Loki Intelligence — Security Briefs · Published
Daily Security Brief: Email Gateway Exploits, Fast Pivots, and Token Protection
Exploited email security appliances and rapid credential pivots from compromised notebooks show how quickly a single foothold can become broad access. Teams should patch Cisco Secure Email Gateway now, remove long-lived secrets from exposed workloads, and tighten token validation and least-privilege access for people, pipelines, and agents.
Signal 01 · CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA's KEV catalog now lists the Cisco Secure Email Gateway SQL injection flaw, CVE-2026-76461, as actively exploited. CISA urges all organizations, not only federal agencies, to adopt risk-based vulnerability management and prioritize remediation of catalog entries like this one.
Why it matters: Treat this as an emergency change for any internet-facing email gateway and confirm fixed AsyncOS versions are actually running on every cluster member.
Source: CISA
Signal 02 · The Hacker News
Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds
Sysdig observed a human operator exploit a pre-auth Marimo notebook RCE (CVE-2026-39987), pull an AWS key from the compromised instance, fetch an SSH private key from Secrets Manager, and log in to a bastion host within eight seconds using hand-written tooling. Hunt.io separately reported 3,562 unauthenticated Redis servers hijacked for cryptomining.
Why it matters: Keep notebook servers off the internet, patch Marimo, tightly scope cloud credentials on workloads, require authentication on Redis, and alert on unusual Secrets Manager reads.
Source: The Hacker News
Signal 03 · The Hacker News
Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution
Cisco confirmed in-the-wild exploitation of CVE-2026-76461 (CVSS 9.8) in AsyncOS for Secure Email Gateway, where a crafted email carrying SQL statements can lead to root command execution regardless of configuration. Fixed releases are available with no workarounds, and Cisco warns attackers may hide evidence on compromised devices.
Why it matters: Upgrade immediately, run Cisco's log checks on every cluster node, and correlate with external firewall and network logs, since on-box evidence may be tampered with.
Source: The Hacker News
Signal 04 · Cloudflare Security
Have it both ways: stay discoverable in search while disallowing AI training
Cloudflare added a Disallow AI Training setting that publishes a no-training preference in robots.txt while keeping designated Accountable mixed-use crawlers from Apple, Google, and Microsoft allowed for search. From September 15, Block settings also apply to those mixed-use crawlers, so blocking them now affects search visibility.
Why it matters: Review bot and AI crawler settings after the migration to avoid unintentionally dropping out of search results or permitting unwanted training on your content.
Source: Cloudflare Security
Signal 05 · Cloudflare Security
Give every teammate and agent the right level of access to your Workers
Cloudflare introduced per-Worker access control with four roles: Metadata Read-Only, Content Read-Only, Editor, and Admin. Roles can be assigned to users or scoped API tokens, so a teammate, CI pipeline, or AI agent can debug, review, or deploy one Worker without touching other account resources.
Why it matters: Replace broad account-level tokens for CI and agents with resource-scoped ones to limit the blast radius if a token leaks or an automation misbehaves.
Source: Cloudflare Security
Signal 06 · CISA
Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers
NIST and CISA published final interagency guidance for federal agencies and cloud service providers on protecting identity assertions, access tokens, and their signing mechanisms against forgery, theft, and misuse. The update incorporates feedback on token validation, secrets management, and detection at scale, with emphasis on Secure by Design.
Why it matters: Use the report to review signing-key storage, token lifetimes, and validation logic across SSO, federation, and API access, and to build detection for forged or replayed tokens.
Source: CISA
Signal 07 · The Hacker News
AI Changed the Exposure Problem. Validation Needs to Change With It.
A Picus Security contributed article notes that only a small share of 2026's fast-growing CVE volume was exploited in the wild and argues severity scores alone cannot set priorities. It positions exploitability validation, control validation, and agentic pentesting as complementary inputs to remediation decisions.
Why it matters: Feed reachability, control-effectiveness, and business-criticality evidence into patch prioritization so limited remediation capacity goes to exposures that are actually exploitable.
Source: The Hacker News
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.