CISO Daily Briefing
Cloud Security Alliance Intelligence Report
Executive Summary
Attackers are going after the build and secrets layer that AI applications depend on. The wfx campaign used 4,837 hijacked GitHub accounts to push a CI secret stealer that harvests AI keys and plants cloud backdoors that survive key rotation. AntiFox, a forked agentic pentest framework, reached AWS Secrets Manager in confirmed intrusions. A critical Apache mod_http2 RCE (CVE-2026-119618) needs upgrading to 2.4.71 or disabling HTTP/2 while distribution packages catch up. The Fireworks–Notion exposure shows that fourth-party AI subprocessors can leak data even when zero-data-retention commitments are in place.
Overnight Research Output
The wfx Campaign: Hijacked GitHub Accounts Harvest CI Secrets
CRITICAL URGENCY
Summary: The campaign began on 10 November. An attacker using stolen GitHub tokens tests write access with innocuous “docs” pull requests, then injects the wfx stealer into workflows. Aikido counted 4,837 compromised accounts and confirmed execution in at least 1,806 repositories. The payload collects keys for OpenAI, Anthropic, Gemini and other AI services, exchanges GitHub OIDC tokens for AWS, Azure and GCP sessions, and then deletes its runs. StepSecurity notes that it exploits no flaw in GitHub Actions itself. Where the payload ran, treat every reachable secret and cloud role as compromised.
Key Sources:
Aikido Security — wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories
SafeDep — wfx: GitHub Actions Credential Stealer Hits 8,000 Repos
The Hacker News — 4,837 Hijacked GitHub Accounts Ran CI Secret Stealer
Endor Labs — Hijacked GitHub Accounts Push ‘wfx’ CI Secret Stealer
wfx-ci-* federated credentials to Azure app registrations. Because commits are reverted within about a minute, scanning the current repository state misses it, and gaps in workflow run numbers are often the only trace left.
CVE-2026-119618: AI-Discovered Apache HTTP/2 RCE and the Distribution Patch Gap
HIGH URGENCY
Summary: A race condition in mod_http2’s assign_headers() corrupts heap memory and allows remote code execution in httpd 2.4.55–2.4.70. The Apache advisory credits Anthropic’s AI-based OSS Scanner, which reported it first, and Google Cloud Vulnerability Research, which found it independently eight days later. Red Hat rates it CVSS 9.8 and cites a reliable public exploit. CSA could not locate that exploit research, and no in-the-wild exploitation has been reported. One day after release, Debian had fixed only some releases, and RHEL and Ubuntu fixes were still pending.
Key Sources:
Apache Software Foundation — Apache HTTP Server 2.4 vulnerabilities
h2/h2c from the Protocols directive is a fast interim fix. Confirm first that no services, such as gRPC back ends, depend on HTTP/2. Track your distribution’s packaging timeline as its own risk item.
AntiFox in the Wild: Forkable Agentic Frameworks Reach AWS Secrets
HIGH URGENCY
Summary: Arctic Wolf Labs linked self-hosted AntiFox instances to confirmed intrusions. Operators compromised IIS applications, harvested web.config secrets and abused valid AWS identities. In one case, the operator cycled through several identities and made hundreds of calls across IAM, Secrets Manager, KMS, EKS and Bedrock in about 30 minutes. One GetSecretValue call against a production secret succeeded. AntiFox is self-described as secondary development of ARTEX, the framework Microsoft tied to secret harvesting a week earlier.
Key Sources:
w3wp.exe spawning shells. Enable Bedrock invocation logging, because Bedrock was in the enumeration scope.
Your Vendor’s Inference Provider: Fourth-Party AI Subprocessor Risk
HIGH URGENCY
Summary: Notion disclosed that AI chat transcripts from fewer than 1% of its workspaces were exposed in a breach at Fireworks AI, its inference and fine-tuning provider. Fireworks had committed contractually to zero data retention, yet the data sat at rest in a dataset. Fireworks’ update says the attacker entered through a third-party cloud provider and attributes the activity to a financially motivated LLMjacking group. The chain runs from customer to SaaS vendor to inference provider to cloud host, and few TPRM programs model it.
Key Sources:
BleepingComputer — Notion says Fireworks breach exposed customer AI chat transcripts
Notion — Security incident involving a third-party AI vendor
SecurityWeek — Notion Customer Data Compromised in Fireworks AI Hack
BleepingComputer — Fireworks AI discloses new breach after cloud provider hack
Sandboxes Without Safe Harbor: EU AI Sandbox Rules and Security Testing
MEDIUM URGENCY
Summary: Implementing Regulation (EU) 2026/2487 sets common rules for national AI regulatory sandboxes under Article 58 of the AI Act. It was published on 11 November and, according to press reports, applies from 1 December 2026. Participants stay liable for harm to third parties and are protected only from administrative fines, and only when they act in good faith. Notified bodies must take exit reports “positively into account,” but those reports do not amount to conformity. The rules prescribe no catalogue of security tests, so the scope of adversarial testing is whatever the sandbox plan specifies.
Key Sources:
EU Law Live — Commission lays down common rules for AI regulatory sandboxes
Tech Times — EU AI Regulatory Sandbox Rules Start December 1
European Commission AI Act Service Desk — Article 57: AI Regulatory Sandboxes
Notable News & Signals
N-able N-central: New Alleged Exploits Prompt Hosted Shutdown
Proof-of-concept code for further N-central flaws has been published, and N-able took its hosted environments offline. N-able advises on-prem customers to do the same until a hotfix ships, and says it has not seen exploitation.
eMudhra CA Fallout Continues With Further Revocations
Fallout from the compromised eMudhra intermediate CAs continues, with additional revocations reported. Inventory any eMudhra-issued TLS certificates and plan replacements, because eMudhra is exiting the public TLS business.
Topics Already Covered (No New Action Required)
- NEAR AI / SGLang RCE breach: Covered in “Inside the Enclave, Still Exposed” (11 November).
- Microsoft neuron-edit agent backdoors: Covered in “Seven Neurons to Root” (11 November).
- 35,000+ exposed Grok-built apps: Covered in “Public by Default” (11 November).
- Railway LLMjacking charges and Google’s LLMjacking warning: Covered in “Who Pays for Stolen Inference?” (11 November) and the Black October series (2–5 November).
- N-able N-central zero-days: Covered in “Able2Shell” (10 November). The new exploits against patched servers may warrant an update.
- OpenSSH SSHole (CVE-2026-123158): Covered in “Any Long Password Works” (7 November).
- Qubole / trusted AWS cross-account abuse: Covered in “Trusted by Default” (10 November).
- Supermarket refrigeration attacks attributed to Iran: Covered in “When Fridges Fail Together” (3 November).
- Claude Code “Don’t Ask Again” settings-file secrets: Covered in “Approved Once, Leaked Forever” (8 November).
- ENISA 2026 State of Cybersecurity in the Union: Covered 10 November.
- Also observed, not yet analyzed: AMD Zen 5 TSA side-channels (medium, no exploitation, relevant to multi-tenant AI hosts), ScreenConnect/SCKit MSP attacks, and an Outlook zero-day in Microsoft’s November Patch Tuesday.