TLDR INFORMATION SECURITY 2026-09-24

Dive into Lakewatch

Learn the new AI Security Framework (DASF 3.0)

Download the eBook: The Security Lakehouse — Outpacing AI Zero-Days

CRITICAL BIFROST AI GATEWAY FLAW LETS ATTACKERS RUN COMMANDS WITHOUT CREDENTIALS

Bifrost, an open-source AI gateway for 20+ LLM providers, ships with management auth disabled by default, so a single unauthenticated POST to /api/mcp/client can register a stdio MCP client and run arbitrary commands as the gateway user (CVE-2026-90898, CVSS 9.8). That exposes every stored provider API key. The official Docker image binds the management API to 0.0.0.0, and v2.0.0 only fixed a related plugin-loading flaw (CVE-2026-86242, CVSS 8.1). Upgrade to transports/v2.1.0 or set governance.auth_config.is_enabled to true, and treat any exposed unauthenticated instance as compromised by rotating virtual and provider API keys.

BIGCOMMERCE DATA STOLEN VIA RIBON APPS HACK

Attackers used compromised Ribon API credentials from a Fastr system breach to access BigCommerce merchant customer data from September 13 to 17. Exposed records included names, email addresses, phone numbers, and postal addresses. BigCommerce revoked the credentials, uninstalled affected Ribon apps, and notified merchants.

GITHUB APP PRIVATE KEYS: 474 LEAKED KEYS EXPOSED

GitGuardian tested 4,802 leaked GitHub App private keys and found 474 that were still authenticated as 440 apps. Forty-four apps held organization-admin permissions. 207 could write repository content, and with the keys having no expiry, the leaked PEM files can remain usable for years. Cases included an Actions token app installed across roughly 300 organizations, BuildBuddy's internal app, Crusher.dev, and a CDC-related app.

THE TALE OF TWO INC RANSOM NOTES

An INC ransomware intrusion across 175+ endpoints started in early August with randomly named scheduled tasks launching an obfuscated PowerShell implant and RDP lateral movement. After 17 quiet days, AnyDesk delivered netscan.exe and a BYOVD EDR killer (hwau.exe loading the HwAudio driver), and Impacket's atexec.py deployed the payload. Huntress onboarded after the incident, so initial access is unknown, and the gap points to an access broker handing off to an affiliate, who followed the standard note with a DATALEAK_PRESS_RELEASE.txt listing stolen files and threatening to contact clients within 48 hours. Defenders should alert on randomly named scheduled tasks, unexpected RMM installs, and new or unsigned driver services, and limit privileged accounts to the systems they actually need.

REVOKING THE TOKEN DIDN'T KILL THE BACKDOOR

GraphWorm, an implant tied to the China-nexus group Webworm, uses a real OneDrive account over Microsoft Graph as a dead drop, and its "upgrade" task swaps all five hardcoded OAuth credentials for a spare account in one command, so token revocation only pauses it. It also identifies victims by hashing MAC, CPU, and disk serials, so renaming or re-addressing a host won't shake the operator. Isolate the host or block the app ID in your own tenant at the same moment you revoke, then hunt sign-in logs for that app ID, unfamiliar tenants, and non-browser user agents hitting OneDrive.

HANDLE REDIRECT

EDR products typically register callbacks on handle creation to monitor when processes call OpenProcess so they can strip access rights before a handle to a sensitive process like lsass is delivered. This article demonstrates a technique in which an attacker calls OpenProcess on a benign process (like notepad.exe) and then redirects the received handle to the sensitive process to evade EDR detection. To detect this attack vector, a security product running at the kernel level can periodically scan all process handle tables and compare ObjectPointerBits decoded EPROCESS against the process that owns the table.

explore AWS Partner solutions in AWS Marketplace.

OUTERLIMIT (PRODUCT LAUNCH)

Outerlimit provides a decentralized authorization layer for autonomous software agents. It finds agents, monitors behavior, and enforces policies at execution time. The system restricts token use by scope, location, and conditions.

FIRMWARE REVERSE ENGINEERING SKILLS

A collection of five agent skills for firmware extraction, static analysis, Ghidra reverse engineering, emulation, and security reporting.

PKTZ

pktz is an eBPF-powered network traffic monitor with per-process and per-connection reporting.

MICROSOFT DISRUPTS AI-ASSISTED PLATFORM THAT COMPROMISED 12,000 ACCOUNTS

EvilTokens, a Telegram-sold subscription service ($1,500 upfront, $500 monthly), abused Microsoft Entra device code authentication to compromise 12,000 accounts across 10,000 organizations before a Microsoft-led operation seized 50 websites and 150 domains, and the UK's Met Police arrested two men. Its AI chatbot analyzed 5,000 compromised emails at a time to identify who could approve payments, who they reported to, and which impersonation ruses would send funds to attacker accounts. Microsoft described it as a shift where criminals can make sense of a compromised inbox in minutes rather than days.

NORTH KOREA'S HANGRO REVISITED

Hangro, North Korea's SoftEther-derived VPN and mail client for officials abroad, added a July 2026 management certificate whose SAN lists hosts in Pyongyang and Khabarovsk plus an internal CGNAT address, while its older 2024 chain fails every signature check, including the root against itself. Its Chinese callback traces to six Shenyang assignments under a single 2008 Silibank registry contact, though silibank[.]com lapsed and was re-registered in 2023. The researcher describes the DPRK "return leg" as layered rather than a single pipe, with dead-drop pickup during Chinese office hours, 10 GB ETRN-enabled mail relays for bulk transfer, and Hangro for interactive sessions, though no actual traffic was observed.

ANTHROPIC AND OPENAI MODELS STILL ATTEMPT RESTRICTED ACTIONS IN SAFETY TESTS

Anthropic's Opus 5.5 escaped or tampered with its sandbox in 1.5% of unguarded tests. With package-registry credentials, it took harmful actions in roughly half of simulated exercises. OpenAI's GPT-6 Luna bypassed “access denied” controls in 42% of runs - Sol did so in 64%. OpenAI plans third-party reviews covering safeguards, capabilities, and misalignment incidents.

UK COPS ARREST 2 EVILTOKENS SUSPECTS, MICROSOFT SEIZES 50 PHISHING KIT WEBSITES

Microsoft and UK police disrupted EvilTokens, a Microsoft device-code phishing service.

STOLEN PASSWORDS ARE EXPOSING AMERICA'S WATER PROVIDERS TO HACKERS

SpyCloud found stolen credentials at 1,787 of 10,000 US water providers reviewed.