Second issue of our weekly review. Every Friday, the events of the last seven days, read through the eyes of a risk owner rather than an analyst. For each one, what it changes for a Canadian organization, and the question to ask on Monday morning.
Last week the thread was operations grinding to a halt. This week it lies elsewhere, and it is less comfortable: the tools your teams stood up themselves to move faster are now being exploited. An AI gateway, a workflow orchestrator, an artifact repository. None of it shows up in a classic asset inventory, and yet CISA has just added these products to the catalogue of actively exploited flaws.
Part 1: the toolchain nobody inventoried
Seven flaws in the KEV catalogue, and a pattern that gives it away
On 2 September, CISA added seven vulnerabilities to the KEV catalogue on evidence of active exploitation. Taken one at a time, they are seven more advisories. Taken together, they tell a single story.
LiteLLM (CVE-2026-59822, CVSS 8.8) is a gateway that unifies calls to language models. Its MCP endpoint accepted an entirely fabricated bearer token: when key validation failed, the code fell back to an empty authentication object, which handed an unauthenticated attacker a valid session. In practice, the ability to list and call the configured MCP tools, and so to reach the services connected behind them. Every version before 1.84.0 is affected, and two public exploits are circulating.
Starlette (CVE-2026-48710) allows HTTP request smuggling leading to authentication bypass. The analysis is explicit about the target: LiteLLM deployments, chained onward to code execution and the deployment of cryptocurrency miners.
Kestra OSS (CVE-2026-49869, CVSS 10.0) allows unauthenticated workflow execution. Actors drop reverse shells, map Docker containers, mine and harvest data. Microsoft assesses that exploitation likely began in late June.
JFrog Artifactory (CVE-2026-82329, CVSS 9.8) lets attackers mint administrator tokens, used to enumerate stored credentials and map the access topology.
The attackers' goal, described consistently across this week's analyses, does not vary: steal the API keys, establish persistence, monetize the host. Remediation deadlines for US federal agencies are 5 September for most, 16 September for Starlette and LiteLLM.
What it changes: an AI gateway is not a team gadget, it is a concentration point. It holds the keys to every one of your model providers, it is often wired to internal tools through MCP, and it was almost always deployed by a product team rather than by IT. This is exactly the shadow AI of episode 1 in our series, except it is no longer a consumer subscription: it is a server, exposed, with secrets inside. The question for your external attack surface inventory: how many components of your AI and developer chain, gateways, orchestrators, artifact repositories, are reachable from the internet, and who, by name, answers for them?
SonicWall: two chained zero-days on remote access gateways
On 2 September, SonicWall confirmed active exploitation of two previously unknown flaws in SMA 1000 appliances. CVE-2026-83548 is a pre-authentication server-side request forgery, rated CVSS 10.0, in the Appliance Work Place interface. CVE-2026-83549 is an OS command injection in the management console that yields code execution at administrator level. Chained, they produce remote code execution with no prior authentication at all. Models 6210, 7210 and 8200v are affected; SMA 100 appliances and SonicWall firewalls are not. The fixes are hotfixes 12.4.3-03526 and 12.5.0-02952. The flaws were found internally by two SonicWall researchers, and the vendor explicitly tells compromised organizations to re-image the appliance and reset credentials and TOTP tokens, which says a great deal about the persistence observed.
What it changes: this is the third week running in which the edge device is the way in, after Citrix NetScaler and the perimeter devices targeted by Gunra. What is new here is the remediation instruction: patching is not enough, you must presume compromise and start from a clean image. If your emergency procedure for a VPN gateway stops at "install the update", it is incomplete. It has to say who authorizes the rebuild, how long remote access stays down during the operation, and how your users work in the meantime.
Part 2: three facts that change how you steer
OpenAI ships a model that finds zero-days
On 3 September, OpenAI released GPT-6 Astra, presented as its first model to cross the "critical" cybersecurity capability threshold under its own evaluation framework. The model scores 100% on ExploitBench, an evaluation of vulnerability research and exploit development. On an internal set of twenty high-severity V8 engine flaws disclosed between June and August 2026, it reaches code execution rates well above the previous generation, and it discovered and then exploited two unknown vulnerabilities during the evaluation, which the vendor is disclosing to the maintainers. The shipped version refuses to write exploit code and keeps the defensive uses, code review and patching, behind restricted access and sandboxed execution.
What it changes: this follows directly from last week's joint advisory AA26-231A on AI-generated exploits against Siemens controllers. The skill barrier keeps falling, this time on finding flaws rather than exploiting old ones. Two governance consequences. First, the gap between a patch shipping and a working exploit appearing will keep compressing: a remediation schedule measured in weeks becomes a bet. Second, the same capability is available to your defence, since assisted code review and patch generation are explicitly allowed. The decision to make is not "should we ban these models", it is "which decisions here must still be signed by a named human", which is the subject of episode 2 on AI governance.
153 million driver's licences, 1.1 million of them Canadian, for sale
An identity theft service called Nexus put more than 153 million scans of US and Canadian driver's licences up for sale this week, alongside more than 10 million identity cards, 3 million travel documents and roughly 580,000 medical cards. Journalist Brian Krebs, working with researcher Zach Edwards, traced the most likely source to IDScan.net, an identity verification provider based in New Orleans. Around 1.1 million of the licences are Canadian. The FBI is investigating, the Nexus platform shut down shortly after publication, and IDScan has acknowledged neither the breach nor its scope.
What it changes: identity verification is a service you buy, and therefore a third party that concentrates your customers' and employees' identity documents. Two questions for your vendor register. First: which providers hold scanned identity documents on your behalf, and for how long, which Law 25 requires you to document under retention. Second, more operational: if your customers' identity documents are circulating, an authentication control that rests on presenting a scanned licence is worth very little. Account recovery and remote onboarding processes deserve a fresh read.
A fake acquisition, a forged NDA, 626,000 euros
Analysts at Gen Digital, the parent of Norton and Avast, documented a campaign named Phantom Deal after an attacker targeted a member of their own legal team. The setup is careful: a first, harmless WhatsApp message sent in the name of an executive the victim knows, asking only whether they are at the office. Then a second person, presented as a professional with a major consulting firm, asks for a personal email address and sends a confidentiality agreement in that firm's branding, describing a secret acquisition and strict disclosure rules. The document requires everything to go through WhatsApp and personal email, and colleagues to stay out of the conversation. The goal was a transfer of 626,735.45 euros to a Hong Kong entity. It failed because the employee noticed that the caller's voice did not match the colleague copied on the thread. The same document template turned up at four other targets across several industries.
What it changes: this is classic business email compromise, but the pretext is what makes it work. An acquisition NDA supplies a legitimate, documented justification for secrecy, and it neutralizes the one control that actually protects, checking with a colleague. No generic awareness training covers this case. The rule to write is procedural and admits no exception: no transfer, whatever the requester's seniority and whatever confidentiality is invoked, without verification through an independent channel chosen by the person paying, not by the person asking. And an NDA is never a valid reason to suspend that check.
The week's three questions for an executive committee
- Which components of our AI and developer chain, model gateways, orchestrators, artifact repositories, are exposed to the internet, and who answers for them by name?
- Does our emergency procedure for a remote access gateway cover rebuilding and credential rotation, or only applying the patch?
- Does our payment verification rule hold up against a requester invoking a confidential acquisition and a signed NDA?
If these three questions have no documented answer, our free cyber risk score places you in ten minutes across the data, third-party and resilience domains. To track these exposures continuously rather than once a year, that is the job of the attack surface and threat intelligence modules of the FortaRisks platform.
Sources: The Hacker News, seven flaws added to KEV · CISA, 2 September alert · Help Net Security, SonicWall SMA 1000 · SecurityWeek, SonicWall zero-days · The Hacker News, GPT-6 Astra · SecurityWeek, 153 million driver licences · Dark Reading, fake merger and acquisition scams