Cyber Digest

Executive Summary

The day's lead is a reminder that the weakest link in an AI product is often the ordinary software underneath it: researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to chain a bug in OpenAI's public help forum with a weakness in OpenAI's single sign-on, and took over the ChatGPT and Codex accounts of several OpenAI employees — reaching an internal code repository with a single pull request in under 72 hours. The entry point was an image-parsing flaw in libheif (CVE-2026-32882) reached through Discourse's ImageMagick pipeline; the consequence was identity, because the forum offered the same "Sign in with OpenAI" SSO that staff use elsewhere. The vulnerable library was patched upstream in May 2026 but still shipped in the forum's server image, and Discourse's advisory rates the result as remote code execution at 8.8. OpenAI fixed it in about 14 hours and paid a US$6,500 bounty. The most urgent item for defenders is on the perimeter: Fortinet reports active exploitation of CVE-2026-58138 (CVSS 9.8), an unauthenticated remote code execution flaw in the Orkes Conductor workflow platform, where attackers submit crafted workflow definitions carrying JavaScript or Python expressions to the workflow API before authentication and escape the intended scripting sandbox into the Conductor process's own privileges; Fortinet blocked 1,290 attempts in 24 hours on 9 September, a 132 per cent daily increase, and nearly 7,000 between 2 and 9 September. Two supply-chain threads run alongside them. CrowdSec disclosed that an attacker copied roughly 170 of its private GitHub repositories in May using the still-live OAuth token of a recently departed employee whose laptop had been hit by the TanStack npm compromise — with the code, 83 user email addresses and investor details surfacing on a forum on 16 September — while a second CrowdStrike case study describes PhantomRaven, an npm credential stealer its operator most likely wrote with a large language model. Rounding out the top tier, CISA added three Linux kernel flaws to its Known Exploited Vulnerabilities catalog on 18 September — CVE-2025-39682 (9.8), CVE-2026-53266 (8.8) and CVE-2025-39964 (7.8) — with Red Hat acknowledging active exploitation and a federal remediation deadline of 21 September under BOD 26-04.

This week's through-line is that the supply chain is now being attacked through the credentials of people who have already left. CrowdSec's disclosure is the clearest case yet: the intrusion was in May, the copy was made with a token belonging to a departing employee whose access had been left open so he could finish work, the account was removed on 25 May, and the company learned of the leak on 16 September — four months of exposure that its own AWS monitoring could not see because, as CrowdSec puts it, the token left no trace in the GitHub logs it could check. The TanStack campaign that seeded it is the same May event that reached Mistral AI and OpenAI, which means one npm compromise has now produced at least four separate downstream disclosures spread across five months, and the delay itself is the finding: code-exfiltration incidents do not announce themselves, and offboarding hygiene is the control that fails quietly and reports late. The second thread is the collision of AI agents with ordinary web mechanics. In one week we have a privilege-chaining technique that turns a single browser extension into control over five vendors' built-in assistants, a model that guessed its way into a real company's systems during a capture-the-flag evaluation because a fictional domain name collided with a live one, and a research team using a frontier model to take over a frontier lab's staff accounts. None of these is a nation-state campaign, and all three describe the same structural problem: agents are being handed credentials, browser capabilities and repository access faster than the identity and evaluation controls around them are being tightened. Against last week's coverage, the shape has shifted rather than repeated. The 18 September North Korean WaterPlum advisory put hard numbers on a known campaign; today's items are smaller, more technical and mostly non-attributed — a platform RCE under live exploitation, three Linux kernel flaws with a federal deadline, a defacer-vs-ransomware-gang feud, and two vendor case studies of credential theft. The vulnerability firehose continues to dominate the sector counts, and the KEV additions keep arriving in clusters (three Linux kernel flaws in one day) rather than singly, which is consistent with the picture CISA has been arguing for months: exploitation is concentrating on flaws that give an attacker total control of an exposed asset, and disclosure volume keeps outrunning triage capacity. For the week ahead, the items to watch are whether the Orkes Conductor exploitation widens beyond the hosting countries Fortinet named, whether any of the Linux kernel flaws get folded into a working exploit chain, and whether the CrowdSec leak produces follow-on exposures at the other organisations whose developer machines were compromised in the same May campaign.