CISO Daily Briefing
ALT CISO BRIEFING
Cloud Security Alliance Intelligence Report
Executive Summary
Attackers are going after the build and secrets layer behind enterprise AI. The wfx CI secret stealer used 4,837 hijacked GitHub accounts to harvest AI keys and cloud identities. Its persistence survives key rotation. AntiFox, a fork of ARTEX, has moved agent-driven intrusions into AWS Secrets Manager and Bedrock. Apache’s AI-discovered CVE-2026-119618 RCE needs immediate HTTP/2 triage because several distributions still ship no fix. The Fireworks–Notion exposure shows that a contractual zero-data-retention commitment does not contain fourth-party AI risk.
Overnight Research Output
The wfx Campaign: Hijacked GitHub Accounts Turn CI into AI-Key and Cloud-Identity Harvesters
CRITICAL URGENCY
Summary: From 10 November, an actor holding stolen GitHub credentials opened probe pull requests titled “docs: dependency audit notes.” It then injected a stealer into workflows or npm postinstall hooks. Aikido counted 4,837 compromised accounts and 61,764 targeted repositories, with confirmed execution in at least 1,806. The payload collects Actions secrets and AI provider keys. It also mints OIDC tokens to open AWS, GCP and Azure sessions. Commits are reverted within about a minute and run logs are deleted, so a gap in run numbers is often the only trace. StepSecurity notes that the campaign exploits no vulnerability in GitHub Actions. Action: search for the probe pull requests and run-number gaps. Rotate every secret the affected job could reach, delete wfx-ci-* federated credentials, and fix AWS trust policies that accept any account.
Key Sources:
StepSecurity — WFX Phantom: The GitHub Actions Secret Stealer That Deletes Its Tracks
SafeDep — wfx: GitHub Actions Credential Stealer Hits 8,000 Repos
The Hacker News — 4,837 Hijacked GitHub Accounts Ran CI Secret Stealer
CVE-2026-119618: AI-Discovered Apache mod_http2 RCE and the Distribution Patch Gap
HIGH URGENCY
Summary: A race condition in mod_http2’s assign_headers() corrupts heap memory and can lead to remote code execution. It affects httpd 2.4.55–2.4.70 and standalone mod_h2 2.0.8–2.0.42, and Apache fixed it in 2.4.71. Anthropic’s OSS Scanner and Google Cloud Vulnerability Research found it independently, eight days apart. Red Hat rates it CVSS 9.8 and cites a reliable exploit against default configurations. Debian has fixed trixie but still lists bookworm as vulnerable. Action: identify hosts that actually negotiate h2 or h2c, and patch where a fixed package exists. Elsewhere, set Protocols http/1.1 and rebuild container images.
Key Sources:
Apache HTTP Server Project — Apache HTTP Server 2.4 vulnerabilities
Debian — DSA-6620-1 apache2 security update
The Hacker News — Critical Apache HTTP/2 Flaw Could Let Attackers Execute Code
AntiFox in the Wild: Forkable Agentic Attack Frameworks Reach AWS Secrets Manager and Bedrock
HIGH URGENCY
Summary: Arctic Wolf Labs linked self-hosted AntiFox instances to confirmed intrusions. AntiFox is an open-source agentic pentest platform built on ARTEX. The operators moved from IIS web shells to web.config secrets. With valid AWS identities, they then issued hundreds of API calls across more than a dozen services in about 30 minutes, including Bedrock. Most calls were denied, but one GetSecretValue call against production succeeded. No Bedrock model invocation has been reported. Action: hunt for the published IOCs and for successful secret reads inside bursts of denied calls. Replace static IAM keys with role-based credentials, and enable Bedrock invocation logging.
Key Sources:
Arctic Wolf Labs — AntiFox Agentic Pentesting Platform Used to Steal AWS Credentials
GitGuardian — AntiFox Targeting AWS Credentials: The Latest Wave of AI Agent Attacks
Your Vendor’s Inference Provider: Fourth-Party AI Subprocessor Risk After Fireworks–Notion
HIGH URGENCY
Summary: Notion disclosed that Notion AI chat transcripts from fewer than 1% of its workspaces were exposed. The breach happened at its inference vendor, Fireworks AI, even though Fireworks had committed contractually to zero data retention. Fireworks confirmed that the 23 October intrusion came through its own third-party cloud provider and reached model weights and datasets for some customers. The exposed data sat at rest in a dataset, outside the default ZDR inference path. Action: Notion customers should review transcripts and rotate any credentials found in them. TPRM teams should ask key SaaS vendors which inference providers sit behind each AI feature and what each one retains.
Key Sources:
Notion — Security incident involving a third-party AI vendor
Fireworks AI — October 2026 Security Incident Update
BleepingComputer — Fireworks AI discloses new breach after cloud provider hack
SecurityWeek — Notion Customer Data Compromised in Fireworks AI Hack
Sandboxes Without Safe Harbor: EU AI Act Regulatory Sandbox Implementing Rules
MEDIUM URGENCY
Summary: The Commission’s implementing regulation on AI regulatory sandboxes under Articles 57–58 was published on 11 November and reportedly applies from 1 December 2026. The regulation number is reported as 2026/2487 but has not yet been verified on EUR-Lex. Participants stay liable for third-party harm and are shielded only from AI Act fines, and only when they follow the plan in good faith. Exit reports must be “taken positively into account,” but they are not conformity declarations. Sandbox information is presumed disclosable unless it is flagged as confidential. Action: map AI red-teaming coverage to Article 15(5). Write every adversarial test class into the sandbox plan, and designate vulnerability findings as confidential by default.
Key Sources:
EU Law Live — Commission lays down common rules for AI regulatory sandboxes
European Commission AI Act Service Desk — Article 57: AI Regulatory Sandboxes
Notable News & Signals
N-able N-central: New Alleged Exploits Against Patched Servers
Fresh exploit claims reportedly work against patched N-central servers, prompting hosted instances to be taken offline. MSP customers should confirm their exposure and watch for a vendor update.
eMudhra CA Fallout Continues With Further Revocations
More compromised eMudhra intermediate certificates are being revoked. Check trust stores and certificate inventories for affected chains.
Topics Already Covered (No New Action Required)
- NEAR AI / SGLang RCE breach: Covered in “Inside the Enclave, Still Exposed” (11 November).
- Microsoft neuron-edit agent backdoors: Covered in “Seven Neurons to Root” (11 November).
- 35,000+ exposed Grok-built apps: Covered in “Public by Default” (11 November).
- Railway LLMjacking losses and Google’s LLMjacking cost warning: Covered in “Who Pays for Stolen Inference?” (11 November) and the Black October series.
- N-able N-central zero-days: Covered in “Able2Shell” (10 November). The new exploit claims may warrant an update.
- OpenSSH SSHole (CVE-2026-123158): Covered in “Any Long Password Works” (7 November).
- Qubole / trusted AWS cross-account abuse: Covered in “Trusted by Default” (10 November).
- Claude Code “Don’t Ask Again” settings-file secrets: Covered in “Approved Once, Leaked Forever” (8 November).
- ENISA 2026 State of Cybersecurity in the Union: Covered 10 November.