Ransomware crews are getting bolder about “collateral damage,” and defenders are getting more honest about the messy middle: the part where you cannot prove you were safe, only that you rebuilt fast enough.

Today's Top 5

1. 26,739 servers, unplug now: Japan’s GMO-linked desktop hosting service told customers to disconnect PCs after attackers planted malware in customer environments and threatened ransomware on user devices. The scary part is what they tried next. Source
2. Bankruptcy notices system intruded: The U.S. Bankruptcy Noticing Center contractor said it restored the platform after an intrusion, and insists no data was extracted. The gap between “no PII” and “no impact” is where audits get expensive. Source
3. GitLab exploit attempt, rebuild anyway: After active exploitation landed in CISA’s KEV, Alpine Linux said an attacker nearly landed a GitLab RCE, so they treated it as compromised and rebuilt from scratch. That rebuild decision is the real lesson. Source
4. MCP server “auth enabled” lie: A GitHub-reviewed advisory for pdf-reader-mcp says HTTP mode logged that API key auth was on, but never checked the key. If you are piloting MCP internally, read that twice. Source
5. PHP2Shell gets a weird sequel: PHP disclosed CVE-2026-115560, an RCE that only hits under a specific runtime serialize-handler switch plus upload-progress conditions. Edge-case bugs are still ops problems once exploit kits learn the edge. Source

Why today matters: Two fronts are merging: extortion crews are threatening to hop from “your data” to “your users’ machines,” while modern dev and AI-adjacent stacks keep shipping security theater, like logs that claim auth is enabled. CISOs should be nervous about anything that sits between customers and production, remote desktop hosting, CI/CD, and “helper” AI servers that were never threat-modeled.

XERJ Corpus Hub: Working the pdf-reader-mcp auth bypass story? An AI agent loading checkov could scan your MCP server IaC for missing authn at the ingress, flag risky “bind 0.0.0.0” patterns, and draft the exact policy checks to block unauthenticated HTTP mode. Browse more at hub.xerj.org.

Ok, let’s get tactical.

Data Breaches

1. GMO Onamae Desktop Cloud breach and ransomware threat (Japan): GMO’s hosted Windows desktop service confirmed unauthorized access and malware in some customer server environments, then warned customers to scan devices, back up, and disconnect from networks. Reports say data later leaked after GMO refused to pay. Source: TechRadar
2. U.S. Bankruptcy Noticing Center (BNC) intrusion, contractor says no PII: BAE Systems said the BNC platform was hit by a cyber intrusion but stated no data was extracted and no PII was breached, and that the system was restored with the Administrative Office of the U.S. Courts. Source: The Record
3. Qilin ransomware claim against Richland Resources Corporation: Threat monitors reported Qilin listed Richland Resources Corporation on its leak site, consistent with double extortion patterns. Treat it as an extortion claim until the victim confirms. Source: Undercode News

Security Research

1. GitLab RCE active exploitation lands in KEV, Alpine Linux rebuilds: Reporting on CISA KEV additions highlights active exploitation pressure and Alpine’s decision to rebuild GitLab infrastructure after near-successful exploit attempts. That “rebuild even without proof” posture is becoming the new bar. Source: The Hacker News
2. MCP TypeScript SDK memory exhaustion (CVE-2026-111768) and hardening gaps: Coverage notes that a single request can exhaust memory during validation and warns that upgrading alone may not fully fix operational exposure for Node-based remote MCP servers. Source: ctxsec
3. pdf-reader-mcp API-key auth not enforced (CVE-2026-62264): A GitHub-reviewed advisory says the MCP server logged that API-key auth was enabled but failed to enforce it, a classic “security control exists only in the log line” failure mode. Source: ctxsec
4. Kubeflow Pipelines fixes unauthorized log reads and decompression bomb (CVE-2026-118759, CVE-2026-118761): Two high-severity issues hit the KFP API server, one around pod-log access patterns and another around decompressing uploads before authorization. If your ML platform touches tokens, assume logs are sensitive. Source: ctxsec
5. OneNote triage upgrade: bulk embedded extraction via JSON output: SANS ISC details how onedump.py’s : jsonoutput can extract embedded files across many .one lures at once, then write payloads to disk named by SHA-256 for faster dedupe and hunting. Source: SANS ISC

Top CVEs

1. CVE-2026-115560: A PHP remote code execution bug tied to session upload progress and a specific runtime change of session.serialize_handler. It is configuration-dependent, but that is cold comfort for large fleets with drift. Source
2. CVE-2026-111768: Model Context Protocol TypeScript SDK issue where one HTTP request can exhaust server memory during validation, impacting Node-based MCP deployments. Treat as availability risk and a forcing function to put real ingress controls in front. Source
3. CVE-2026-62264: pdf-reader-mcp in HTTP mode logged API-key auth as enabled but failed to validate the key, allowing unauthenticated access paths depending on deployment. Verify with negative tests, not startup logs. Source
4. CVE-2026-118759: Kubeflow Pipelines API server could expose pod logs without properly authorizing the caller against the run, depending on environment and permissions. Logs are often secret sponges, treat them that way. Source
5. CVE-2026-118761: Kubeflow Pipelines API server decompressed multipart uploads before namespace authorization, enabling a decompression bomb style memory exhaustion for callers who can reach the endpoint. Rate limits and auth at ingress matter here. Source

Podcasts & Talks

1. Security Now #1102: A Strategic Plug Pull: This episode is heavy on the PHP2Shell aftermath and what “patch now” looks like when the vulnerable surface is measured in millions of servers. Useful for framing an exec update that does not promise certainty you cannot deliver. Listen: TWiT

Final Words

Today’s underlying pattern is trust-by-assumption. Attackers are assuming they can push fear outward to your customers’ devices, and vendors are assuming “we printed a line that says auth is enabled” counts as security. The uncomfortable implication: incident response is becoming a product feature, and rebuild-from-scratch is becoming the default, not the exception.

This week, do three things:

• Run a tabletop for “ransomware threat to customers,” using your remote desktop, VDI, or managed endpoint offerings as the scenario, and pre-draft the unplug and isolation guidance so Legal is not writing it live.
• If you run GitLab, validate whether you are exposed to the actively exploited GitLab KEV item in your environment and rehearse a rebuild plan, not just a patch plan, including runner and token rotation.
• If you are experimenting with MCP servers, block unauthenticated HTTP exposure at the ingress, then test with a request missing the API key and confirm you get a 401, do not trust startup logs.

Your turn: If a vendor you rely on told customers to “disconnect power and network by noon,” could your org issue equally blunt guidance within one hour, or would it get stuck in approval purgatory? Hit reply with your take, or drop a comment on the web version. I read every reply.

Know someone running internal MCP servers “just for a pilot” without a real auth boundary? Forward them this issue, it takes 30 seconds and it might save them from shipping an unauthenticated data faucet. For everyone else, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!