Quantum-Ready Auth, Critical Patches, and AI Agent Risks

Major cloud providers introduced AI and security updates while critical fixes landed for network and VPN infrastructure. At the same time, targeted campaigns and a software supply chain compromise highlighted active threats across regions and sectors. New research also detailed the growing risks of autonomous agents and practical controls for detection and governance.

Quantum-Ready Auth and Platform Updates

Microsoft urged organizations to expand post-quantum planning beyond data confidentiality to include authentication and certificate ecosystems. The company launched a PQC TLS Pilot Program for approved certificate authorities to evaluate ML-DSA roots and issuance in controlled, non-production environments; pilot certs are not publicly trusted. On supported Windows 11 systems with specific July 28, 2026 updates, ML-DSA pilot certificates can be evaluated, subject to platform and Schannel requirements. Microsoft recommends inventorying certificate-dependent systems, mapping trust relationships, assessing vendor roadmaps, and building multi-year, non-production testing strategies to surface size limits, application incompatibilities, and lifecycle gaps before large-scale transitions.

AWS Bedrock added Ultrafast mode support for OpenAI’s GPT-6.1 Sol to enable significantly lower latency for production use cases such as real-time coding assistants and interactive agents. Governance and auditing mechanisms remain in place for access control and compliance, with availability via the console and supported APIs. In parallel, AWS Cost visibility improved with new Amazon Bedrock product attributes in Cost Explorer, Budgets, and Dashboards. Teams can group and filter spend by model, provider, inference type, and feature—combining these with cost allocation and IAM principal tags—to monitor usage and trigger targeted budget alerts at no additional charge.

Network Firewall now supports wildcard matching for container attribute-based inspection across Amazon EKS and ECS workloads, reducing policy sprawl by covering multiple application variants with a single rule. The change aims to streamline security operations in dynamic microservices environments and is subject to regional availability. Separately, Google Cloud unveiled the Gemini enterprise agent embedded across Workspace apps, offering unified agent capabilities, multi-agent orchestration, model-choice flexibility, and enterprise integrations through tools and skills registries. The launch emphasizes identity, policy and permission controls, sandboxing, network gateways, and spend management for enterprise deployments.

Critical Network and VPN Patches

Cisco NX-OS advisories address five critical validation-related vulnerabilities affecting Nexus 3000/9000 Series switches in standalone mode across NX-API, NGOAM, and MPLS OAM features. Exploitation could enable arbitrary code execution with root privileges or force process crashes and device reloads. Several features are disabled by default, and Nexus 7000 and Nexus 9000 in ACI mode are not affected. Cisco advises upgrading to fixed releases identified via its Software Checker, disabling unused features (NGOAM, NX-API, MPLS OAM), and applying temporary Live Protect shields where immediate upgrades and reboots are not possible; no public exploitation was reported at the time of publication.

SonicWall SMA customers should address CVE-2026-102255, a CVSS 10.0 pre-auth SSRF in the SMA 1000 series Workplace interface. Related flaws (CVE-2026-102256/102257/102258) range up to high severity, with some enabling remote or arbitrary command execution. Fixed releases (12.4.3-03670 and 12.5.0-03082 or later) are available, and there are no workarounds apart from patching. Analysts recommend removing the Workplace interface and management console from the public internet, verifying build versions, and treating remediation as the start of a wider investigation where exposure occurred.

FBI/USSS warned that the FortiBleed campaign continues to compromise Fortinet FortiGate firewalls and SSL VPN gateways at scale, citing tens of thousands of affected devices across nearly 200 countries and links to ransomware affiliates. Attackers use credential stuffing and password spraying, GPU-accelerated cracking, and automated tooling to obtain and validate credentials, then create new administrative accounts and move laterally. The alert provides incident response and hardening guidance, including isolating compromised hosts, terminating sessions, resetting credentials, enabling phishing-resistant MFA, and ensuring secure credential storage.

Campaigns, Breaches, and Supply Chain

Talos Report documented a mid-2026 spear-phishing campaign against Taiwan-based research organizations that combined institutional impersonation with real event details and deceptive registration links. The infrastructure hosted pixel-perfect Google sign-in replicas in multiple languages and an advanced adversary-in-the-middle implementation using HTTP POST for data exfiltration and a persistent WebSocket channel for low-latency operator control, facilitating MFA challenge handling and credential theft. Talos observed indicators of AI-assisted lure generation but did not claim definitive LLM authorship.

UAC-0099 activity against Ukrainian government personnel included a .NET infostealer/RAT dubbed ASHVEIN with credential theft, screenshots, file exfiltration, and encrypted C2. The malware hides tasking in invisible HTML elements and can fall back to GitHub-based dead-drop resolvers. Delivery vectors include DLL sideloading, VHD containers, and droppers, with decoys impersonating Ukrainian authorities; reporting also notes a technique intended to disrupt AI-assisted analysis by embedding prompts that target LLM safety filters.

IDCF Cloud operator IDC Frontier disclosed a ransomware incident that caused an outage in East Japan Region 1 and led to the proactive disabling of management console access across regions. The company is investigating the intrusion vector and scope; the attacker circulated screenshots claiming encryption of hundreds of databases and hypervisors and sealing of thousands of VM disks. IDC Frontier said 495 corporate and local government clients were affected and is continuing remediation and recovery while assessing customer impact.

Tensorlake npm was compromised via a malicious 0.5.144 release that executed an obfuscated loader and a Shai-Hulud credential-stealing worm. The payload harvested secrets from local files, CI systems, Kubernetes, Vault, and cloud providers; dropped HackBrowserData; established persistence; and supported attacker-supplied code execution. For propagation, it enumerated packages tied to the victim’s publishing identity, forged Sigstore provenance, and republished tainted versions, with exfiltration routed via an Ethereum contract and a GitHub fallback. Affected users are advised to uninstall, rotate potentially exposed credentials and tokens, and inspect repositories for planted artifacts.

AI Agents: Security Controls and Detection

AWS AgentCore research by Unit 42 and Zenity Labs highlighted recurring security issues in late 2025–2026, including default-enabled root-level shell tools and metadata service configurations without session token enforcement. Demonstrations showed agents returning full temporary credentials, accessing source code, invoking other agents with overly permissive roles, and persisting to harvest additional secrets. AWS implemented configuration updates and IMDSv2 enforcement; researchers characterized fixes as incremental and recommended least-privilege roles, treating shell/HTTP tools as high-risk, restricting egress, removing secrets from images, and baselining agent identities and tool usage.

VirusTotal analyzed 35,878 AI agent skills and found 52.9% with security or abuse risks and 18.5% (6,637) malicious, with 62% of malicious samples relying on plain-language instructions rather than binaries. The report introduces the CARO-A naming convention to encode type, targeted ecosystem, campaign family, and malicious component locus, with stealers and loaders dominating. Benchmarking showed uneven detection, with prompt-only attacks commonly missed by open-source and vendor scanners; VirusTotal now offers a low-latency agentic analysis endpoint with verdicts, probabilities, and CARO-A labels.

Check Point reported a 48% year-over-year jump in average weekly attacks per organization in September 2026, with education the most targeted sector and Latin America the highest-volume region. Phishing reached 1 in 91 emails, ransomware incidents rose 53% year over year, and enterprise GenAI usage showed 1 in 39 prompts classified as high risk for sensitive data exposure across most organizations. The report calls for prevention-focused controls with coverage across networks, cloud, endpoints, email, and AI services.

Threat Source emphasized pragmatic risk management—such as segmenting unpatchable legacy systems—while documenting CAIRN research on adversaries embedding plain-language instructions to mislead AI-assisted analysis (A3: AI-Analysis Evasion). Talos recommends treating extracted text as evidence rather than directives and flagging imperative language aimed at analysis systems. The newsletter also summarizes recent vulnerabilities, breaches, and defensive guidance centered on continuity, segmentation, and hardening AI analysis pipelines.