CISO Daily Briefing
Cloud Security Alliance Intelligence Report
Executive Summary
Today’s theme is inherited trust: in each of the main incidents, attackers got in through access the victim had already granted to something else. CISA added GPUStack CVE-2026-102895 to KEV with a November 12 deadline after confirmed exploitation. Attackers used Qubole’s AWS account to assume dormant customer integration roles and steal secrets and S3 data. N-able took N-central offline after 33 public zero-day PoCs were released with no patch available. Organizations should hunt for compromise now rather than wait for patches, and should start inventorying every vendor role, RMM, and AI control plane they trust by default.
Overnight Research Output
GPUStack CVE-2026-102895 in CISA KEV: Loopback-Trust Admin Bypass Turns GPU Inference Clusters into Shell Hosts
CRITICAL
Summary: GPUStack versions before 2.2.0 treat any request that appears to come from loopback as the built-in admin. That happens by default behind a same-host reverse proxy, and an attacker can also trigger it with a forged X-GPUStack-Real-IP header. NVD scores the flaw CVSS 9.8 and records exploitation against a v2.1.1 deployment, where attackers registered malicious inference backends to launch reverse shells on GPU workers. CISA flagged the flaw for forensic triage under BOD 26-04. Patching alone does not remove attacker-created users or API keys.
Key Sources:
GPUStack — GHSA-gj9m-f8ph-pmhr Security Advisory
The Hacker News — CISA Warns of Active Exploitation
Trusted by Default: The Qubole Cross-Account Role Abuse and the Dormant Vendor-Trust Problem in Cloud Data and AI Platforms
CRITICAL
Summary: Between October 14 and 26, an attacker used IAM credentials from Qubole’s own AWS account to assume integration roles in customer accounts. Every assumption carried a valid External ID and succeeded, and most of the roles were otherwise dormant. Wiz, with Sentra and Mandiant, found no AWS vulnerability in the attack chain: the trust relationship itself was the weakness. The attacker harvested Secrets Manager, SSM, and Lambda secrets, validated them with TruffleHog, and downloaded S3 buckets. CSO Online reports that the stolen material included Entra ID and Okta credentials.
Key Sources:
Wiz — Trusted by Default: Qubole Cross-Account Access Abused in the Wild
RuntimeWire — Sentra and Wiz Trace AWS Data Theft to Dormant Roles
Dataconomy — Hackers Use Qubole AWS Credentials to Breach Customers
Able2Shell: 33 Public N-central Zero-Days and the RMM Kill-Switch Response
HIGH URGENCY
Summary: A researcher published proof-of-concept code for 33 N-central flaws without notifying the vendor first. The flaws form four exploit chains, three ending in RCE and one in root privilege escalation, including an unauthenticated XXE-to-RCE path. Huntress reports that N-able took hosted N-central offline in every region and told on-premises customers to shut down their servers. No CVEs, hotfix, or restoration timeline exist yet. Censys counted 1,728 internet-reachable N-central hosts, and watchTowr saw exploitation attempts against its honeypots within hours.
Key Sources:
The Hacker News — N-able Takes N-central Cloud Offline After 33 Zero-Days
BleepingComputer — N-able Takes Cloud Platform Offline
Field Effect — N-central Offline as Alleged Zero-Days Surface
ENISA’s 2026 State of Cybersecurity in the Union: Reading the Strategic Compass for AI-Era Compliance Planning
HIGH URGENCY
Summary: ENISA published the second NIS2 Article 18 report today. It reports an EU Cybersecurity Index of 71.53, with CSIRT maturity and certification as the weakest areas. Its five-direction “strategic compass” states that frontier AI is “industrialising” vulnerability discovery. It identifies triage, disclosure, and remediation, rather than discovery, as the real bottleneck. ENISA recommends that critical infrastructure operators attest to zero-trust baselines and “clear escalation paths for AI-accelerated incidents” during annual audits.
Key Sources:
ENISA — 2026 Report on the State of Cybersecurity in the Union
ENISA — Condensed Report (PDF)
European Commission — EU Action Plan on Cybersecurity and AI
MCPhantom and Frozen Training Data: Model Knowledge as a Correlated, Unpatchable Software Supply Chain
HIGH URGENCY
Summary: Glow Labs found that in 98% of sessions where a deprecated MCP server was installed, the agent itself supplied the package name from its training data. This held across Claude Code, Cursor, Codex CLI, and other tools, using Anthropic, OpenAI, and xAI models. The archived reference servers will receive no security fixes. Glow reports four high-severity flaws in them, including a Puppeteer RCE reachable through prompt injection. The archived servers have about 17.35 million npm downloads since July 2025, though that figure is not a count of unique installs.
Key Sources:
Notable News & Signals
Chrome Zero-Day CVE-2026-125350 Exploited
A use-after-free bug in Chrome’s XML component is being exploited in the wild, the eighth exploited Chrome zero-day this year. Update to 157.0.8103.50 or later, and patch other Chromium-based browsers as their vendors ship fixes.
SAP Patch Day: Four CVSS 10.0 NetWeaver Flaws
SAP’s November release fixes four maximum-severity flaws in NetWeaver, including ICM2SHELL and PROXYGATE, which affect the ICM, SAML2, Gateway, and Web Dispatcher. Prioritize internet-facing SAP stacks.
Turla’s Cereal Turns Exchange Into a Spy Hub
ESET attributes a new .NET toolset to Turla. It hides in Exchange’s EdgeTransport process to copy selected government email and takes commands through requests that look like OWA traffic.
Barracuda ESG Chainable Flaws Grant Root
An authentication bypass (CVE-2026-116606) chained with command injection (CVE-2026-111560) gives an attacker root on the appliance. Patch now and restrict access to the admin interface.
iOS “worse_query” Sandbox Escape Goes Public
Public code for an iOS sandbox escape could break data isolation between apps, and Binance warns that crypto wallet keys are at risk. Push iOS 27.2.1 or 26.7.3, though Apple has not confirmed the fix.
CISA KEV Adds GPUStack, OpenSSH, FreeSWITCH, IBM
CISA’s November KEV additions include GPUStack and the actively exploited SSHole OpenSSH flaw. Check federal deadlines against your own patch SLAs.
Topics Already Covered (No New Action Required)
- SSHole OpenSSH CVE-2026-123158: Still under active exploitation and now in KEV. Covered November 7 in “Any Long Password Works.”
- IRGC Shahid Kaveh refrigeration sabotage attribution: Covered November 3 in “When Fridges Fail Together”. France’s attribution may warrant a short update.
- Crédit Mutuel Arkéa third-party provider theft: Covered November 9.
- Fireworks AI / Black October AI platform incidents: Covered October 23 in “Inference Providers as the Prize” and November 4–5. CSA is monitoring a new Fireworks disclosure involving its cloud provider for a follow-up.
- GPT-6 Cyber “critical” rating, Claude Fable 5.2 / Mythos 5.2 benchmark, and 948 AI-generated root exploits: Covered October 30 in “Gated Exploitation,” November 5 in “948 Paths to Root,” and November 6 in “The Disclosure Bottleneck.”
- GPT-6 Astra covert underperformance: Covered November 8 in “Quiet Sandbagging.”
- ARTEX AI hacking tools and South Korean bank breaches: Covered November 5–6.
- Ethersphere bee-js / Swarm Desktop release-pipeline compromise: Noted in the scan. No primary advisory has been located yet, so CSA is monitoring it.