Welcome to today's edition of Secret CISO, where healthcare, federal law enforcement, and the tools developers trust most all had very bad weeks. We start with McKesson, the pharmaceutical distribution giant, which confirmed that the ShinyHunters extortion crew talked its way past two employees' Okta logins and walked out with roughly a terabyte of data touching 284 million patient records, then demanded a very specific $55,236,150 not to leak it.

From there we head to Washington, where the ATF is dealing with a self-inflicted wound of a different kind: the Qilin ransomware gang dumped 6.3GB of case files, forensic phone extractions, and investigative records from a standalone CALEA wiretap-compliance system after a ransom countdown expired, a breach serious enough that Justice Department officials have already labeled it a 'major incident.'

Job-review site Glassdoor and Houston-based Nutex Health round out our breach roundup, both now facing extortion demands from ransomware crews racing to cash in before their leak-site countdowns hit zero.

On the research side, a newly disclosed vulnerability class called GitSpawn shows how a booby-trapped Git repository can silently execute code the instant it's opened in Claude Code, Cursor, Codex, or Grok, no prompts typed and no approvals clicked. We also cover a WhatsApp video-call trick that lets anyone holding your locked Android phone browse your entire photo gallery, and a Unit 42 report on the first confirmed autonomous AI cyberattack campaign, in which a Chinese-speaking actor pointed DeepSeek at 460 targets and let it hack largely on its own.

Google entered the fray too, launching a specialized 'Gemini 3.8 Flash Cyber' model built to hunt vulnerabilities and write its own patches, a sign of how fast offense and defense are both going autonomous.

Our CVE section is dominated by CISA's latest Known Exploited Vulnerabilities additions: a maximum-severity SonicWall SMA 1000 SSRF chained with remote code execution, a perfect-10 command injection in the Kestra workflow platform, an authentication bypass in LiteLLM's MCP endpoint, a SQL injection in Sangoma Switchvox, and a Windows kernel driver zero-day that North Korea's Lazarus Group used against defense contractors for at least five weeks before Microsoft patched it.

Grab your coffee, patch what you can today, and let's get into it.

Data Breaches

1. McKesson Confirms Breach of 284 Million Patient Records: The pharmaceutical and healthcare distribution giant disclosed in an SEC filing that the ShinyHunters extortion group used voice-phishing against employees to compromise Okta single sign-on credentials, then pivoted into McKesson's Salesforce and Snowflake environments to exfiltrate roughly a terabyte of data between August 21 and 25, including Social Security numbers, medical record numbers, diagnoses, and medication history. The attackers are demanding $55,236,150 and have set a countdown for McKesson to respond. Source: BleepingComputer
2. Qilin Ransomware Leaks ATF Investigation Files: The Russia-based Qilin ransomware-as-a-service operation published roughly 6.3GB of data allegedly stolen from a standalone ATF system tied to the Communications Assistance for Law Enforcement Act, including investigative case directories and Cellebrite phone-extraction records. The system was isolated from ATF's case management and eForms systems and was shut down once the breach was discovered, but Justice Department officials have already classified the incident as a major security event requiring congressional notification. Source: Cybernews
3. Glassdoor Hit With Ransomware Extortion Claim: The Gentlemen ransomware gang added Glassdoor to its dark-web leak site, claiming it stole company data and starting a 172-hour countdown to publication. No sample data has been posted publicly yet, so the scope of any compromised jobseeker or employer information remains unconfirmed. Source: Cybernews
4. Nutex Health Says Patient Data Stolen After Ransomware Attack: The Houston-based physician and hospital network confirmed hackers stole patient data and is now facing a public leak threat from the Gentlemen ransomware gang, which listed the healthcare firm on its extortion portal. The full extent of the compromised medical and personal information has not yet been disclosed. Source: Infosecurity Magazine

Security Research

1. GitSpawn Lets Malicious Repositories Silently Hijack AI Coding Agents: Researchers at Manifold Security disclosed a vulnerability class where a booby-trapped Git repository abuses the core.fsmonitor setting to run attacker-controlled commands the moment an AI coding tool like Claude Code, Cursor, OpenAI Codex, or Grok Build inspects the repo in the background, with no user interaction required. A successful attack can hand over SSH keys, cloud credentials, API tokens, and access to any other repositories connected to the developer's account, and delivery doesn't require a normal git clone since the payload rides in the .git directory of shared folders, ZIP archives, or synced drives. Source: Cybersecurity News
2. WhatsApp Video-Call Trick Bypasses Android Lock Screens to Expose Photos: Researcher Jose Rodriguez found that answering an incoming WhatsApp video call on a locked Android phone, then tapping into the call's Meta AI photo-editing feature, opens the device's full photo gallery without ever entering a PIN or biometric. The flaw doesn't affect every device, tests found Pixel and Oppo handsets vulnerable while a Samsung Galaxy S25 Ultra blocked it, and no patch has shipped yet, so Meta and Google are urging users to set WhatsApp's photo permission to limited in the meantime. Source: Cybersecurity News
3. Unit 42 Documents First Confirmed Autonomous AI Cyberattack Campaign: Palo Alto Networks researchers uncovered a Chinese-speaking actor using the DeepSeek model, run through the open-source Hermes Agent framework, as an autonomous offensive operator against roughly 460 targets, with the AI independently handling reconnaissance and exploitation of vulnerabilities including flaws in Citrix NetScaler and Marimo notebooks. The operation was only discovered after the AI agent accidentally exposed its own environment, including exploit scripts, target lists, and attack logs, on a self-created web server. Source: Unit 42
4. Google Launches Gemini 3.8 Flash Cyber to Autonomously Find and Patch Vulnerabilities: Google introduced a specialized cybersecurity variant of its Gemini 3.8 Flash model that can independently discover software flaws and generate working fixes, scoring 86.2% on the CyberGym benchmark and producing patches Chrome's security team rated 2.6 times more accurate than competing commercial models. The model is being made available through Google's limited-access Fairwind program for governments and trusted partners, and Google's own vulnerability research team reportedly used it to find a critical flaw in under two hours. Source: VentureBeat
5. Attackers Plant Remote Access Tools on Compromised PaperCut Servers: Following PaperCut's emergency patches for a chained authentication-bypass and unsafe class-loading exploit in its NG/MF print management software, researchers report that threat actors who compromised servers before the fix shipped are now installing remote access tools to maintain persistence. Organizations that patched are urged to also hunt for post-exploitation footholds rather than assuming the update alone closed the door. Source: Help Net Security

Top CVEs

1. CVE-2026-83548 & CVE-2026-83549: A maximum-severity (CVSS 10.0) pre-authentication server-side request forgery flaw in SonicWall SMA 1000 series appliances that attackers are chaining with a post-authentication OS command injection bug to achieve unauthenticated remote code execution on internet-facing VPN gateways. SonicWall and CISA say the pair is being actively exploited against exposed appliances, with a mandated federal remediation deadline of September 5. Source.
2. CVE-2026-49869: A critical (CVSS 10.0) OS command injection vulnerability in the open-source Kestra workflow orchestration platform that lets an unauthenticated remote attacker create and execute arbitrary workflows without credentials. CISA added it to the Known Exploited Vulnerabilities catalog after observing it used to deploy reverse shells and cryptocurrency miners on compromised servers. Source.
3. CVE-2026-59822: An improper authentication flaw (CVSS 8.8) in Berri LiteLLM's Model Context Protocol Streamable HTTP endpoint that lets an unauthenticated attacker establish a fully authenticated MCP session using an arbitrary Bearer token. The bug is now under active exploitation and carries a CISA remediation deadline of September 16 given LiteLLM's widespread use as an AI gateway. Source.
4. CVE-2026-9586: A SQL injection vulnerability in Sangoma Switchvox VoIP phone systems that unknown threat actors are weaponizing to mint administrative tokens and gain unauthorized control of affected deployments. It joins the KEV catalog with a September 5 remediation deadline for federal agencies running the platform. Source.
5. CVE-2026-68820: A use-after-free vulnerability (CVSS 7.0) in afd.sys, the Windows Ancillary Function Driver for WinSock, that Check Point Research says North Korea's Lazarus Group exploited for privilege escalation in an Operation Dream Job-style fake recruiter campaign against defense and aerospace employees. A compiled rootkit artifact shows Lazarus had been running the exploit for at least five weeks before Microsoft shipped a fix in its August Patch Tuesday. Source.

Final Words

If there's a throughline to today's edition, it's that trust is the thing attackers are actually after, whether that's the trust an employee places in a caller claiming to be IT, the trust a federal agency places in an isolated system's isolation, or the trust a developer places in a folder of code before opening it in their AI assistant. McKesson and the ATF didn't fail because of exotic zero-days; they failed because a voice on the phone and a ransom countdown were enough.

Meanwhile the GitSpawn research and Unit 42's DeepSeek findings are a preview of where this goes next: both attackers and defenders are handing more of the keyboard to autonomous AI, and the gap between what these systems can quietly do and what a human notices is only getting wider. Google's own answer, an AI model built to patch vulnerabilities before someone like Lazarus finds them, shows the defensive side is racing to keep up.

Patch your Kestra, LiteLLM, SonicWall, and Switchvox deployments before Friday's CISA deadline, and if you're a McKesson, Glassdoor, or Nutex Health customer, watch for breach notifications in the coming weeks.

As always, if you found this useful, please share Secret CISO with a colleague who needs their daily dose of threat intelligence. Stay vigilant, stay informed, and see you in the next edition of Secret CISO!