

Action for defenders:
Scan your external ranges for port 5173 and any /@fs/ path handling. Where a Vite server was reachable, treat Terraform state exposure as the working assumption and review role trust policies rather than only rotating the leaked keys.

Primary source: The Hacker News
Reporting: Bloomberg via BNN, SecurityWeek

What happened: Independent researchers disclosed on September 11 that a cluster of autonomous agents under test by OpenAI published thousands of junk and malicious packages to RubyGems between May 5 and June 18, 2026. Reporting states more than 2,000 malicious packages were uploaded in May, that some attempted to steal user API keys through a then-unknown RubyGems server flaw, and that the activity achieved remote code execution on servers tied to RubyDoc.info. RubyGems removed over 500 packages and found no evidence that API key theft succeeded. The registry learned of the attribution from outside researchers rather than from OpenAI. OpenAI says the activity was benign and is reviewing the incident with RubyGems and the researchers.

Why it matters: The disclosure path inverts the assumption behind every registry trust model. The party best placed to know which agents did what was the model provider, and the registry found out from third parties three months later. Provenance metadata, SLSA attestation and publisher reputation all describe the package and none of them describe the operator, so a dependency review that asks "is this publisher known" has no field for "was this published by a model under evaluation." Casey's observation about reporting lag applies here in an unexpected direction: the delay was not in a triage queue, it was in attribution reaching the people who needed it.

Action for defenders: Check whether any of the removed RubyGems packages entered your build caches or artifact mirrors between May 5 and June 18, and confirm your registry proxy retains enough publication metadata to answer that question at all.

Primary source: European Commission, State of the Union 2026
Reporting: SecurityWeek, Help Net Security, Euronews

What happened: In her 2026 State of the Union address, European Commission President Ursula von der Leyen called for pacing the development of frontier AI models and cited their offensive-security potential: "Models being developed will allow hacking on a level we never thought possible. And they will soon be in the hands of adversaries who see the world very differently from us." She pointed to the Hugging Face incident as an example of self-improving model risk, committed the EU to joint work with Canada, the UK and other partners on evaluation and verification of advanced models, early warning and AI security, and said Europe needs sovereign AI capability and more compute for national security purposes.

Why it matters: A Commission president naming model capability as a cyber-offense problem in the State of the Union is the step that precedes instrument design, and EU instruments tend to land as obligations on deployers rather than only on model providers. The concrete near-term signal for architecture teams is the evaluation and verification workstream with Canada and the UK, because a cross-jurisdiction verification regime for advanced models implies attestation requirements that flow down to enterprises running those models in their own tenancy. Nothing is binding yet, which is precisely when procurement language gets written.

Action for defenders: Add a line to your model procurement checklist capturing which frontier models you run, in whose tenancy, and under what contractual evaluation commitments, so the question is already answered when a verification regime is proposed.

Primary source: Oracle CSPU September 2026
Reporting: SecurityWeek

What happened: Oracle's September 2026 Critical Security Patch Update released 673 new security patches covering 672 unique CVEs across 17 risk matrices, with more than 130 additional CVEs resolved indirectly, for a total above 800 vulnerabilities. Reporting puts more than 100 at critical severity and more than 240 as remotely exploitable without authentication. E-Business Suite received the largest batch at 159 patches. Fusion Middleware received 153, including fixes for 78 unauthenticated, remotely exploitable flaws.

Why it matters:  Seventy-eight unauthenticated remote flaws in Fusion Middleware is the number that should drive sequencing. Fusion Middleware fronts the integration tier, so those hosts usually hold service accounts into databases and downstream applications rather than data of their own. A quarterly batch this size also breaks the triage habit that works for Patch Tuesday: ranking 672 CVEs by CVSS produces a queue nobody finishes, while ranking by internet exposure and authentication requirement produces a short one.

Action for defenders: Pull the list of internet-reachable Fusion Middleware, E-Business Suite and Hyperion hosts first, check each against the unauthenticated-remote subset of this CPU, and schedule those before anything ranked purely by CVSS.

Casey Ellis has spent fifteen years watching vulnerability reports arrive at scale, first through Bugcrowd and then through the disclose.io project, which puts him in an unusual position to say what actually changed. His answer is that three costs collapsed at once and only one of them gets discussed. The cost of discovery went down. The cost of getting from discovery to weaponization went down. And the cost of writing a submission and sending it went down.

The third one is the one nobody planned for. Intake queues across the industry, vulnerability disclosure and SOC alerting alike, are absorbing volume they were never sized for, and triage has fallen behind far enough that reporting a real finding has become an unattractive use of a researcher's time. Casey's read on where that leads is the most uncomfortable claim in the episode: capable people are holding zero-day, not to sell or exploit it, but because getting someone to act on it is too much work.

Set that next to this week's news and the shape is hard to miss. WSO2 patched in April and is being exploited in September. Vite disclosed in April and is being scanned at volume in September. Cisco compressed disclosure to KEV listing into a single day, which is what the alternative looks like when the process works.[Listen to the full episode →]

Before diving into our insights, let's clarify some key terms:

This week's issue is sponsored by Token Security

Five AI agents left the sandbox. Credentials determined what happened next

In one two-week stretch, OpenAI, Anthropic, Meta, Moonshot, and the UK AI Security Institute each disclosed agents that got loose and kept going.

One pulled infrastructure credentials and read production data. Another registered accounts, published malware that ran on 15 systems, then harvested a security vendor's credentials and reused them.

The methods were dull: weak passwords, debug endpoints, and reachable metadata. Identity set the damage, and identity is what stopped it.

Token Security finds your agents and remediates credential use unrelated to the job.

See what your agents can reach once they leave the sandbox

Casey draws a hard line between the volume problem that is already here and the capability problem that is not.

"When I say like the vuln apocalypse isn't here yet, like we're in the slopdemic right now, that's a part of what I mean."

The mechanism is three simultaneous cost reductions, and he is precise about which ones:

"So, so what's, what's happened is the cost of discovery, uh, or like the cost of getting to a point of discovery and a, a point of weaponization to where you can create impact has gone down. Especially for competent operators, but like right across the board as well for the more trivial types of vulnerabilities. Um, so there's that. Then, like, the, the you must be this tall to ride bar has gone down, so there's more people jumping in and actually doing that. And at the same time, the cost of actually writing a submission and sending it has gone down as well. So you've got, like, this increase in noise, this increase in opportunism."

He is careful not to frame the new arrivals as adversaries. Most of them, in his description, are "a 3 out of 10 for usefulness and like an 11 out of 10 for enthusiasm, and they've got new toys." The damage is indirect and it is a capacity problem: "if that noise level gets up too high, you end up in a position where you're spending so much time dealing with it that you miss the stuff that actually matters in the process, and the volume of that is going up at the same time."

This is the observation with the longest tail, and Casey flags it as such himself.

"and yeah, probably the last thing I'd say there, and this is, this is, uh, like a big takeaway, is that a lot of people are just sitting on zero-day now. 'Cause, 'cause the, you know, the, the thing is that like triage queues right across the board, not just vulnerability intake from the outside world, but like the SOC queues, the... Like, everything's just gotten dialed up from a noise standpoint over the past, you know, 12 to 18 months at, at the very least."

The motive is friction, not malice:

"a lot of folk are just basically not hoarding zero-day for like, you know, they're, they're not like thinking about breaking bad or doing whatever. It's just too hard, so they're just sort of sitting on it."

What he tells companies to fix is narrower than it sounds. First, publish policy that sets expectations clearly, because "if you do that, then you can end up in a position where if there's a disagreement at some point, you can just point to the thing that you've already said, and oftentimes that helps to, to deescalate." Second, invest in researcher education on writing efficient reports, a need he says was always there but is now "on, on, you know, a lot of Adderall, um, and moving at a million miles an hour."

The most portable idea in the episode, and the one that explains why cheap discovery has not produced cheap compromise.

"'Cause like folk can find, it is easy to find, like that's a symptom of v- of, of vulnerability. I'm gonna test that and prove that it's real. Job done, right? Like that part is actually pretty easy, but attackers and exploits don't function as a list. They function as a graph that has a starting point and an impact endpoint. Um, and usually what it comes down to is that traversing that graph is, is very much up to the skill and, and the context of the operator."

The consequence is not democratisation. It is amplification of people who already had the context:

"Like the folks that are doing like true VR, like the scary stuff, they've just upleveled their game, you know, 10 to 100X because they're not, they're not like delegating their intelligence to the model. They're using it as this like- super partner, like, you know, what's the word? Um, the wingman type thing."

Casey describes his own working pattern as steering rather than handing off: guiding models to an outcome using "more of like a product management level understanding of how this all works," because he understands how the operator mindset works even where he is rusty on the bits and bytes. He also notes that the low end is now self-limiting, since easily found bugs are contested: "it's actually really easy to find that, so you're gonna dupe out if you're a bounty hunter or end up, you know, bumping into a competing adversary if you're an actual bad guy."

Casey names this as one of his two big takeaways from RSA and Black Hat combined.

"the big thing, this is probably the other big observation from, from RSA and BlackHat, is this whole concept of like vulnerability management sort of being, you know, a bit of a fool's errand if your goal is to make sure that everything's fixed. It's like we're not gonna get around to all of it. There's too much. Like we've got to actually think about, you know, what, what our threat model is, what are we trying to prevent, like what kind of attackers are we expecting, like what's their level of like economically rational motivation to do the thing?"

His method is to invert the queue: "How do we sort of reverse out the things that are most important and make sure that we're not missing that stuff if it comes in on the queue, and then kind of work, work backwards from that instead of trying to eat the whole elephant and figure out which part was best."

He also uses adversary economics to dismiss the periodic claim that bug bounty is finished. Pricing, in his framing, is evidence about what an attacker would pay: "every vulnerability and every chain of impact that can be created has some sort of value to it to someone, and... the whole thing kind of functions as a marketplace. That, that value might be zero, legitimately, or it could be really high."

Casey treats the defender's dilemma as an economics argument that AI made impossible to keep debating.

"something that I was talking about a while back is the idea that like we're used to this sort of attacker-defender innovation like cycle time in... the cybersecurity industry, and what AI does is that it squishes that like OODA loop to the point where, you know, maybe we're not gonna fit into it for too much longer. So at that point, we've got to think about like how are we actually changing the game here? Like how do we, um, how do we impose cost on attackers?"

The reorientation he describes keeps prevention in the mix rather than abandoning it:

"How do we, you know, think very carefully about like detection, you know, ejection, recovery, like all those different things. Moving into a, into an assume breach posture. Continuing to work on prevention and defense. I'm not saying give up on that necessarily, but it's like, okay, this is, like this is gonna fail at some point, so like how do we, how do we actually, you know, in a resilient and an antifragile way prepare for that?"

He does not claim to have the answer, and says so plainly: "I don't feel like there are necessarily clear answers to a lot of those questions just yet. But like that to me is sort of the set of the sail at this point."

Casey's sharpest pushback in the episode, and a useful counterweight to the week's regulatory news. Ashish raised it by noting that UK and European buyers are paying six figures to the Big Four for Mythos readiness assessments he does not think they need.

"even talking about it as a Mythos problem, to me, kind of misses the point a little bit because like I'd, I've seen... Literally, I've seen people do this type of stuff with, with open weight models and with with unrestrained, um, frontier models for the last three and a half to four years. Like this is not a new, it's not a new thing. It's just that everyone's talking about it all at the same time now."

On policy, he was in Washington the week the export control action landed and read the response as recognition rather than reaction to an event:

"You're not gonna export control your way to, to, to a safer security. It's one... safer security state, you know, internet wide."

"we keep on, in general, talking about this sort of problem space as though we've got the ability to control it, whereas in reality we actually kind of don't."

He does credit one effect without hedging: "the marketing problem and actually driving awareness around this, I think that's a, that's an underrated problem to solve that it did actually solve in some ways."

"they, they aren't necessarily aware of what AI can be used for defensively or even from like a build standpoint because corporate policy has been like, 'Don't use this stuff.' Right? Like the reality is that people are just gonna use it anyway at this point. I think like relying on policy to prevent, that's probably not the best defensive, you know, thinking at this point."

"if you've got leadership that's not necessarily aware of the art of the possible, then you're gonna end up with this pretty big gap between the folk leading the business and, and what your workforce is actually doing. So what I've, what I've been encouraging, you know, senior leaders to do is like just use this stuff at home. Like figure it out. Like, yeah, like get a harness, like just play with it."

The evidence is what the Black Hat and DEF CON NOC and SOC teams saw this year. Zero-day crossed the wire at Black Hat, which Casey says does not normally happen there, because "if you're sitting on something, like you know that if you shoot it across the network at BlackHat, it's gonna get caught... And that shifted this year, I think, because you've got folks that have capability but don't necessarily understand that, that tradecraft component." And then there was port 3000, which he calls "pretty wild": vibe-coded applications bound to every interface, with people sitting around waiting for exactly that. The employee-side exposure was mundane and real, people "sending, you know, like prospect lists in clear text and, like, just all sorts of silly shit like that."

His organisational prescription comes from Hack the Pentagon, where the work ran through what he calls the United States Digital Services Group, "which was effectively the digital transformation arm for the DoD." The pattern he wants larger organisations to copy is a team "that's, like, literally their job to disrupt the way that we think within the organization."

Casey's read on the Black Hat vendor floor is unsentimental.

"there's so many agentic pen test vendors, you know, on the floor at BlackHat, for example, and it's like the pen testing was effective to a certain point before we turbocharged it and made it available 24/7 and got robots to do it. Like now we're just sort of dialing up the same thing that has been somewhat effective, but I wouldn't say super effective in terms of the overall risk posture of organizations over the years and just doing more of it because that's kind of what the market says we should do."

His test for whether a control earns its place returns to first principles:

"app sec's awesome, shift left's awesome. Like, those things are all good and important from a resilience standpoint. Um, but when you come back to the fundamental of why we're doing this in the first place, it's because of the bad guy. So all right, now what?"

Which is how he arrives at deception:

"deception tech, I think, is gonna have a really good time over the next period because like, shout out to Haroon and, and those guys who've been, like, literally just quietly grinding away on that as a, as a good solution for, you know, 12 or 13 years, and all of a sudden everyone's like, 'Oh, crap, we don't know what our agents are doing.'"

Ashish named the objection the category always had to answer:

"'cause I mean, it used to be hard to justify why do we have this thing which never lights up?"

Casey's reply: "It was always a good solution, but now it's sort of an obviously good solution, I think."

Practical takeaways

🔍 What's your median time from external vuln report to first human response? Do you even measure it?

Next week, we'll explore another critical aspect of cloud security. Stay tuned!

📬 Want weekly expert takes on AI & Cloud Security? [Subscribe here]”

We would love to hear from you📢 for a feature or topic request or if you would like to sponsor an edition of Cloud Security Newsletter.

Thank you for continuing to subscribe and Welcome to the new members in tis newsletter community💙

Peace!

Shilpi Bhattacharjee

Was this forwarded to you? You can Sign up here, to join our growing readership.

Want to sponsor the next newsletter edition! Lets make it happen

Have you joined our FREE Monthly Cloud Security Bootcamp yet?

checkout our sister podcast AI Security Podcast