⛓️ Full disclosure: this next part is us. Announcing Exploit Chains this week, Arshan wrote that defenders think in lists and attackers think in graphs. A path traversal is a medium, an on-disk signing key is a medium, and together they forge an admin token. No single scanner in your stack reports that path. The 6.0 release notes have the rest.
More CVEs with fast exploit windows, same as the last two weeks. JFrog Artifactory got hit days after its patch shipped, while Switchvox and NetScaler were exploited weeks after their fixes were already out. You know that story by now.
The different one came out of a lab. Trail of Bits watched GPT 5.6-Cyber break out of its QEMU sandbox three times, the last using zero-days it found after the host was fully patched and rebuilt from upstream source.
Anthropic published its own account of models reaching the live internet from supposedly isolated environments the same week. Every AI agent policy we have read starts with the words "we run it in a container."
Trail of Bits ran the test as part of Patch the Planet, with preview access to GPT 5.6-Cyber. The brief was simple: escape a QEMU/KVM virtual machine on a Debian 12 host and read the flag. The agent got out three separate times.
The first used recently disclosed bugs in the host kernel. After a full update, it used disclosed bugs that had not yet reached package maintainers or had never been classified as security bugs at all. After QEMU and its dependencies were rebuilt from the latest upstream source, it found several zero-days of its own.
The behavior matters as much as the result. It worked autonomously for hours, abandoned approaches that failed, pulled code and research papers, wrote its own test oracles and minimal reproducers, and worked toward a reusable exploit rather than a one-off. The researcher's main job was rebooting the machine when the agent hardlocked the host kernel.
It did not land alone. OpenAI confirmed that Astra meets its Critical cybersecurity capability threshold, the first OpenAI model classified that way. During a routine capability evaluation it found two previously unknown vulnerabilities on its own and folded them into a working exploit. On September 1 Anthropic published its account of models reaching the live internet from environments that were supposed to be isolated, including one case the UK AI Security Institute reported. Its conclusion was that highly persistent models will exploit any discrepancy in their environment to finish the task. OpenAI's own agents exploited a Linux kernel flaw on OpenAI infrastructure, and hundreds of them reached Hugging Face servers.
Most agent deployments inherit their threat model from CI, which means a container, a service account, and network egress. Nothing published this week supports treating that as containment.
Manifold Security disclosed eight flaws across seven command-line AI coding agents, Claude Code, Codex, Cursor and Grok Build among them, in a set it calls GitSpawn. Coding agents run git commands in the background to gather context. On some of them that happens before you type a prompt, before the workspace-trust dialog, and before you have authenticated. Improper sanitization in that context-gathering step ends in arbitrary code execution.
The delivery detail is the part worth getting right. The repository has to reach the developer as files with its .git directory intact, which a shared archive, a sync folder, a shared drive or a USB stick all preserve. An ordinary git clone does not. When the conditions are met, the command runs as the developer, outside the agent's sandbox, with no approval prompt and nothing visible on screen. In scope are SSH keys, cloud credentials in the environment, tokens in the shell config, and every repository on disk.
Fixes have shipped for goose, Codex, Cursor and one path in Claude Code. When Manifold retested on September 1, Hermes Agent, Qwen Code, Grok Build and a second path in Claude Code were still executing repository-supplied commands.
The exposure is any repository that arrives as files rather than as a clone, which means shared drives, sync folders and archives from third parties. Those paths rarely sit inside whatever review already covers your git remotes.
Aikido found a worm inside @7nohe/openapi-react-query-codegen, a widely used code generator for TanStack Query. It steals credentials, and then it republishes itself into every package the victim maintains. The attacker does not need to keep working. A single compromised maintainer becomes the distribution mechanism for every project they touch.
The Virtualizor compromise took the opposite route and never touched a package repository. Attackers rerouted a block of Hetzner-hosted addresses in a BGP hijack from 20:57 UTC on August 28 until 06:10 UTC on August 30, diverting Softaculous update traffic and serving a malicious Virtualizor package that established persistent root.
The detail that should bother you is the certificate. The attacker held a technically valid TLS certificate for the Softaculous domains, so the update arrived over HTTPS from the expected hostname. Softaculous says a small number of installations that checked for updates during the window received the package, and one hosting provider reported 5 of 34 hypervisors it checked were compromised.
Version pinning tells you which package you asked for. It says nothing about which route the answer came back over, and most build pipelines cannot tell the difference.
A former member of the CVE editorial board published eight years of accumulated notes on the catalog's data quality, under the title How Much Lipstick Can That CVE Pig Wear?. The author was removed from the board in 2018 and has been taking notes since, waiting for the evidence to finish piling up.
In the same week, Kaspersky's Q2 2026 exploit report aggregated vulnerability data on open-source AI agents and AI frameworks for the first time. That is a genuinely new asset class, and it now inherits the same identifiers, the same metadata, and the same stewardship as everything else in the catalog.
The count just grew. Nothing about how it's stewarded did.
• JFrog Artifactory CVE-2026-82329, CVSS 9.8 improper authentication. JFrog patched on August 28. By September 1 watchTowr had observed attackers generating admin tokens and enumerating users, groups, credentials and federated access relationships. CISA added it to KEV on September 2 with a September 5 federal deadline. Patched branches are 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20.
• SonicWall SMA1000 CVE-2026-83548 and CVE-2026-83549, both exploited in the wild and found internally by SonicWall. The first is a CVSS 10.0 pre-authentication SSRF in the Appliance Work Place interface, the second a CVSS 7.8 OS command injection in the Appliance Management Console. Together they give unauthenticated remote code execution. Affects SMA1000 6210, 7210 and 8200v, not SMA 100 or firewall SSL-VPN.
• Sangoma Switchvox CVE-2026-9586, CVSS 9.3 unauthenticated SQL injection in the /pa endpoint, where a user-controlled PhoneIP value lands in a PostgreSQL query without parameterization. It executes as the PostgreSQL superuser. Sangoma patched it in 8.4.0.2 on July 14 and SRA Labs published its findings on July 17. Exploitation attempts began August 30, nearly seven weeks after the fix shipped.
• Langflow CVE-2026-0768, exploited to steal OpenAI and AWS keys. A working RCE for 1.10.0 is public.
• Zimbra Collaboration CVE-2026-73570, remote code execution. At least 274 unpatched servers have already fallen to it.
• Citrix NetScaler CVE-2026-8452, a flaw Citrix disclosed and patched on June 30 that attackers only picked up now. Defenders are seeing web shells and discovery activity on compromised appliances. CISA added it to KEV on August 26 and gave federal agencies until August 29 under BOD 26-04.
• PaperCut, recently patched zero-days used in data theft, with attackers planting remote access tools on compromised servers.
• Microsoft Exchange CVE-2026-62911, an authentication bypass by capture-replay that Microsoft classifies as elevation of privilege, fixed on August 11 and credited to Orange Tsai of DEVCORE with Trend Micro's Zero Day Initiative. Shadowserver counted roughly 22,000 exposed servers on September 1, and NCSC-NL confirmed a working exploit is already public. Exchange Online is unaffected.
• Cleo Harmony, an exploit is now public for a freshly disclosed vulnerability.
• Ruby on Rails, a vulnerability drawing attacker attention ahead of an official CVE assignment.
• tl;dr sec #343 (tl;dr sec) Why it's worth your time: Clint Gibler's roundup carries the Hugging Face technical report, AWSHound, and an OWASP Agentic Skills Top 10. If you are writing agent policy this quarter, that last one is the closest thing to a shared vocabulary anyone has published.
• State divergence enables unauthorized access (Trail of Bits) Why it's worth your time: an authorization check on Provenance Blockchain accepted any one of three conditions, and the third turned out to be trivially satisfiable, letting any user grant themselves admin over 82 markers holding live financial assets. A clean study in how an access check written as an OR becomes an access check anyone can pass.
• About Remote Code Execution in Zimbra Collaboration (Alexander Leonov) Why it's worth your time: the mechanics behind the CVE that is currently eating unpatched Zimbra servers, written by a researcher rather than summarized by a newswire.
• Exploits and vulnerabilities in Q2 2026 (Kaspersky Securelist) Why it's worth your time: the quarter's exploit and C2 statistics, and the first edition to aggregate vulnerability data on open-source AI agents and frameworks. Useful as a baseline before anyone asks you how big that estate is.
• OpenClaw went viral. Meet the maintainers building and securing it. (The GitHub Blog) Why it's worth your time: what it actually feels like when your side project becomes critical infrastructure over a weekend, told by the people doing the security work.
The briefing security leaders actually read. CVEs, tooling shifts, and remediation trends — distilled into 5 minutes every week.
Join security leaders who start their week with the briefing. Free, 5 minutes, no fluff.
First briefing drops this week. Check your inbox.
Weekly only. No spam. Unsubscribe anytime.