CISO Daily Briefing
ALT CISO BRIEFING
Cloud Security Alliance Intelligence Report
Executive Summary
The 48-hour scan surfaced two unauthenticated remote code execution flaws in Kaltura’s mwEmbed video player that the vendor has still not acknowledged, leaving multi-tenant CDN customers to fend for themselves. A DNS-rebinding flaw in NVIDIA NemoClaw lets any webpage silently rewrite a local AI agent’s model behavior with no phishing required, and a newly documented Windows implant, SLEEPWALKER, stays dormant with no outbound C2 until a single crafted packet arrives. On the governance side, ENISA opened a consultation on the first EU-wide MSSP certification scheme, comment window closing September 13, 2026. Anthropic/EPFL research on self-propagating “mind viruses” in agent identity files also surfaces a new systemic contagion vector worth tracking, though no in-the-wild spread has been confirmed.
“Mind Viruses”: A New Agent-to-Agent Contagion Vector
MEDIUM
Anthropic/EPFL research shows ideas can spread agent-to-agent through persistent identity files like SOUL. No in-the-wild spread confirmed, but a simple system-prompt warning nearly eliminates it.
- 55% infection rate via identity files vs. 17% ordinary files
- Alignment training, not capability, drives resistance
- One-paragraph warning is a near-complete mitigation
Overnight Research Output
Kaltura mwEmbed: Unpatched Deserialization Flaws Enable Unauthenticated RCE
CRITICAL URGENCY
Summary: Two unpatched vulnerabilities in Kaltura’s mwEmbed HTML5 video player — CVE-2026-19913 (arbitrary file read, CVSS 9.1) and CVE-2026-19912 (RCE, CVSS 10.0) — both stem from an unsanitized deserialization endpoint, mwEmbedLoader.php, and require no authentication to exploit. Researcher Gerjan Wemekamp escalated the finding to Kaltura for five months, through corporate, executive, and national-CERT channels, without a substantive vendor response; CERT/CC’s own advisory states it “was unable to reach Kaltura.” The vulnerable endpoint sits on Kaltura’s shared, multi-tenant CDN, so a single exploited host can expose data or code-execution access affecting multiple unrelated customers at once.
Key Sources:
The Hacker News — Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code (Aug 26, 2026)
CERT/CC — VU#308749: RCE and Arbitrary File Read Vulnerabilities in Kaltura Servers
DNS-Rebinding Flaw in NVIDIA NemoClaw Enables Persistent Model Poisoning
HIGH URGENCY
Summary: CVE-2026-65105 (CVSS 8.1) combines DNS rebinding with NemoClaw’s default of binding its local Ollama instance to all network interfaces, letting a malicious webpage reach the unauthenticated API and rewrite the chat template governing every future model interaction. Because the poisoned template lives beneath the system-prompt layer, the injected instructions persist across reboots and are invisible in conversation logs. NVIDIA has shipped a structural fix for macOS and Linux; Windows and WSL received only a warning, leaving those platforms exposed at disclosure.
Key Sources:
The Hacker News — A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw (Aug 25, 2026)
Cyera Research — Drive-By Agent Hijacking: One Website Visit, Persistent Model Poisoning
CSO Online — NemoClaw’s AI Can Be Poisoned Through a Browser Tab (Aug 25, 2026)
SLEEPWALKER — A Network-Triggered Windows Backdoor With No Outbound C2
HIGH URGENCY
Summary: SLEEPWALKER is a previously undocumented 64-bit DLL that side-loads into the ESET Management Agent, impersonating a legitimate Windows library, and remains fully dormant — no C2 domains, no beaconing — until it receives a specifically crafted network packet validated through AES-256-CCM decryption. Once triggered, it interprets commands written in a bespoke 23-instruction bytecode language covering staged payload delivery, in-memory shellcode execution, and six covert transport channels. It requires prior admin access to deploy and shows no code overlap with known threat-actor toolsets, so attribution remains unresolved.
Key Sources:
The Hacker News — New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode (Aug 26, 2026)
The Register — You Don’t Want This Sleepwalker Backdoor on Your Windows Machine (Aug 24, 2026)
ENISA Opens Public Consultation on First EU-Wide Certification Scheme for Managed Security Services
MEDIUM URGENCY
Summary: ENISA opened public consultation on the draft EUMSS certification scheme on July 24, 2026, with comments due September 13, 2026. Issued under Article 48(1) of the Cybersecurity Act, EUMSS defines horizontal baseline controls plus service-specific vertical requirements (currently only an incident-response profile) across three assurance tiers — basic, substantial, and high. Certification will become mandatory for providers seeking eligibility in the EU Cybersecurity Reserve within two years of the scheme’s finalization, giving MSSPs a direct commercial reason to weigh in now.
Key Sources:
“Mind Viruses” — A New Contagion Vector as Agent Ecosystems Share Persistent Prompt State
MEDIUM URGENCY
Summary: An August 10, 2026 Anthropic/EPFL preprint demonstrates that ideas engineered to self-propagate can spread between AI agents through editable, persistent identity files like SOUL, infecting the next agent in a chain 55% of the time versus 17% for an ordinary file. Claude Sonnet 4.6 proved “essentially fully immune,” while other models of comparable capability showed varying susceptibility — alignment training, not raw capability, drove resistance. A one-paragraph system-prompt warning reduced successful propagation to near zero across 150+ adversarially evolved payload generations, and no confirmed in-the-wild multi-hop infection was found in ~2,000 traced attempts on the Moltbook agent social network.
Key Sources:
The Hacker News — AI “Mind Viruses” Can Spread Between Agents Through Persistent Prompt Files (Aug 2026)
Notable News & Signals
Talos “SPECTRE” Coverage Confirms UAT-10147 Agentic Attack-Scaling Story
This cycle’s Talos and Forrester/Aegis coverage of agentic-controls risk restates the UAT-10147/SPECTRE implant already covered across three CSA notes (Aug 21, 24, 25) — no new action needed.
ENISA NIS360 2026 Sectoral Maturity Report Still Circulating in Trade Press
References to the NIS360 report continue to appear alongside AI Act and NIS2 coverage this cycle; CSA’s corpus already addresses it in depth, so no new note was produced.
Topics Already Covered (No New Action Required)
- Gitea CVE-2026-60004 RCE: Active exploitation covered in CSA research note dated Aug 26, 2026.
- Zimbra CVE-2026-73570 SNMP nation-state exploitation: Covered in CSA research note dated Aug 26, 2026.
- MLflow SSRF (CVE-2026-64849): Covered Aug 26, 2026, with an earlier related note from Aug 23, 2026.
- UAT-10147 SPECTRE implant / agentic attack scaling: Covered across three CSA notes dated Aug 21, 24, and 25, 2026.
- China AI agent regulation enforcement: Covered in CSA research note dated Aug 26, 2026.
- EU AI Act Digital Omnibus / Article 50 / high-risk deadline delay: Covered extensively across six-plus CSA notes since June 2026, most recently Aug 1, 2026.
- ENISA NIS360 2026 sectoral maturity report: Already covered in the CSA corpus alongside NIS2/AI Act analysis.
- Non-human identity / AI agent identity governance: A saturated topic area (15+ existing CSA notes); CSA’s own Aug 20 “Governing AI Agent Identities” maturity-model post was considered but skipped as duplicative.