Session CRT-20260910 — 10 September 2026 · Afternoon Edition

Rebuild is no longer the automatic consequence of mere internet exposure. James has drawn a narrower, evidence-based boundary: patch-in-place can be defensible when immutable, time-synchronised off-box telemetry covers the entire vulnerable window and independently shows only approved management access, no Talos indicators or unauthorized administrative activity, no abnormal egress, and no anomalous PAM, identity-provider, or VPN sessions. He also makes an important operational point: an unnecessary FMC rebuild can remove critical management and emergency-change capacity while potentially destroying evidence.

That does not reduce the urgency around Cisco FMC CVE-2026-20079. Confirmed exploitation can produce unauthenticated root-level command execution, and no workaround was reported here. The immediate sequence remains to remove public management access, preserve evidence, inspect for indicators, and upgrade. Rebuilding becomes warranted when there are exploit artifacts, unauthorized root activity, persistence, or reason to doubt policy integrity. NetFlow by itself is not enough when HTTPS reached FMC directly, and the exact fixed-build boundaries remain unverified. In other words, patch-in-place requires affirmative, sufficiently complete evidence—not simply an absence of alerts.

James also places the reported Fortinet CVE-2025-25249/PivotC2 activity second in tonight’s order, behind Cisco, with isolation and volatile and network evidence capture for affected reachable assets. The discussion now turns to three similarly attribution-sensitive cases: separating PaperCut’s minimum verified exploitation outcome from the autonomous-agent narrative, determining whether the Microsoft 365 campaign defeats passkeys or manipulates enrollment and recovery, and distinguishing verified Term Finance on-chain movement from attribution and final-loss assumptions.

Three distinct claims have now been narrowed to what the evidence actually supports. For PaperCut NG/MF, the verified floor is serious enough without the autonomous-agent narrative: CVE-2026-81578 and CVE-2026-82078 have been chained for remote code execution, with subsequent C2 traffic, and both PaperCut and CISA recognize active exploitation. Attribution remains unknown. The reported 440 servers and 395 organizations are moderate-confidence telemetry figures; the 12 Domain Admin compromises remain low confidence without independent host or identity artifacts. Tonight’s defensible response is Emergency Patch 2 or later, trusted-IP restriction of web access, and investigation of exposed systems, with isolation where immediate patching is impossible.

On the Microsoft 365 campaign, the room should not describe this as attackers breaking passkey cryptography. The supported chain is social engineering, legitimate victim approval, acquisition of a replayable session or device-code token, enrollment of an attacker-controlled authentication method, and then Graph-enabled reconnaissance and data access across Exchange, SharePoint, and OneDrive. Graph is the post-compromise execution layer, while the precise permissions and endpoints have not been established. The most direct control is to restrict “Register security information” through Entra Conditional Access to compliant, managed devices.

For Term Finance, on-chain records support roughly $8.5 million in gross extraction, not necessarily final net loss. They also support the central governance failure: a very small stake acquired overwhelming active voting power, a malicious proposal sat visible for six days without a veto, and the cooldown was reduced to zero. Tornado Cash funding does not establish attribution. Deposits should remain disabled and legacy DAO roles revoked while Term decides whether to migrate users to newly audited vaults under enforceable governance controls.

That leaves a prioritization question we now need to test: whether uncertainty around PaperCut’s campaign scale justified ranking it fifth, or whether verified RCE and C2 should move any internet-exposed deployment much higher regardless of disputed victim counts.

PaperCut’s priority has materially changed: a vulnerable server now ranks second tonight—above Fortinet and WatchGuard—when untrusted networks can directly reach the PaperCut application’s HTTP(S) service without an effective allowlist or filtering control. That shift rests on CISA’s confirmation that CVE-2026-81578 and CVE-2026-82078 can be chained, together with watchTowr’s observation of unauthenticated RCE, C2 traffic, Godzilla webshell deployment, and suo5 proxy tunneling.

The ranking remains conditional rather than absolute. Confirmed PivotC2 activity on Fortinet or compromise indicators on WatchGuard take precedence over a PaperCut server that is merely exposed. PaperCut also falls lower if it is already on the current vendor-fixed release or if off-box controls demonstrate that only trusted management sources could reach it throughout the vulnerable period.

For qualifying PaperCut systems, the immediate sequence is isolation, preservation of Java-process memory and active connections before restart, collection of PaperCut and proxy logs, and then patching. Evidence of C2, servlet-filter implants, proxy tooling, or unauthorized configuration changes should trigger rebuilding rather than confidence in patching alone.

The discussion now broadens from one exposure-driven ranking decision to three related trust questions: separating compromise mechanics from Lazarus attribution, distinguishing model distillation from access-control evasion or espionage, and identifying what coding-agent tokens, prompts, project data, and connection settings infostealers can actually capture.

Three distinct threats now share one operational lesson: trusted interfaces become dangerous when their surrounding identity and access boundaries fail. In South Korea, the supported mechanics are clear—15 legitimate sites became watering holes, exploiting vulnerable AnySign4PC 1.1.4.4–1.1.4.6 without user prompts and delivering SIGNBT or COPPERHEDGE with process injection. The failed boundary was between untrusted web content and privileged browser-adjacent middleware. Lazarus attribution remains moderate-confidence rather than definitive, especially given parallel Gunra activity. The immediate decision is to upgrade to 1.1.5.0 or later, disable unpatchable installations, and investigate affected-site visitors for the named malware, net.tmp, inet.tmp, and abnormal injection behavior.

On frontier-model extraction, the room has sharpened an important distinction. Large-scale distillation is not automatically espionage; the stronger public claim concerns fraudulent accounts and transfer infrastructure used to evade access controls. CISA’s account supports industrial-scale querying and evasion at high confidence, although its underlying telemetry is not public. Chinese state awareness is only moderate-confidence, and direct state direction remains low-confidence. Public evidence does not establish theft of model weights or other non-public secrets. The open policy question is therefore which provider control should lead, without treating state awareness as proof of state tasking.

For compromised developer endpoints, MCP and connection configurations present the widest blast radius because they can expose cloud, repository, database, ticketing, and collaboration credentials. Replayable cloud and repository tokens follow; prompts, source code, and project metadata are primarily confidentiality risks unless they contain secrets. This is post-compromise collection from predictable local storage, not evidence of vulnerabilities in Claude, Cursor, Codex, Cline, or similar tools. Containment starts by isolating the endpoint while preserving evidence, then disabling the developer identity and revoking sessions from a clean host, followed by inventorying and rotating credentials across the locally reachable trust graph. Those confidence levels and boundary failures should anchor our final synthesis.