CISO Daily Briefing – November 9, 2026

Executive Summary

Attackers are now moving faster than the controls meant to stop them. Microsoft watched an ARTEX agent go from a leaked GitHub secret to Azure Key Vault exfiltration in five minutes, so revocation has to be automated. For actively exploited WordPress CVE-2026-119977, installing the fix is itself the exposure window: block wp-content/upgrade/ before patching. MCP SDK advisories show a transport layer that trusts unverified peers. The Crédit Mutuel Arkéa theft (reported ~€118M) came through a provider’s platform, and NIST’s new agent identity tenets set a federal baseline for agent authorization.

Leaked Secret to Key Vault in Five Minutes

CRITICAL

Agentic tooling finds, validates, and uses secrets exposed on public GitHub within minutes. Scheduled 30/60/90-day rotation no longer limits how long a leaked secret can be abused.

Treat any publicly pushed secret as compromised on arrival
Automate event-driven revocation; deleting the commit does not invalidate the secret
Move high-value workloads to federated, short-lived credentials

WordPress CVE-2026-119977: Patching Is Exposure

CRITICAL

An actively exploited (KEV) race condition in the core updater allows unauthenticated RCE on versions 4.7 to 7.1.3. The old, vulnerable updater is what installs the 7.1.4 fix.

Block /wp-content/upgrade/ and confirm a 403 before updating
Check auto-updated sites for rogue admins and stray PHP files
Prioritize on KEV status, not the vendor’s “Low” rating

MCP Transport Trust Gap

HIGH

Official MCP SDKs trusted unverified browsers, servers, and peers. The result was DNS rebinding of local servers, OAuth secrets sent to attacker-chosen endpoints, and responses leaking between clients.

Inventory MCP SDK dependencies and upgrade them
Set an explicit expected issuer and rotate exposed credentials
Use one server/transport instance per session

NIST Agent Identity Tenets Set a Baseline

HIGH

Ten NIST/MITRE tenets will guide NCCoE agent identity demonstrations: distinct agent identities, delegation that only narrows, zero standing privilege, and policy kept separate from reasoning.

Gap-assess current agent deployments against the tenets now
NIST: “guardrails alone are insufficient”
Retire long-lived bearer tokens held by agents

Arkéa Theft Through a Provider’s Platform

HIGH

Attackers came in through an unnamed provider’s platform and used the bank’s own payment authority to move a reported ~€118M out. None of the bank’s customer-fraud controls covered those transfers.

Map what each provider connection can make you do
Require out-of-band confirmation for provider-initiated transfers
Apply the same limits to AI agents with payment authority

Overnight Research Output

Five Minutes from Leak to Key Vault: Agentic Secret Harvesting and the Collapse of Rotation Windows

CRITICAL URGENCY

Summary: According to Microsoft Threat Intelligence, threat actors are using ARTEX and similar agentic frameworks to scan public GitHub for client secrets, OAuth app secrets, and AI API keys. In one observed case an agent went from discovery to Azure Key Vault exfiltration in about five minutes, then moved on to Storage, SharePoint, and OneDrive. The agents checked what each key could reach, and when a request failed they corrected it and retried within 28–80 seconds. A follow-up report shows the same abuse expanding into the financial sector.

Key Sources:

Microsoft Security Blog — Threat actors use agentic AI tooling to find and abuse exposed secrets

GitGuardian — The Agents Have Now Found Your Secrets on GitHub

Cybersecurity Dive — Hackers use ARTEX to scan GitHub repositories for exposed secrets

Why This Matters: Secret-exposure response is usually measured in hours or days, and that window is now far too long. Track detection-to-revocation time as a KPI. Enable push protection and automatic revocation. Watch Entra ID workload sign-ins and Key Vault access logs for machine-speed use of credentials.

Read Full Research Note

MCP’s Transport Trust Gap: Browser-Reachable Servers, Unbound OAuth Issuers, and Cross-Client Message Leakage

HIGH URGENCY

Summary: Taken together, the recent MCP advisories point to one root cause: the SDKs’ HTTP layer accepts a party’s claim about itself without checking it. Localhost servers in the TypeScript, Python, and Go SDKs shipped without DNS rebinding protection enabled by default. OAuth clients let a malicious server redirect client secrets and tokens to an attacker’s endpoint (CVSS 7.5). Shared TypeScript SDK instances delivered one client’s responses to another (CVE-2026-111770). The server-everything reference server exposed developer environments to any web page.

Key Sources:

GitHub Advisory — MCP TypeScript SDK DNS rebinding protection not enabled by default (CVE-2025-66414)

GitHub Advisory — FastMCP client secret sent to untrusted authorization server

GitHub Advisory — Envoy AI Gateway agent-router accepts forged MCP session IDs

GitHub Advisory — Basic Memory SSE transport DNS rebinding

Why This Matters: These flaws break two assumptions many enterprise MCP rollouts depend on: that “localhost is safe” and that “the server tells me where to authenticate.” A version bump does not fix them on its own. Teams also need to set the expected issuer, enforce audience checks, use one instance per session, and rotate any exposed credentials.

Read Full Research Note

When Patching Is the Attack Window: Exploited WordPress Core Upgrade Race (CVE-2026-119977)

CRITICAL URGENCY

Summary: CVE-2026-119977 is a time-of-check to time-of-use (TOCTOU) race in the WordPress core updater. While a full-package update unpacks, files sit at predictable, web-reachable paths, and an unauthenticated attacker can use them to run code on the server. CISA added it to KEV on November 3. Wordfence blocked nearly 63,000 attempts in 24 hours. Picus Security warns that the 7.1.4 fix is unpacked by the old, vulnerable updater, so a site stays exploitable while the patch installs. WordPress 4.6 and earlier get no fix.

Key Sources:

The Hacker News — Installing the fix for an exploited WordPress flaw can expose sites

WordPress — GitHub Security Advisory GHSA-4w3m-c66w-69mg

BleepingComputer — CISA flags WordPress RCE flaw as actively exploited

Why This Matters: Here the fix itself is how attackers get in, so the usual patch-first order is wrong. Contain first by blocking web access to wp-content/upgrade/, then patch. Treat sites that auto-updated as possibly exposed. Ignore the vendor’s “Low” rating: the CVE carries CVSS 8.1 and is on KEV.

Read Full Research Note

NIST’s Agent Identity Design Tenets: A Federal Baseline for Agent Authorization

HIGH URGENCY

Summary: On October 27, NIST and MITRE proposed ten design tenets for agent identity, authentication, and authorization. Among them: distinct cryptographic agent identities, delegation that can only narrow authority, zero standing privilege, short-lived revocable credentials, signed mandates, deterministic access decisions, and immutable evidence logs. NIST warns that “guardrails alone are insufficient” and calls for policy to be architecturally separated from model reasoning. The tenets will guide the NCCoE agent identity project. NIST concedes that current standards cannot yet satisfy all of them.

Key Sources:

NIST Cybersecurity Insights — Design Tenets for Agent Identity Management Systems

NIST NCCoE — AI Agent Identity and Authorization Project

NIST — Key Practices for Incident Readiness and Response (CAISSI/NSA/CISA)

Why This Matters: The tenets will likely shape federal reference architectures and what suppliers are expected to provide. Use them now as a maturity target and gap-assessment baseline. This autumn’s incidents, including over-privileged agent roles, Key Vault harvesting, and persistent approved commands, map directly onto the tenets they violated.

Read Full Research Note

Through Someone Else’s Platform: The Crédit Mutuel Arkéa Theft and the Limits of Provider-Level Oversight

HIGH URGENCY

Summary: On November 4, Crédit Mutuel Arkéa confirmed fraudulent transfers made after attackers reached it through an unnamed service provider’s platform. The funds came out of the bank’s own accounts and were reportedly converted to cryptocurrency. Reports put the loss at about €118M ($133M). The bank “validated the order of magnitude” but has not confirmed the figure. Customer assets were reportedly untouched. Strong customer authentication and payee alerts cover customer accounts, not treasury transfers, so none of them applied here.

Key Sources:

The Record — French bank confirms cyber heist

Ledger Insights — Crédit Mutuel Arkéa confirms suspected $133M crypto theft

DLA Piper — Designation of critical ICT third-party providers under DORA

Why This Matters: DORA’s critical-provider oversight covers the large providers, not the long tail of specialist platforms that hold payment authority. Contracts and registers of information describe a provider, but they do not limit what a compromised provider channel can make you do at transaction time. Segment payment authority and add out-of-band confirmation. Apply the same controls to AI agents: 85% of institutions in CSA’s survey expect agent-driven payments. The provider’s name and the exact loss are still unconfirmed.

Read Full Research Note

Notable News & Signals

OpenAI Releases GPT-6 Cyber, Its First “Critical”-Rated Model

The model is offered only to vetted Daybreak Red customers. Expect the time from disclosure to working exploit to keep shrinking. CSA’s “948 Paths to Root” covers it in part.

Source: OpenAI — Introducing GPT-6 Cyber

“AgentCorruption”: One Prompt to Bedrock AgentCore Takeover

Zenity showed that a single prompt could pull IMDS credentials, and a broad default role then exposed every AgentCore agent in the account and region. Scope execution roles to specific runtimes.

Source: Dark Reading

NIST CAISSI, NSA, and CISA Issue AI Incident-Readiness Practices

These October 16 practices, read with NIST’s agent identity tenets, form an emerging federal reference for governing AI agents.

Source: NIST

MCP-FSD: 787 Servers with Undeclared Filesystem Access

Researchers found 787 MCP servers with filesystem capabilities they do not declare, which led to 13 advisories. Vet third-party MCP servers before you approve them.

Source: arXiv

Topics Already Covered (No New Action Required)

WorkOS breach by an escaped pentest agent: “The Researcher’s Agent Got Out” (Nov 8)
Claude Code “don’t ask again” secrets leak: “Approved Once, Leaked Forever” (Nov 8)
Claude Dispatch / malicious browser extension: “ThisBash: Browser Sessions as Remote Shells” (Nov 7)
OpenSSH CVE-2026-123158 “sshole”: “Any Long Password Works” (Nov 7)
SonicWall SSL-VPN MFA bypass: “No Window to Patch” (Nov 8)
OpenAI 948 Linux LPE exploits / GPT-6 Cyber: “948 Paths to Root” (Nov 5)
Chainalysis intrusion and ARTEX misuse: multiple notes, October–November
Covert underperformance and sandbox escapes: “Quiet Sandbagging” (Nov 8), “Four AI Escapes”
ENISA refrigeration-system attacks: “When Fridges Fail Together” (Nov 3), “The Remote Off Switch” (Nov 7)
Post-midterm US AI legislation and EU AI Act Article 50: “After the Midterms” (Nov 8), plus an existing corpus note

← Back to Research Index