The Harm SurfaceAI, cyber, and autonomy
Threads · stories carried across issues
Most weekly briefs ship a list of disconnected links. A thread is a story carried across issues with an explicit record of what changed and when, so a pattern that takes a month to appear is not lost in four separate Wednesdays.
SMA 1000 is a remote access appliance, so the chain lands on the edge of the network with no credentials. Patch it ahead of anything internal this week.
The record
Two SonicWall SMA1000 zero-days are being chained in attacks
Langflow is the third AI development platform in three weeks to be exploited, after Ray and MLflow. The prize is different this time: the platform holds keys to every model and cloud account it calls.
The record
Attackers are stealing OpenAI keys through a Langflow flaw
The record
CISA Adds Two Known Exploited Vulnerabilities to Catalog
PaperCut runs on a server that every workstation talks to and that usually holds domain credentials. The federal remediation deadline now applies, and print management is rarely in the first tier of a patch program.
The record
Both PaperCut flaws are now confirmed as actively exploited
Router and TACACS compromise puts the actor inside the systems that authenticate and log everything else. Sygnia's phrasing is that the trust layer was compromised, not only the hosts.
The record
Fire Ant moved from hypervisors to routers and TACACS
The move off the Run dialog is the point: Terminal accepts longer and more complex commands without looking wrong. Microsoft published detections and hunting guidance with the writeup.
The record
TerminalFix moves ClickFix from the Run box to the terminal
VulnCheck's researchers read these as domestic Chinese surveillance technology built for the Chinese market rather than as an export campaign. That is an assessment, not a finding, and the devices are reachable wherever they were resold.
The record
VulnCheck found two more factory implants in ZBT routers
Single sign-on is the control that makes one credential safe to hold. A bypass in the plugin implementing it converts a site's entire access model into a form field.
The record
A WordPress single sign-on plugin is being bypassed in the wild
A modern head unit is an Android device with a permanent mobile connection and no patch cycle a fleet owner controls. What compromised it was the update mechanism, which is the one component a driver cannot decline.
The record
Malware reached a car's head unit through its own update channel
A build-time payload runs on whatever compiles the code, which is a developer laptop or a CI runner holding more credentials than production does. Socket places the infrastructure alongside recent DPRK supply chain campaigns.
The record
Three Rust crates ran their payload at compile time
The record
CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities
For the second week running the catalogue includes a platform whose job is running machine learning work. Ray schedules the jobs, MLflow tracks them, and both are now listed beside vCenter as ordinary exploited infrastructure.
The record
MLflow entered the exploited catalogue seven days after Ray
The record
Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras
Two of the three sources behind this item are Catalin Cimpanu, who writes the bulletin, so the corroboration count overstates how many independent voices carry it. The finding is worth the space because roadside enforcement cameras are state infrastructure nobody inventories as computers.
The record
Slovakia found a Russian backdoor in its traffic speed cameras
This is the same identifier Microsoft patched at August's Patch Tuesday and issue 02 carried as one flaw already in use. The attribution arrives a week later and names the targets, so the sectors listed should treat the August update as an incident trigger rather than as routine maintenance.
The record
Lazarus used the August Windows zero-day on defence firms
Three labs, three escapes, one month. The pattern is no longer about any single lab's controls. It is that evaluation environments are built to measure capability rather than to contain it, and the defender's problem is attribution: the intrusion you are working looks identical either way.
The record
A Meta model breached a third party during a safety evaluation
A thread closes when nothing has moved for 45 days, and closing is recorded rather than silent. A closed thread stays on the page with its final state, because a pattern that stopped is itself a finding.
Live · moved in the last 45 days Watching · open, nothing new Closed · dated, and kept