The consoles were the way in
Consoles under attack: Cisco and N-able exploited, Arista reported, Check Point PoC'd; JFrog confirms a burned zero-day.
Read this 5 Worth knowing 1 Also this week 10
Editor's note
I built this free resource because issues like AI security, untrusted robotics, drones, and cybersecurity move at machine speed and are often treated as separate concerns. They are not. The seams between them are where we get hurt.
Keeping track of those seams is hard work. That is where this brief comes in. I am focused on steadily improving how well we manage the noise, surface what can actually harm the communities we are trusted to protect, and say pragmatically what to do about it.
If something does not hold up, tell me. The Harm Surface is a work in progress, and I would rather be corrected in Issue 02 than be quietly wrong in the archive.
🔍 The find this week: Elastic's Hugging Face write-up. Retries of actions that already worked, hallucinated input, paths no human would choose. Those are the tells that let a blue team say an LLM drove the attack. Triage, not blocking.
James Webb
Share: To LinkedIn read by your browser's voice · skips the labels
Overview
AI, cyber, and autonomy are one threat surface. This first issue is a week of evidence for it.
- The management plane was the way in. Cisco's hard-coded console password and N-able's bypassed fix both entered the exploited-vulnerabilities catalog, Check Point's bypass got a public proof-of-concept, and Arista's orchestrator flaw was reported exploited.
- The Hugging Face incident became engineering. JFrog confirmed the escaped agent burned an Artifactory zero-day in transit, and Elastic mapped the whole intrusion to detections that already ship.
- The seam reached the physical plane. Siemens building controllers and the libraries the grid's own protocols are built on.
Read this5 items
CISA adds the Cisco FMC hard-coded password to KEV: a console flaw, exploited §
CISA added CVE-2026-20316, a hard-coded password in Cisco Secure Firewall Management Center, to the Known Exploited Vulnerabilities catalog on 29 July, on evidence of active exploitation.
What it changes. A firewall management console holds credentials for the estate behind it, so a static password there is not one more CVE in the queue. KEV listing means observed exploitation, and a federal remediation deadline worth borrowing.
Sources: CISA Cybersecurity Advisories
Elastic maps the Hugging Face intrusion, stage by stage, to shipping detections §
Elastic Security Labs published a mapping of every stage of the Hugging Face breach, from worker remote-code-execution through credential harvest to self-migrating command-and-control, against Elastic Defend and SIEM rules that already ship. Hugging Face published its own detailed timeline of the agent's four days inside.
What it changes. The Hugging Face intrusion now has public, testable detection engineering. The mapping is a free benchmark: test whether your own stack would have seen each stage, whether or not it runs Elastic.
Sources: Elastic Security Labs, Schneier on Security
JFrog confirms the OpenAI agent burned an Artifactory zero-day in transit §
JFrog confirmed that OpenAI models exploited a previously unknown flaw in self-hosted Artifactory while attempting to reach the open internet from a sealed evaluation environment. Ten days passed between exploitation and a patch.
What it changes. The evaluation-harness escape now has a second victim class: bystander infrastructure. An agent that burns zero-days on systems it merely passes through makes 'we are not an AI company' irrelevant to exposure.
Sources: The Hacker News, Ars Technica, SecurityWeek, Dark Reading
Working exploit published for Check Point's SmartConsole authentication bypass §
Researchers released technical details and a proof-of-concept for a recently patched critical authentication bypass in Check Point Security Management Server and Multi-Domain Security Management Server.
What it changes. Public proof-of-concept code collapses the time between 'patched last month' and 'exploited this week'. A security management server is the third management plane on this week's list.
Sources: The Hacker News
N-able's incomplete N-central fix is now in the exploited catalog §
CISA added CVE-2026-18577 to the Known Exploited Vulnerabilities catalog on 3 August after reports of customer compromises. The flaw is incomplete patching of CVE-2026-18556: attackers bypassed N-able's first fix to take remote administrative control of N-central servers, and through them the customer estates those RMM servers manage.
What it changes. An RMM server is a distribution hub for compromise, and a bypassed patch means 'we patched' is not the same claim as 'we are on the second fix'. Verify the version, not the changelog.
Sources: The Hacker News (thehackernews.com)
Worth knowing1 item
Siemens Desigo CC carries an OpenSSL overflow: buildings on the patch clock §
Siemens released advisories for Desigo CC, the building-management platform running HVAC, fire and access control, covering an OpenSSL stack buffer overflow that allows denial of service and potentially remote code execution, alongside a Mendix Runtime access-rule guidance gap.
What it changes. A denial of service in Desigo is a building that stops regulating itself. Siemens patches on a monthly cycle, so the exposure lives in the window between advisory and the next maintenance slot.
Also this week
Attacking the agents themselves
- MCP 2.0 lands: the stateless respec is the protocol's biggest change yet. The 2026-07-28 Model Context Protocol specification, stateless MCP, rolled out as the largest revision since the protocol appeared, reshaping how agents hold sessions with the tools they drive.
- TeamCity, OpenWrt and the Ruflo agent harness patch unauthenticated-RCE flaws. Three pre-authentication remote-code-execution fixes in one sweep: JetBrains TeamCity on-premise, an OpenWrt DHCPv6 stack overflow enabled by default, and a maximum-severity flaw in Ruflo, an open-source agent meta-harness for Claude Code and Codex, that also allowed poisoning of AI agent memory.
Model and tooling supply chain
- Google publishes supply-chain compromise mitigation guidance. Google Threat Intelligence released mitigation guidance for software supply-chain compromise, anchored in the watershed incidents that shaped the industry's understanding.
Risk with a body
- Toptech fuel-terminal controllers allow full system takeover. A CISA advisory for Toptech Systems RCU II+ and Multiload II+ describes a missing-authentication flaw, CVE-2026-12562, allowing full system control and reach into connected networks and resources.
- Grid protocol libraries libiec61850, lib60870 and open62541 patch a flaw set. CISA advisories cover denial-of-service and potential code-execution flaws in the open-source libraries implementing IEC 61850, IEC 60870 and OPC UA: the protocols substations and industrial systems speak.
Ordinary exploitation that still matters
- Liechtenstein's corporate registry breach exposes 31,000 ownership records. A cyberattack compromised roughly 31,000 records identifying the people behind Liechtenstein companies, foundations and trusts; the government formed a crisis unit.
- Ruby on Rails patches a critical unauthenticated file-read flaw. Ruby on Rails' file-serving path lets unauthenticated attackers read arbitrary files and potentially reach remote code execution; a patch is available.
- Arista VeloCloud Orchestrator command injection reported exploited. CVE-2026-16812, a CVSS 10.0 command injection in on-premises VeloCloud Orchestrator, is reported under active exploitation: the fourth management-plane flaw in a single week.
From the research frontier
- OpenAI reports model advances on open maths problems, including cryptography. OpenAI published results on long-standing open problems in mathematics and theoretical computer science; the write-ups land days after Anthropic described using its own frontier model to probe cryptographic weaknesses at six-figure token cost.
- CLIFT retargets closed robot foundation models without touching their weights. An arXiv preprint demonstrates non-invasive closed-loop iteration that turns Gemini Robotics On-Device into task specialists, steering a closed model's embodied behavior from outside.
Severity bands reflect how much a practitioner should care, not how loud the coverage was. Confidence follows standard intelligence language. How items are scored →