Session CRT-20260926 — 26 September 2026 · Morning Edition

Halil, verified exploitation puts Oracle PeopleSoft first. CVE-2026-35273 affects PeopleTools 8.61.x/8.62.x and is described as remotely exploitable without authentication or user interaction; observed attacks upload a JSP webshell and then execute Windows commands. In the next 30 minutes: remove exposed instances from the internet, apply Oracle’s fix, preserve evidence, and hunt for uploaded JSP files and subsequent command execution. Patching alone is insufficient because it does not remove an existing webshell. Fortinet documents WAF controls, but I cannot verify the renewed campaign’s precise WAF-bypass mechanism—so do not treat a WAF alert-free dashboard as proof of safety.

My ranked decision after that is: 2) externally reachable unauthenticated Docker APIs on TCP 2375, if exposure is confirmed—block access immediately and investigate the host; this is a configuration-driven entry path, not something to solve merely by patching. 3) internet-facing Kiteworks—restrict exposure and prepare to execute the vendor’s emergency shutdown guidance, but classify it as warning-only: the available source says an attack is imminent but provides no exploit primitive, victim telemetry, or verified exploitation. Do not declare those systems compromised without evidence.

4) WSO2/Adobe KEV additions; 5) WordPress CVE-2026-87902. I do not have enough source-level detail here to identify the specific WSO2/Adobe CVEs, affected versions, exploit chains, or the vulnerable WordPress component. Therefore, the defensible 30-minute action is asset/version matching and exposure validation—not blind fleet-wide shutdown. Oracle is patch-and-hunt now. Exposed Docker is block-and-investigate. Kiteworks is contain-and-prepare. The rest requires exact reachability before headline severity earns emergency status.

The urgent common issue is overprivileged nonhuman identities connected to unsafe data or tool paths, not AI by itself. Fact: SalesBleed reportedly enabled zero-click data exfiltration through Salesforce Agentforce. Assessment: AI supplied the untrusted instruction path, but the reachable Salesforce records and actions were determined by the agent’s service identity and connected tools. Its likely blast radius is therefore the objects, APIs, and external actions available to that identity—not automatically the entire Salesforce tenant.

Fact: Microsoft reports Storm-3168 using compromised Azure service principals. Assessment: Azure accepted identities operating with their assigned permissions; the evidence cited does not establish an Azure control-plane failure. The blast radius follows Entra app-role assignments, Azure RBAC, credential access, and any cross-subscription or federated trust paths. For GitLab, I cannot confirm the exposure mechanism or token scope from the available information. Conditionally, the radius should be bounded to projects mapped to each email-to-issue token, while treating automation consuming those issues as potentially reachable until tested.

Tonight, I would run containment and preservation in parallel:

• Salesforce: Disable the affected Agentforce input/integration path; revoke its OAuth grants or workload credentials and reduce object/tool permissions. Preserve Agentforce sessions, Salesforce event/audit records, connected-app grants, and record-access history.
• Azure: Disable the compromised service principals, replace every secret/certificate/federated credential, and remove unnecessary app roles and RBAC assignments. First export Entra service-principal sign-ins, audit logs, app-registration manifests, owners, credential metadata, Graph activity, and Azure Activity Logs.
• GitLab: Disable inbound email-to-issue processing and rotate the relevant tokens. Preserve token metadata, GitLab audit events, issue/comment creation history, original email headers, and mail-gateway logs.

The shared-responsibility boundary matters: Salesforce and GitLab own defects in their product trust boundaries; Microsoft owns Entra/Azure platform security. Customers still own identity permissions, connected-data scope, credential lifecycle, logging, and downstream automation. “Nonhuman” does not mean non-privileged—it merely means the account cannot complain when someone gives it tenant-wide access.

The evidence supports high confidence that Bitget suffered unauthorized multi-chain outflows, but not one settled loss total: reporting ranges from roughly $351.6 million to $387.5 million. The wallet-backend compromise, spoofed transaction data, and absence of private-key theft remain moderate-confidence claims, not independently demonstrated forensic findings. The reported VPN/IP overlap and laundering-address links to the Bybit theft raise Lazarus attribution only to low confidence; they are useful pivots, not identity proof.

For KelpDAO, $292 million is presently a litigated exploit figure, not a confirmed realized loss in the evidence available here. The lawsuit establishes a dispute with LayerZero, but does not independently settle exploit mechanics, backend-signing responsibility, or net recoverable loss. What changed for Bitget is broader reporting of affected assets and a more specific backend-spoofing theory—not evidence strong enough to resolve the amount or attribution.

Before naming an actor, exchange and bridge operators should freeze affected routes, preserve API, policy-engine, HSM and signer logs, rotate credentials after forensic capture, reconcile every chain from published transaction hashes, and impose signer quorum, withdrawal caps and destination allowlisting. A MITRE mapping should wait until evidence distinguishes credential abuse, signer compromise, or transaction-validation failure.

Halil, the evidence supports agent-enabled intrusion, but not yet a fully autonomous campaign. The report describes Strix performing discovery, Cairn handling exploitation, and Hermes orchestrating post-exploitation through 121 skills. It also records 1,951 short Chinese-language prompts across 260 sessions via OpenRouter. That architecture shows delegated tool use, but the repeated operator interaction cuts against claims of unattended autonomy. Without complete execution transcripts showing independent target selection, exploitation decisions, recovery from failure, and cross-target persistence, the reported 105-target scope should remain an allegation rather than proof that agents ran the entire operation unaided.

The kill chain appears to have closed decisively at impact and monetization: the report attributes 27 compromises, skimmer deployment at 19 victims, theft of more than 600,000 unexpired card records, and deletion of 180 database tables at one bicycle retailer after extraction. What remains unclear is the initial-access mechanism for each victim and whether the models discovered novel exploit paths or merely drove conventional scanning and exploitation tools. That distinction matters: adaptive tool orchestration is AI-specific; vulnerable storefronts, credential abuse, web-shell deployment, card skimming, and database wiping are established intrusion mechanics.

My decision-ready position is: treat this as a serious reduction in attacker cost and cycle time, not a new exploit class. The earliest broadly applicable control is deny-by-default exposure at the web boundary: restrict origin and administrative access, force public traffic through a managed WAF/CDN, and remove unnecessary Internet-facing services. Because the underlying exploit primitives have not been publicly established, I would not claim that one signature or patch would have stopped every intrusion. Immutable storefront deployments, restrictive Content Security Policy, and database credentials incapable of destructive administration are the next containment layers.

So I would argue directly against “AI changes everything.” AI appears to change campaign economics—roughly $25 per completed scan was reported—and may compress reconnaissance through post-exploitation. It does not eliminate prerequisites: reachable services, exploitable flaws, excessive credentials, and writable payment pages. Defenders should accelerate remediation and constrain machine identities, but they should not replace conventional controls with an “AI defense” product merely because the attacker used agents.