CISO Daily Briefing
ALT CISO BRIEFING
Cloud Security Alliance Intelligence Report
Executive Summary
Attackers are targeting the administrative and developer-tooling layer rather than end-user apps: N-able N-central shipped its fourth emergency hotfix in five weeks for a CVSS 10.0 pre-auth RCE, MikroTik RouterOS routers are under active exploitation via a chained SSH bypass (“MikroTrick“), and Coder’s registry was compromised to push credential-stealing Terraform modules into AI development pipelines. Separately, independent research found that Claude, Codex, and Hermes coding agents will autonomously install unregistered packages referenced in llms.txt files scraped from Fortune 500 and defense-contractor domains — a novel, cross-vendor trust failure with confirmed callbacks from live corporate networks. The Five Eyes alliance formalized frontier-model scrutiny criteria and “timely access” commitments, escalating government engagement with frontier AI. CISOs should prioritize immediate patching of N-central and RouterOS instances and audit coding-agent behavior against llms.txt-sourced instructions.
Overnight Research Output
N-able N-central Fourth Emergency Hotfix Patches Maximum-Severity Pre-Auth RCE
CRITICAL
Summary: N-able shipped its fourth emergency hotfix in five weeks for N-central 2026.3, closing CVE-2026-86218 — a CVSS 10.0 pre-authentication RCE requiring no credentials to exploit. N-able’s public advisory claims no confirmed in-the-wild exploitation, but this conflicts with separate customer notices and Huntress’s independent confirmation of a compromised N-central instance on September 4, two days before the hotfix shipped. The Shadowserver Foundation counts roughly 1,500 internet-facing N-central servers, concentrated in the U.S. and Europe, still exposed. Because N-central is used by MSPs to administer client endpoints at scale, a single compromised instance can pivot into every downstream customer environment it manages.
Key Sources:
BleepingComputer — N-able patches max severity N-central flaw amid ongoing attacks
SOCRadar — N-able N-central HF4 Patches Critical Pre-Auth RCE
TechNadu — N-able Patches Max-Severity N-central RCE Flaw CVE-2026-86218
MikroTrick — Chained MikroTik RouterOS Flaws Enable Unauthenticated Router Takeover
CRITICAL
Summary: CERT Polska coordinated disclosure of six RouterOS vulnerabilities on September 5, three of which chain — dubbed “MikroTrick” — into full administrative takeover of any SSH-exposed router with no credentials. CVE-2026-67276 (CVSS 9.2) stems from RouterOS validating only the key type and modulus of an SSH public key, not the full key, letting an attacker forge a valid key without the private key. CVE-2026-86060 (CVSS 9.2) then escalates that pre-auth foothold to full admin via a crafted username. Active exploitation, including rogue admin account creation traced to a specific attacker IP, was confirmed a full three days before the public advisory.
Key Sources:
Coder Registry Compromise Distributes Credential-Stealing Terraform Modules to AI Development Environments
HIGH
Summary: On August 31, an attacker compromised a Cloudflare API key belonging to Coder and used it for roughly fourteen hours to redirect a subset of registry.coder.com traffic to an attacker-controlled server. Users fetching Terraform modules during that window received tampered artifacts that harvest provisioner environment variables, cloud API keys, CI/CD credentials, and SSH keys. Because Coder provisions cloud development environments for both human developers and autonomous AI coding agents at organizations including Dropbox, Palantir, and U.S. government/defense customers, the blast radius extends into AI-tooling credentials as well as conventional CI/CD secrets.
Key Sources:
BleepingComputer — Coder’s registry infrastructure compromised to push malicious modules
SC World — Coder platform targeted by attackers delivering malicious Terraform modules
eSecurity Planet — Coder Registry Compromise: Malicious Terraform Modules Explained
Five Eyes Formalize Frontier AI Model Scrutiny and Industry Access Commitments
HIGH
Summary: The Five Country Ministerial 2026 communiqué (Australia, Canada, New Zealand, UK, US; Sydney, August 25–26) formalizes frontier AI model oversight as a standing ministerial-level agenda item for the first time. The communiqué commits the five nations to identifying model characteristics that “may require additional government scrutiny” while simultaneously pledging “timely access to frontier models” for national-security purposes — pairing tighter oversight with an explicit government access guarantee. Neither government has published the specific triggering criteria, leaving enterprises to infer them from adjacent actions such as the U.S. Commerce Department’s suspension of Anthropic’s Fable 5 and Mythos 5 models.
Key Sources:
GOV.UK — Five Country Ministerial Communiqué 2026
Australian Government, Department of Home Affairs — Five Country Ministerial 2026
Import AI 471 — Why Hugging Face worries me; space mining; Five Eyes on AI
The llms.txt Trust Model Is Broken — AI Coding Agents Install Unregistered Packages Across the Fortune 500
CRITICAL
Summary: Independent researchers scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies, and Big Tech, and found 120 llms.txt files referencing code packages or domains that were never registered. After claiming a handful of those dangling references, researchers received phone-home callbacks from a Fortune 500 corporate network within an hour, with process-lineage evidence implicating at least three different AI coding agents — Anthropic’s Claude, OpenAI’s Codex, and Nous Research’s Hermes. The underlying failure is a trust model: coding agents treat vendor-published llms.txt documentation as ground truth and execute its installation commands without verifying the referenced package exists or is owned by the vendor.
Key Sources:
Schneier on Security — AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks
Compendia Labs — The llms.txt Trust Model
Startup Fortune — Researcher Alon Hertz Tricked Claude, Codex and Hermes Into Running Malware
Notable News & Signals
Latin America AI-Enabled Data-Exfiltration Campaign (Unit 42)
Reviewed as a technical candidate this cycle but superseded by the three fresher, higher-severity items above (N-able, MikroTik, Coder); may warrant a dedicated note in a future cycle if follow-on reporting emerges.
Topics Already Covered (No New Action Required)
- Hugging Face rogue AI agent swarm / OpenAI incident: Extensively covered across four separate CSA research notes between September 1–6 (rogue agent swarm, emergent agent coordination systemic risk, agentic sandbox escape). No new facts surfaced this cycle beyond existing coverage.
- AI-vendor and GPU concentration risk: Covered September 3–5 (GPU monoculture, AI agent collective supply chain concentration, AI access concentration). No new material this cycle changes that analysis.
- EU AI Act / SB 53 frontier disclosure governance: Covered September 3 (EU CRA reporting deadline) and September 5–6 (SB 53 critical threshold, AI incident disclosure gap). No fresher governance material on these specific threads surfaced this cycle.