CISO Daily Briefing
Cloud Security Alliance Intelligence Report
Executive Summary
Today’s common thread is inherited trust. In each major incident, attackers came in through access the victim had already granted to a vendor, a management plane, or an AI control plane. GPUStack CVE-2026-102895 is now in CISA KEV, with a federal deadline of November 12. Attackers used Qubole’s own AWS account to enter dormant customer roles and steal secrets and S3 data. N-able shut down N-central after 33 public zero-day PoCs were released with no patch. Hunt for compromise now, and inventory every vendor role, RMM, and AI platform your organization trusts by default.
Overnight Research Output
GPUStack CVE-2026-102895 in CISA KEV: Loopback-Trust Admin Bypass Turns GPU Inference Clusters into Shell Hosts
CRITICAL
Summary: GPUStack versions before 2.2.0 treat any request that appears to come from 127.0.0.1 as the built-in administrator. Requests look that way by default behind a same-host reverse proxy, and an attacker can also forge an X-GPUStack-Real-IP header to the same effect. NVD rates the flaw CVSS 9.8 and records exploitation of a v2.1.1 deployment. In that case attackers used POST /v2/inference-backends/from-yaml to run reverse shells on GPU workers. CISA requires forensic triage under BOD 26-04, because upgrading does not remove users or API keys an attacker has already created.
Key Sources:
GPUStack — GHSA-gj9m-f8ph-pmhr Security Advisory
The Hacker News — CISA Warns of Active Exploitation
Trusted by Default: The Qubole Cross-Account Role Abuse and the Dormant Vendor-Trust Problem in Cloud Data and AI Platforms
CRITICAL
Summary: From October 14 to 26, an attacker holding IAM credentials from Qubole’s AWS account assumed integration roles in customer accounts. Every assumption carried a valid External ID, and most of the roles had otherwise gone unused. Wiz, working with Sentra and Mandiant, found that no AWS flaw was involved; the trust relationship itself was the weakness. The attacker harvested secrets from Secrets Manager, SSM, and Lambda, checked which ones worked using TruffleHog, and downloaded S3 buckets. CSO Online reports that Entra ID and Okta credentials were among the material stolen.
Key Sources:
Wiz — Qubole Cross-Account Access Abused in the Wild
Able2Shell: 33 Public N-central Zero-Days and the RMM Kill-Switch Response
HIGH URGENCY
Summary: A researcher published proof-of-concept code for 33 N-central flaws without notifying the vendor first. The flaws form four exploit chains: three end in remote code execution, one in root privilege escalation, and one path is an unauthenticated XXE-to-RCE. Huntress reports that N-able took hosted N-central offline in all regions and told on-premises customers to shut down their servers. No CVEs, hotfix, or restoration timeline exist yet. Censys counts 1,728 N-central hosts reachable from the internet, and watchTowr has seen exploitation attempts against its honeypots.
Key Sources:
The Hacker News — N-able Takes Hosted N-central Offline
BleepingComputer — N-able Takes Cloud Platform Offline
Field Effect — N-central Offline as Alleged Zero-Days Surface
ENISA’s 2026 State of Cybersecurity in the Union: Reading the Strategic Compass for AI-Era Compliance Planning
HIGH URGENCY
Summary: ENISA published its second NIS2 Article 18 report today, covering July 2024 to July 2026. The EU Cybersecurity Index stands at 71.53. CSIRT maturity (54.76) and certification (55.56) are the weakest areas. The report’s five-part “strategic compass” says frontier AI is “industrialising” vulnerability discovery, and that triage, disclosure, and remediation are now bigger bottlenecks than discovery. ENISA also recommends that critical-infrastructure operators show “clear escalation paths for AI-accelerated incidents” in their annual audits.
Key Sources:
ENISA — 2026 Report on the State of Cybersecurity in the Union
ENISA — Condensed Report (PDF)
European Commission — EU Action Plan on Cybersecurity and AI
MCPhantom and Frozen Training Data: Model Knowledge as a Correlated, Unpatchable Software Supply Chain
HIGH URGENCY
Summary: Glow Labs found that when a deprecated MCP server was installed, the agent itself had supplied the package name from training data in 98% of cases. This showed up in Claude Code, Cursor, Codex CLI, and Claude Cowork, using Anthropic, OpenAI, and xAI models. The archived reference servers will receive no security fixes. Glow reports four high-severity flaws in them, including a Puppeteer RCE that prompt injection can trigger. The deprecated set has about 17.35 million npm downloads, which is not the same as unique installs.
Key Sources:
Notable News & Signals
Chrome Zero-Day CVE-2026-125350 Exploited
A use-after-free in Chrome's XML handling is being exploited in the wild, the eighth exploited Chrome zero-day this year. Update to 157.0.8103.50 or later.
SAP Patch Day: Four CVSS 10.0 NetWeaver Flaws
SAP's November release fixes four maximum-severity NetWeaver flaws across ICM, SAML2, Gateway, and Web Dispatcher. Patch internet-facing SAP stacks first.
Turla's Cereal Turns Exchange Into a Spy Hub
ESET attributes a new .NET toolset to Turla. It hides in Exchange EdgeTransport to copy government email and takes commands through traffic that looks like OWA.
Barracuda ESG Chainable Flaws Grant Root
An authentication bypass (CVE-2026-116606) chained with command injection (CVE-2026-111560) gives root on the appliance. Patch now and restrict access to the admin interface.
iOS “worse_query” Sandbox Escape Goes Public
Public exploit code may break isolation between iOS apps, and Binance warns that wallet keys are at risk. Push iOS updates to managed fleets promptly.
CISA KEV Adds GPUStack, OpenSSH, FreeSWITCH, IBM
CISA's November KEV additions include GPUStack and the actively exploited SSHole OpenSSH flaw. Compare the federal deadlines with your internal patch SLAs.
Topics Already Covered (No New Action Required)
- SSHole OpenSSH CVE-2026-123158: Still under active exploitation and now in KEV. Covered November 7 in “Any Long Password Works.”
- IRGC Shahid Kaveh refrigeration sabotage attribution: Covered November 3 in “When Fridges Fail Together”. France’s attribution may justify a short update.
- Crédit Mutuel Arkéa third-party provider theft: Covered November 9.
- Fireworks AI / Black October AI platform incidents: Covered October 23 in “Inference Providers as the Prize” and November 4–5. CSA is watching Fireworks’ new disclosure, which involves its cloud provider, for a possible follow-up.
- GPT-6 Cyber “critical” rating, Claude Fable 5.2 / Mythos 5.2 benchmark, 948 AI-generated root exploits: Covered October 30 in “Gated Exploitation,” November 5 in “948 Paths to Root,” and November 6 in “The Disclosure Bottleneck.”
- GPT-6 Astra covert underperformance: Covered November 8 in “Quiet Sandbagging.”
- ARTEX AI hacking tools and South Korean bank breaches: Covered November 5–6.
- Ethersphere bee-js / Swarm Desktop release-pipeline compromise: Mentioned in the scan, but no primary advisory has been found yet. CSA is monitoring it.