Loki Intelligence — Security Briefs · Published
Daily Security Brief: Exploited Edge, DevOps, and AI Risks
Today's risk picture is led by actively exploited vulnerabilities in network security management, source control, artifact repositories, and remote access tools. Teams should prioritize emergency patching, internet exposure review, credential rotation where compromise is possible, and stronger governance for enterprise AI use.
Signal 01 · The Hacker News
Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
Cisco reported that multiple threat clusters are exploiting recently patched Secure Firewall Management Center flaws, with activity tied to credential theft and Qilin ransomware deployment. The targeting of firewall management infrastructure raises the stakes because these systems often hold privileged access and network-wide visibility.
Why it matters: Treat FMC patching as urgent, restrict management-plane access, review administrator accounts, and rotate credentials if logs show suspicious access.
Source: The Hacker News
Signal 02 · CISA
CISA Adds Three Known Exploited Vulnerabilities to Catalog
CISA added exploited flaws affecting JFrog Artifactory and ConnectWise ScreenConnect to its KEV catalog. The affected products sit in software delivery and remote management workflows, making them high-impact targets for intrusion and persistence.
Why it matters: Inventory exposed Artifactory and ScreenConnect instances, apply vendor fixes on KEV timelines or faster, and audit recent access for unusual privilege use.
Source: CISA
Signal 03 · CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA also added a GitLab Community and Enterprise Edition path traversal vulnerability to the KEV catalog after evidence of exploitation. The listing confirms the issue has moved beyond theoretical risk and should be handled as an active threat.
Why it matters: Prioritize GitLab upgrades, reduce public exposure where possible, and monitor for abnormal repository access or unexpected file reads.
Source: CISA
Signal 04 · The Hacker News
GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
GitLab released fixes for several vulnerabilities, including a maximum-severity file-read issue that saw probing soon after disclosure. Rapid scanning after publication indicates attackers are moving quickly to identify unpatched servers.
Why it matters: Engineering teams should fast-track GitLab maintenance windows, validate successful patch deployment, and review logs for suspicious repository or commit-related access.
Source: The Hacker News
Signal 05 · BleepingComputer
GitLab urges users to patch max severity path traversal flaw
GitLab urged self-managed customers to immediately patch a maximum-severity path traversal flaw. The warning reinforces that source code platforms require the same urgency as internet-facing identity or remote access systems.
Why it matters: Do not wait for routine patch cycles; update GitLab, confirm version status across environments, and check whether sensitive project data may have been accessed.
Source: BleepingComputer
Signal 06 · The Hacker News
When the Whole Company Adopts AI: What It Does to Your SOC
Enterprise-wide AI adoption is creating a new class of SOC alerts tied to employee use of AI tools and agents, not just attacks against AI systems. Security teams are being asked to distinguish normal automation from risky data movement, shadow AI, and policy violations.
Why it matters: Product and security leaders should define approved AI use, log AI integrations, classify sensitive data flows, and tune detections around business context rather than blocking blindly.
Source: The Hacker News
Signal 07 · BleepingComputer
Hackers abused Claude to extract secrets from 1.8M Android apps
Anthropic said financially motivated and state-linked actors attempted to misuse Claude in campaigns that included extracting secrets from large numbers of Android apps. The report shows attackers are adapting AI services to accelerate reconnaissance and data discovery at scale.
Why it matters: Mobile and platform teams should strengthen secret scanning, remove embedded credentials from apps, rotate exposed keys, and monitor AI-enabled workflows for abuse signals.
Source: BleepingComputer
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.