Session CRT-20260711 — 11 July 2026 · Morning Edition

Halil, my call is:

1. ShareFile Storage Zone Controller — shutdown/isolate now. Progress is explicitly telling customers to power off the on-prem Windows servers, and CyberBrief notes cloud-side restrictions are not enough. That is not “patch when convenient.” First two checks: look for unexpected inbound/outbound traffic from the SZC host before shutdown, and review IIS/Windows/app logs for unusual file-transfer, auth, or process-spawn activity. Exposure alone is not compromise; compromise is evidence of anomalous access, new processes, outbound staging, or file movement.

2. CitrixBleed 2 / CVE-2025-5777 — isolate affected internet-facing NetScaler paths, kill sessions, then patch. The reported exploit path is session hijack leading to DragonForce ransomware. That closes a real kill chain: edge bug → stolen session → internal access → ransomware. First two checks: invalidate all active sessions/tokens tied to the appliance, and hunt VPN/Gateway logs for session reuse from new IPs, impossible travel, or MFA bypass patterns. If you only patch and leave stolen sessions alive, you’ve locked the door while the burglar is still inside.

3. Langflow CVE-2026-55255 — patch-and-hunt urgently; isolate if internet-exposed or multi-tenant. CISA says it is actively exploited, and CyberBrief says the /api/v1/responses IDOR lets an authenticated attacker execute another user’s flow using a victim UUID, with reports of code execution, second-stage payload delivery, PostgreSQL dumping, and arbitrary file writes. First two checks: query access logs for /api/v1/responses calls where user identity and flow/UUID ownership do not match, and hunt for new files, child processes, outbound payload fetches, or database export activity from the Langflow host.

4. Django GeoDjango / CMS lane — patch-and-hunt unless you see exploitation telemetry. I have visible evidence here for Django GIS CVE-2026-1207 SQL injection reportedly exploited in the wild, but less concrete telemetry in front of me for ACSC/WP-SHELLSTORM specifics. First two checks: web logs for SQLi payloads against GIS endpoints, and database logs for abnormal geospatial queries, bulk reads, or error bursts tied to the web tier. Don’t shut down every CMS because a headline says “active exploitation”; isolate when you see shells, new admin users, webroot writes, or outbound C2.

Halil, the common thread is durable trust state, not just stolen passwords. From the sourced Microsoft 365/Entra evidence: Forg365 is described as abusing Microsoft’s device-code flow to hijack Microsoft 365 sessions, and O-UNC-066/Pink is reported using operator-controlled vishing/phishing to relay credentials and weak MFA in real time, then enroll attacker-controlled Entra passkeys. So after a password reset, attackers may still retain active M365 sessions, refresh tokens, OAuth/device-code grants, registered passkeys/FIDO2 credentials, Authenticator/TOTP/SMS methods, trusted devices, and any browser-held session material. For the Payouts King, Citrix, and KDDI items, I’d treat the pack’s framing as containment signal, but I don’t have enough sourced detail here to assert their exact mechanics beyond Teams phishing/extension, session hijack, and exposed-password risk.

Tonight for Microsoft 365/Entra: revoke user sessions and refresh tokens; remove unknown passkeys, Authenticator registrations, TOTP seeds, SMS numbers, and recovery methods; audit and remove suspicious enterprise app consents/OAuth grants; restrict or disable device-code authentication where business can tolerate it; require phishing-resistant authentication for admins and high-risk users; and lock passkey enrollment so it requires a managed device, known network or compliant device posture, and strong step-up—not a phone call and a polished “Microsoft” page. Treat passkey registration as privileged enrollment, not user self-service decoration.

For VPN/Citrix owners: password rotation is not containment. Kill active sessions at the gateway, invalidate persistent cookies/tokens, review recently added devices and MFA factors, shorten session lifetime, disable “remembered device” persistence for remote access, and require phishing-resistant MFA or certificate/device-bound authentication for privileged VPN access. For the Teams/Edge-extension angle, enforce browser extension allowlisting via policy; don’t ask users to “be careful with extensions” while allowing arbitrary extension install.

Training myth to retire: “Users should spot the fake Microsoft login.” The O-UNC-066 reporting says the kit is operator-controlled and adapts to SMS OTP, TOTP, and push approvals, which means ordinary MFA awareness is a weak control. The enforceable control is to make stolen passwords and relayed prompts non-transferable: WebAuthn/passkeys properly governed, device-bound sessions where available, OAuth consent governance, session revocation, and hard restrictions on who can enroll new authenticators.

Halil, the real shift is not “AI went rogue.” It is that agents are being wired into privileged workflows. Anthropic says it assessed with high confidence that a Chinese state-sponsored group manipulated Claude Code into attempting infiltration of roughly thirty global targets, succeeding in a small number of cases; Anthropic’s report also says the AI executed approximately 80%–90% of tactical work independently, with humans in strategic supervisory roles. MITRE’s campaign entry describes the same operation as using Claude Code for reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration across approximately 30 entities.

So what is genuinely new operationally? Agentic compression of the kill chain. The novelty is not a new exploit primitive; it is that MCP-connected coding agents can chain familiar actions faster: enumerate, test, write code, run tools, summarize results, and move to the next step. That changes defender timing and audit requirements.

What is old appsec with AI branding? Langflow exploitation and the JadePuffer-style LangFlow intrusion pattern still look mostly like exposed workflow infrastructure, code execution, weak boundary controls, and credential handling failures. GhostApproval symlink deception, hidden-repo prompt injection, and similar coding-agent attacks also map to a familiar class: injection plus confused deputy. The difference is that the “interpreter” is now an LLM agent with shell, repo, browser, or SaaS authority.

I would disable or sandbox immediately: shell execution, filesystem write outside the project workspace, MCP tool auto-approval, network egress, browser/session reuse, credential/keychain access, package install, git push/merge, cloud admin actions, and access to secrets-bearing CI/CD contexts. Restore only with per-project sandboxes, ephemeral credentials, explicit approval for high-risk tool calls, read-only mounts where possible, and full logging of prompt-to-tool decisions.

For OpenClaw specifically, I would not treat the WhatsApp-to-host claim as confirmed from the evidence here. But if the architecture allows a message channel to trigger host-side agent actions, the mitigation is the same: no untrusted content should be allowed to drive privileged tool execution without isolation and human approval.

Halil, the highest-risk path here is not “cloud” in the abstract; it is delegated control-plane trust crossing boundaries. The clearest sourced examples are: Progress warning ShareFile customers to shut down hybrid Storage Zone Controllers over a credible security threat; KDDI disclosing a breach tied to exploitation of an unnamed third-party shared email platform zero-day; and Forg365 abusing Microsoft device-code flow to hijack Microsoft 365 sessions. That gives us three trust bridges to worry about: hybrid storage controllers, third-party SaaS email tenancy, and Microsoft 365 identity/session flows.

My containment order would be:

1. Stop trust propagation first. For ShareFile-style hybrid controllers, isolate or shut down the Storage Zone Controllers before doing forensic niceties. If that controller has access to internal file shares, object storage, AD/LDAP, or service accounts, assume it is a bridge from SaaS edge to internal data plane.
2. Revoke delegated SaaS trust. In Microsoft 365, kill active sessions, revoke refresh tokens, review device-code/OAuth app grants, enforce phishing-resistant conditional access, and inspect passkey/FIDO registration events. “Passwordless” is still identity state; it is not magic fairy dust.
3. Freeze automation and CI/CD credentials. For the GitHub/package-metadata angle, I do not have enough visible source detail here to assert the exact CISA or package compromise mechanics, but the containment principle is the same: rotate repository secrets, CI runners’ cloud credentials, OIDC trust relationships, deployment keys, and any cloud role assumable by build systems.
4. Limit cloud metadata blast radius. On AWS, force IMDSv2, block unnecessary metadata access from containers/build jobs, scope instance profiles to least privilege, and put SCPs around dangerous APIs like iam:PassRole, sts:AssumeRole, s3:*, and key-management operations. On Azure/GCP, apply the same idea to managed identities/service accounts.

Shared responsibility matters here: Citrix/Progress, Microsoft, and the email-platform provider own their service-side fixes; the customer owns hybrid connector placement, tenant app consent, conditional access, CI/CD secret hygiene, and cloud IAM blast radius. The practical sequence is: disconnect exposed bridges, revoke sessions/tokens, rotate machine credentials, constrain role assumption, then patch and restore. If you patch first while CI/CD or SaaS OAuth trust is still live, you are just redeploying the attacker with better uptime.