CISO Daily Briefing
Cloud Security Alliance Intelligence Report
Executive Summary
Autonomous AI agents are now carrying out intrusions at scale. One operator using the open-source Cairn agent platform broke into sites at more than 100 companies, at a reported cost of about $50 per breach. The AI supply chain is also under attack. Researchers showed that backdoored open-weight models can steal credentials through coding agents, and attackers are hijacking Google Cloud billing accounts to run up six-figure Gemini bills within 48 hours. DHS’s DeepSeek order now reaches products “developed using” DeepSeek. Separately, PHP2Shell patches land at 14:00 UTC today; prioritize patching internet-facing PHP.
Overnight Research Output
Fifty Dollars per Breach: Detecting Autonomous Agent Intrusion Campaigns
CRITICAL URGENCY
Summary: Reuters and NorForge report that a Chinese-speaking operator used Cairn agents to attack 1,200+ websites and breach more than 100 companies, including Deere, SharkNinja, and Cummins. The operator’s instructions to the agents ran to fewer than 100 characters. The agents reached working access in under 23 hours, often through support or vendor-run sites rather than the hardened main application. Cost estimates range from about $5 per task to about $50 per successful intrusion. Gambit Security measured about $25 per scan. Wiz CIRT separately documented machine-speed attacks across cloud, Kubernetes, CI/CD, and identity. Attribution of specific models (Claude Code, DeepSeek) comes from aggregators and has not been confirmed by Reuters.
Key Sources:
NorForge — Inside Cairn: Open Windows into Massive AI-Driven Cyber Operations
Wiz — Anatomy of AI-Driven Cloud Attacks
Unit 42 — AI Campaign Targets Linux Infrastructure
GridinSoft — Cairn AI Attacks: Exposed Panels, Webshells and Secrets
Poisoned Weights: Trigger-Activated Backdoors in Abliterated Open-Weight Models
HIGH URGENCY
Summary: ProjectDiscovery trained a backdoor into Qwen2.5-7B-Instruct with a QLoRA adapter in about 2.5 hours for roughly $8. The backdoor fired on all 50 triggered prompts and answered all 50 clean tool-calling prompts correctly. Inside a coding agent, the trigger makes the model emit a pointer to a remote script that steals credentials, so the operator can change the payload after distribution. Schneier notes that AI inherits every software supply-chain weakness. Research from Anthropic and Microsoft shows that finite testing cannot rule out an unknown trigger.
Key Sources:
ProjectDiscovery — How Abliterated Models Can Get You Pwned
Schneier on Security — Backdooring Open-Weight AI Models
Microsoft Security — Detecting Backdoored Language Models at Scale
Cloud Billing Hijacking as LLMjacking: From Search Ad to Six-Figure Gemini Bill
HIGH URGENCY
Summary: Wiz CIRT documented GCP intrusions that began with sponsored search ads for “google cloud” and “gcp,” which led to a fake login page that captured passwords and MFA codes. The attackers then deleted the domain-restriction organization policy, added external Gmail accounts as billing admins, demoted the legitimate admins to viewers, and linked their own projects to the victim’s billing account. Gemini charges reached tens to hundreds of thousands of dollars within 48 hours. The victim never sees the attacker’s prompts or logs.
Key Sources:
Wiz — From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts
Google AI Developers Forum — 13 Foreign Projects Attached to Our Dormant Billing Account
The Hacker News — Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes
DeepSeek FASCSA Order: What “Developed Using” Means for AI Supply Chains
HIGH URGENCY
Summary: DHS’s exclusion and removal order, signed July 24 and published October 20, bars DeepSeek products from federal civilian agencies. It also removes “third-party products and services developed using DeepSeek implementations,” an undefined phrase that may reach self-hosted weights, fine-tunes, quantizations, and possibly distilled models. The agency exception window closed before the order was published. When FAR 52.204-30 is in a contract, contractors must report covered products within three business days and flow the clause down to subcontractors.
Key Sources:
Federal Register — DeepSeek Exclusion and Removal Order #2026-01 (PDF)
The Hacker News — US Orders DeepSeek Removed from Federal Systems
Forkast — The Exclusion Follows the Model Into Anything Built On It
When Trust Infrastructure Fails: Keys and Relays as Chokepoints
MEDIUM URGENCY
Summary: Eight eMudhra intermediate CA keys were so weak that anyone could recover them from the public certificates. Browsers distrusted them within hours, and Certificate Transparency limited the damage. Stolen UpdraftCentral keys were used to backdoor WordPress sites, with about 400,000 potentially exposed. A ConnectWise vendor credential was used for unauthorized sign-ins to 162 Microsoft 365 tenants, and 300+ hijacked Tor exits intercepted SSH logins.
Key Sources:
Google — Protecting Chrome and Android Users from Compromised eMudhra Intermediate CAs
The Hacker News — Eight eMudhra CA Keys Compromised
BleepingComputer — Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites
Notable News & Signals
PHP2Shell: Emergency PHP Patch Due 14:00 UTC Today
PHP is releasing an out-of-cycle fix today for two critical remote code execution flaws (CVE-2026-109618/109619, CVSS 9.2). Researchers expect mass exploitation soon after release, so patch internet-facing PHP immediately.
FortiSIEM CVE-2026-106173 Public PoC Released
Horizon3.ai has published a working exploit for unauthenticated remote code execution through the FortiSIEM gRPC service on port 27918. Upgrade to 7.5.1, or restrict access to the port.
Qilin and INC Ransomware Exploit PAN-OS CVE-2026-0257
Ransomware affiliates are using a GlobalProtect authentication bypass for initial access. Confirm that PAN-OS and Prisma Access are patched, and review VPN authentication logs.
CISA/FBI #StopRansomware Advisory on SafePay
Joint advisory AA26-293A reports that SafePay has hit 600+ victims through VPN credentials and edge-device CVEs. The group stops shadow copies and factory-resets backup NAS devices.
Generative AI Erases Behavioral Tells in Phishing
Proofpoint reports that AI-written phishing is now fluent, personalized, and unique to each recipient. Detection that relies only on behavior is weakening, so training and filtering need to shift toward the sender's intent.
Visual Studio Copilot / SSMS RCE (CVE-2026-103572)
A trailing dot in a filename let prompt-injected Copilot edit sensitive configuration files without asking the user, which enables code execution. Patched in October Patch Tuesday; update Visual Studio and SSMS.
Topics Already Covered (No New Action Required)
- ENISA Threat Landscape 2026 (dependencies): Covered by two CSA Labs research notes (Sep 24 and Sep 26).
- Independent evaluators at frontier labs: Covered by “Embedded Independent Evaluators: What Does Independence Establish?” (Oct 17).
- AI cryptanalysis: Covered by “AI Cryptanalysis and the Cryptographic Assumption Horizon” (Oct 20).
- PEERSTITCH FortiGate implant (Unit 42): Covered (Oct 18).
- AI-agent intrusion campaigns (ARTEX, CyberXero, CERT-In advisory): Covered Oct 12–19. Today’s Cairn note is scoped to detection and economics.
- Agentic identity standards: Covered in prior CSA research (Sep 16).