Today’s theme is “blast radius by delegation.” Not delegation as a management virtue, delegation as an architectural mistake: vendors, clouds, agents, and identity roles doing too much with too little friction.

Today's Top 5

1. 8.6M karaoke records exposed: A single contractor workstation becomes the front door to millions of customer identities, and nobody can yet prove what left the building. Source
2. 495 orgs hit by cloud ransomware: When your IaaS provider is the victim, your backup strategy becomes your incident response plan, and a lot of teams discover they only had “hope,” not recovery. Source
3. One prompt, cloud creds leaked: Zenity demonstrates how an AI agent with “helpful” web access can be coerced into pulling secrets from instance metadata, then pivoting across an entire region’s agent fleet. Source
4. Citrix SAML config, 9.5 risk: A memory overflow bug turns specific NetScaler SAML setups into a potential RCE or DoS problem, and the preconditions are the kind teams forget they enabled years ago. Source
5. Bing redirects power ad malware: Attackers are using legit bing.com click tracking inside Google Ads to bounce victims through a compromised site to a fake Claude installer, with cloaking that punishes “open in new tab.” Source

Why today matters: We are watching “control surfaces” multiply: cloud consoles, contractor environments, SAML endpoints, and AI agent tools. Attackers are not breaking stronger doors, they are finding the doors you forgot you owned. If your security model assumes clean boundaries between “us” and “them,” today’s stories are your reminder that the boundary is now a graph.

Alright, let’s sort the damage from the lessons.

Data Breaches

1. Nippon Columbia malware incident exposes 8.6 million karaoke fan records: Daiichi Kosho disclosed malware on a contractor (Nippon Columbia Group) endpoint that may have exposed data for 8,631,000 customers and 93,000 employees. Daiichi Kosho says it has not confirmed theft, but is warning customers to watch for phishing and scams. Source: BleepingComputer
2. Nissui Logistics system outage after suspected third-party data center access: Nissui says a system failure at its logistics subsidiary disrupted shipping and receiving, and the suspected cause is unauthorized access to an outsourced data center. The company says it is still checking whether any personal or customer data left its control. Source: Nissui (news release)
3. IDCF Cloud ransomware outage impacts 495 companies and local governments: IDC Frontier says a ransomware attack forced shutdown of systems serving East Japan Region 1, impacting 495 organizations and disabling management console access while it verifies security across regions. Customers saw attacker claims of snapshot wiping and large-scale encryption, raising immediate questions about true recoverability. Source: BleepingComputer
4. Another ShinyHunters-linked arrest after FBIJobs breach: The FBI says it arrested another suspected co-conspirator tied to the FBIJobs platform breach, which the bureau attributes to a contractor-managed platform missing a security update. BleepingComputer reports leaked samples included home addresses, SSNs, and family-member data, the kind that turns into real-world harassment fast. Source: BleepingComputer

Security Research

1. AgentCorruption: SSRF-style credential exposure in Amazon Bedrock AgentCore: Zenity’s writeup shows how an agent that can fetch URLs can be induced to query the EC2 instance metadata service (IMDS) and disclose cloud credentials, then expand impact through overly broad permissions. The uncomfortable part is that it looks like “normal tool use” in logs until you ask what URLs the agent should never reach. Source: Zenity Labs
2. SonicWall SMA1000 CVE-2026-102255 exploitation attempts reported: BleepingComputer reports exploitation attempts for a maximum-severity SSRF in SMA1000 WorkPlace, with honeypot traffic suggesting attackers are already poking at internal services like CouchDB. Even if “attempts” are noisy, the exposure count and patch velocity are the real story. Source: BleepingComputer
3. Unpatched AhsayCBS bugs exploited to drop webshells and miners: Huntress observed attackers chaining an auth bypass and command injection to deploy JSP webshells and XMRig, plus a PowerShell script designed to pause mining when Task Manager opens. The kicker is that researchers say the “fixed” latest version was still affected, which is a bad day for anyone relying on version numbers as proof. Source: BleepingComputer
4. Atlassian Data Center arbitrary file access advisory (CVE-2026-21589): Atlassian warns that all affected Data Center products allow unauthenticated access to specific files in the web app root if the attacker already knows the path and name. That caveat is not comforting when attackers love config files and logs. Source: Atlassian
5. Malvertising chain uses Bing redirects to deliver ClickFix payloads: Push Security’s findings (via BleepingComputer) show a practical evasion trick: make the ad destination look like bing.com, then rely on redirect logic and cloaking to keep scanners blind. This is the new normal for “brand impersonation installers.” Source: BleepingComputer

Top CVEs

1. CVE-2026-107406: Memory overflow in Citrix NetScaler ADC and NetScaler Gateway that can lead to Remote Code Execution or Denial of Service when configured as SAML SP or SAML IdP (with version-specific preconditions). If you run SAML on NetScaler, treat “do we actually need this mode enabled?” as a security question, not an IAM question. Source
2. CVE-2026-102255: Pre-auth SSRF in SonicWall SMA1000 WorkPlace interface (CVSS 10.0) that can be abused to reach internal functionality and perform unauthorized operations. SonicWall’s notice says no evidence of exploitation, but independent telemetry and defensive advisories say attackers are already trying. Source
3. CVE-2026-105133: Authentication bypass in AhsayCBS used in active attacks with a public exploit, often as the first half of a chain. MSP-adjacent tooling is still the attacker’s favorite place to shop for leverage. Source
4. CVE-2026-105134: OS command injection in AhsayCBS that attackers chained after the bypass to execute code, drop webshells, and run crypto miners. If your backup platform has a management UI exposed beyond trusted IPs, you are playing on hard mode. Source
5. CVE-2026-21589: Atlassian Data Center arbitrary file access affecting multiple products, enabling unauthenticated access to specific files in the application root directory (no directory listing). The practical risk is secrets that were never meant to be web-readable. Source

Podcasts & Talks

1. SANS Stormcast (Mon, Oct 12, 2026): AgentCorruption SSRF in Amazon Bedrock Agents, plus CVE-2026-0257 ransomware exploitation: A tight briefing that connects two things defenders keep trying to separate: “AI security” and “classic cloud credential theft.” If your agents can make outbound calls, you own an SSRF problem again, just with nicer wording. Listen: SANS ISC
2. SANS Stormcast (Thu, Oct 8, 2026): Atlassian CVE-2026-21589 scanning and practical detection angles: Useful for teams trying to answer the only question that matters during a vuln stampede: “Are we being scanned right now, and from where?” Listen: SANS ISC

Final Words

Here is the pattern most coverage misses: the attacker’s best path is increasingly “legitimate functionality at the wrong trust level.” A contractor endpoint that can see millions of records. A cloud console you cannot reach during an incident. An AI agent that is allowed to fetch URLs like a helpful intern. A SAML config that nobody remembers enabling, still sitting in the auth path like a loaded mousetrap.

This week, do three things:

• Patch and verify exposure for CVE-2026-107406 on NetScaler, and explicitly audit whether SAML SP or IdP is enabled anywhere you forgot to document.
• Inventory and lock down remote access appliances, then prioritize SMA1000 upgrades for CVE-2026-102255, including confirming WorkPlace exposure and removing internet-facing management paths.
• For AI agents and automation runners, block access to IMDS at the network layer, require IMDSv2, and restrict agent tool URLs so “fetch this link” cannot ever reach metadata or internal admin panels.

Your turn: If a contractor laptop can touch 8.6 million records in your ecosystem today, do you know which contractor it is, and can you prove it from logs? Hit reply with your one-sentence answer, or drop a comment on the web version. I read every reply.

Know someone whose “backups” still live inside the same cloud control plane they are trying to recover from? Forward them the IDCF Cloud story, it costs 30 seconds and the alternative costs a weekend. If you’re reading this second-hand, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!