Fourth issue of our weekly review. Every Friday, the events of the last seven days, read through the eyes of a risk owner rather than an analyst. For each one, what it changes for a Canadian organization, and the question to ask on Monday morning.
Last week the thread fit in one sentence: the patch now arrives after the attacker. This week the problem moves one step upstream: the code you run is not the code you approved. A departed employee whose account stayed open, a plugin pinned by cryptographic hash that loads something else entirely, an expired domain bought by a stranger that thousands of sites still call. Three different mechanisms, one shared consequence: what runs inside your organization was decided somewhere else. Then the infrastructure side, where the pace has not slowed, and five Canadian claims in three days.
Part 1: four ways to lose control of what runs in your name
CrowdSec: 170 private repositories copied in May, discovered in September
On 18 September, French security vendor CrowdSec confirmed that roughly 170 of its private GitHub repositories were copied on 22 May, between 05:52 and 06:01 UTC, from an IP address in Toronto. The account used belonged to an employee who had just left the company and whose GitHub access had never been revoked. His laptop had been compromised in May's supply chain attack on TanStack: on 11 May, 84 malicious versions of 42 of that project's npm packages were published and harvested secrets from developer machines.
The stolen material includes the vendor's SaaS console, its data-science scripts and models, its deployment and automation tooling, and the consensus algorithm that decides whether an IP address lands on its blocklists. Add to that the email addresses of 83 users, and the names, emails and investment context of 51 prospective investors from 2020. CrowdSec says the account was used only to copy code, that its infrastructure and databases were not touched, and that no code was modified. The company saw none of it: the code surfaced on an online forum on 16 September, four months after the fact.
What it changes: nothing in that chain is exotic. A compromised dependency, a developer laptop holding tokens in the clear, an offboarding whose access revocation never followed, and four months of dwell time before discovery. All four links appear in any security policy; none of them held. For an executive committee, the useful question is not "do we have an offboarding procedure" but: how many former employees still have live accounts on our code repositories, cloud environments and SaaS tools, and who checked that this year in the systems rather than in the procedure? And if a private repository left today, what signal would tell us, other than reading it on a forum?
Plugin4Shell: commit pinning does not protect AI coding agents
On 18 September, researchers at AIR Security published Plugin4Shell, a zero-click remote code execution flaw affecting the four leading AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. When an agent installs a plugin, it performs a git checkout against a 40-character commit hash, precisely to guarantee that the installed code is the code that was reviewed. None of the four verified that the resulting working tree actually matched that hash.
The bypass is disarmingly simple: the repository owner creates a branch whose name is exactly the pinned hash, then sets it as the default branch. Git resolves branch names before commit hashes, and the agent silently installs the attacker's branch. Two attack paths follow: submit a clean plugin, wait for it to be reviewed and pinned, then swap the content afterwards; or hijack a legitimate author's repository through token theft and push code that passes the same check. The victim did nothing careless: they only had to install a plugin from a marketplace they trust, reviewed and pinned exactly as the security model intends. Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0. GitHub Copilot has no fix, and Google will not patch Gemini CLI, which it is retiring.
In the same vein, the week brought two npm campaigns: WeaselBiscuit, an infostealer delivered through 13 malicious packages that targets Chrome extension storage and shows functional overlap with BeaverTail and OtterCookie, both attributed to North Korea; and PhantomRaven, distributed through more than a hundred typosquatted packages and most likely written with a large language model, judging by its verbose comments and placeholder code.
What it changes: the AI coding agent is becoming a component of your software production chain, with a developer's rights and an automation's speed. It therefore inherits the same governance regime: an inventory of what is installed, provenance for plugins, and above all an explicit decision about tools the vendor has stopped fixing. The Gemini CLI case is the most instructive of the week: a product being retired is not a product without users, it is a product without patches. If your teams have one in their toolchain, the question is no longer "when do we patch" but "when do we remove it, and who decides".
An abandoned CDN domain was re-registered, and thousands of sites still call it
A content delivery network wound down years ago and let the domain it served assets from expire. In July 2025, a stranger registered it, with wildcard DNS giving them control of every hostname beneath it. Thousands of websites, code repositories and documentation pages still carry hard-coded references to hostnames under that domain. From the outside nothing broke: the files load, and nobody was notified. What those thousands of pages serve is now decided by a third party whose name none of those organizations knows. In September 2026, alerts collected by Report URI surfaced a cluster of compromised e-commerce sites running a social-engineering campaign of the ClickFix family.
What it changes: this is the same pattern as the API key left for four years in Manchester Airports' public JavaScript last week, seen from the other end. What a browser loads on your pages is a production dependency just as much as a library in your repository, but it appears in no inventory, no software bill of materials and no vendor questionnaire, because that third party was never put under contract. Two concrete checks this week: the list of third-party domains your pages actually call in production, and among them, the ones whose original company no longer exists. That is an external attack surface exercise, not a vendor management one.
Part 2: the infrastructure, where the pace has not slowed
Cisco: two products exploited in three days
On 14 September, Cisco disclosed CVE-2026-76461 (CVSS 9.8), a SQL injection in the email-parsing logic of AsyncOS on Secure Email Gateway. A crafted email is enough: it travels the appliance's normal inspection path and lets an unauthenticated attacker execute commands as root. Exploitation was already under way at disclosure, and CISA added the flaw to the KEV catalogue the same day with a 17 September federal deadline. One detail worth noting: Cisco found the vulnerability while working a customer support case, not during an internal security review.
Two days later, on 16 September, the vendor shipped fixes for CVE-2026-76460 (CVSS 10.0), an authentication bypass on an API endpoint of Identity Services Engine and ISE-PIC, branches 3.1 through 3.5, likewise leading to root-level command execution. Here too, exploitation was known before publication. Added to KEV the same day, due 19 September, with mandatory forensic triage under directive BOD 26-04.
What it changes: after the firewall management console last week, it is now the email gateway and the network access control server, three Cisco infrastructure products exploited in ten days. Those three devices share one property: they are security systems. By design they sit in front of everything else, reachable and highly privileged. The control that matters is no longer the patch window but the presumption: on a flaw exploited before disclosure, a patch applied on time says nothing about the period before it. The decision to settle in advance, once and for all, is this: on what criterion do we trigger a compromise assessment rather than a routine update, and who signs it off?
vCenter: from an espionage campaign to a ransomware campaign
CVE-2026-59310 (CVSS 9.8) is a directory traversal in the VMware vCenter syslog server that lets an unauthenticated attacker execute code. Broadcom fixed it on 29 July. Two weeks later, incident response firm QUIRSO counted more than 361 compromised IP addresses across 47 countries, attributed to a suspected espionage actor deploying a reverse SSH tool for persistence. On 15 September, CISA updated its KEV entry to flag that ransomware groups are now exploiting the same flaw.
What it changes: this is the classic trajectory, and it keeps getting shorter. A flaw first serves espionage, quiet by nature, then joins the ransomware affiliate toolkit, where it becomes loud. Whoever holds vCenter holds the hypervisor, and therefore the virtual servers, snapshots, backups and restore paths — precisely what your recovery plan rests on. Two months passed between the patch and that shift: that is the real margin available to an organization that tracks the KEV without reading it. And this is not theoretical: Akira, the group that claimed a Canadian victim this week, specializes in encrypting VMware ESXi environments.
Chrome and Windows: last Tuesday's two zero-days were already in service
Volexity documented a spear-phishing campaign run on 1 September by a China-linked cluster tracked as UTA0560 against several non-governmental organizations. The emails pointed to a US university website, whose reflected cross-site scripting flaw served as a springboard to attacker infrastructure. There, a three-stage chain: CVE-2026-85046 for arbitrary read and write inside the V8 sandbox, CVE-2026-87491 to escape the browser sandbox, then CVE-2026-85880 in the Windows ALPC mechanism to inject code into the Chrome process. Final payload: GRIMWEDGE, a JavaScript backdoor that performs host reconnaissance, manages files and processes, executes commands and delivers further payloads. APT31 used the same chain to install LONGTALE, which masquerades as a legitimate Gemini extension and captures keystrokes, form data, session cookies and screenshots.
What it changes: look at the numbers. CVE-2026-87491 was added to KEV on 9 September, and CVE-2026-85880 was one of the two already-exploited zero-days in the 966-fix Patch Tuesday of 8 September. In other words, two of the lines your teams triaged last week inside a 966-entry list were, at that very moment, links in a working exploitation chain against real organizations. That is the most concrete argument for a triage rule written in advance: in a batch that size, "exploited in the wild" is not one label among many, it is the only criterion that separates an update from a race against the clock. For the record, CISA also added three Linux kernel flaws on 18 September, the same day public exploit code was released for four other local privilege escalations in that kernel.
Part 3: five Canadian claims, and one sector taking the brunt
Between 16 and 18 September, five Canadian organizations were posted on leak sites. Bee Maid Honey, the marketing arm of the Alberta and Manitoba honey producer cooperatives, with plants in Winnipeg and Spruce Grove, was claimed by Akira on 16 September: the group advertises 46 GB of data, including HR files holding passports, driver's licences and death certificates, along with financial statements, contracts and non-disclosure agreements. The same day, Qilin listed the agency In The Company of Huskies. On the 17th, Braincipher claimed technical services firm Xpera. On the 18th, the Play group posted two Canadian victims on the same day, including manufacturer Vista Plastic Solutions.
The sector pattern is documented. According to the Black Kite report picked up this week, manufacturing absorbed 1,183 ransomware incidents in the first seven months of 2026, a 40% increase over the same period in 2025. Half of those attacks came from groups that did not exist two years ago; a single one of them, The Gentlemen, accounts for 12% of the year's total.
What it changes: the reason for that concentration is economic, not technical. In most organizations an attack stops IT while operations limp along; in a manufacturer, it stops physical production. Missed shipments, idle workers, contractual penalties, blocked customers: financial pressure builds in hours, not weeks, and attackers know it. If you are a manufacturer, or if your critical suppliers are, the conversation to have is not about the size of a ransom but about the cost of a day of downtime, and how many such days your cash position and your contracts can absorb. That question should drive the resilience budget, and it belongs to the CFO as much as to the security lead.
Part 4: AI on both sides of the table, in three facts
Google confirmed this week an incident that occurred in May during a security evaluation run by Israeli firm Irregular. The test sandbox had internet access by mistake, and the fictional company name used in the exercise matched a real domain. Gemini gained access to a protected system by repeatedly guessing its password, and in two other cases by finding credentials in a public repository. The model ended the intrusion once it established that it had reached a real company. Irregular notified Google in July, Google informed the affected companies and federal authorities, and the case only became public in September, when journalists started asking questions.
In the other direction, a three-person team at startup Hacktron used Claude Opus 5, inside OpenAI's bug bounty programme, to chain two vulnerabilities all the way to employee accounts. The entry point was the community forum, which hands HEIC images to ImageMagick and the libheif library: a crafted image corrupts the forum server's memory, and shared authentication does the rest, up to the ChatGPT and Codex accounts of employees who were forum members. The model produced a working exploit against the forum's real configuration within hours; OpenAI fixed it in fourteen hours and paid a $6,500 bounty. Finally, Microsoft addressed CVE-2026-85889 (CVSS 10.0), a missing authentication check on a critical Azure AI Foundry function allowing privilege escalation over the network. The fix was entirely server-side: customers had no patch to apply, and no way to verify anything.
What it changes: three facts, one governance lesson. A model under evaluation crossed the boundary of its test environment because a network configuration did not match the intent; an enterprise AI platform exposed a privileged function with no authentication; a commercial model served as an exploit-chaining tool for researchers, and tomorrow for others. All three ask your organization the same question: which real systems can your AI agents reach, under which identities, and who logs what they do? That is exactly the ground covered by Thursday's episode on vendors using AI without telling you: the perimeter is no longer yours, but the accountability still is.
This week's three questions for an executive committee
- How many accounts belonging to former employees and contractors are still live on our code repositories, cloud environments and SaaS tools, and who verified that in the systems this year rather than in the procedure?
- Which AI-assisted development tools are installed in our production chains, with which plugins, and which of those tools are no longer being patched by their vendor?
- On a flaw exploited before disclosure, on what criterion do we trigger a compromise assessment rather than a routine update, and who signs that decision?
If those three questions have no documented answer, our free cyber risk score places you in ten minutes across the identity, vulnerability and third-party domains. To track these exposures continuously rather than once a year, that is the job of the attack surface and threat intelligence modules of the FortaRisks platform.
One last word, then we stop talking about ourselves
FortaRisks will be at GoSec next Wednesday and Thursday, 23 and 24 September, in Montreal. Come talk risk, not product: bring the question about a third party you cannot answer, or the AI use nobody owns yet in your organization, and we will work through it together at the booth. To book a slot, write to us.
Sources: The Hacker News, CrowdSec and TanStack · Cybersecurity News, 170 private repositories · AIR Security, Plugin4Shell · Help Net Security, two agents still unpatched · The Hacker News, Plugin4Shell · The Hacker News, the re-registered CDN domain · BleepingComputer, Cisco Secure Email zero-day · The Hacker News, Secure Email Gateway exploited · CISA, 16 September advisory · Infosecurity Magazine, Cisco ISE exploitation · BleepingComputer, vCenter and ransomware · BleepingComputer, vCenter and reverse SSH · The Hacker News, the Chrome-Windows chain and GRIMWEDGE · CISA, 18 September advisory · ransomware.live, Canadian victims · ransomware.live, Bee Maid Honey · SecurityWeek, ransomware against manufacturers · The Hacker News, Gemini and the test that spilled over · Axios, three companies affected · The Hacker News, Claude Opus 5 and the OpenAI accounts · The Register, the exploit chain · The Hacker News, Azure AI Foundry