Welcome to today's edition of Secret CISO, where the courts, the skies, and the frontier of AI capability all had a rough few days. We start with a third-party software breach that reached deep into the U.S. judicial system, exposing Social Security numbers and even sealed court records across eleven states. From there we head to the skies over Manchester, where an extortion crew followed through on its threat after an airport operator refused to pay, dumping hundreds of gigabytes of customer data onto the open web.

Dropbox also makes an appearance, not because of its own code but because of a partner's broken identity check — a reminder that your security perimeter now includes every login button you outsource to someone else. On the research side, the story of the week is arguably OpenAI's Astra model, which became the first AI system to formally cross a 'critical' cybersecurity capability threshold after independently discovering zero-day vulnerabilities during testing.

Researchers also had a busy stretch chipping away at supposedly phishing-resistant defenses: a new family of 'Pass-ta-key' attacks shows how synced passkeys on Windows can be recovered or replayed under the right conditions, while a separate team demonstrated a faster remote Spectre side-channel against Cloudflare Workers capable of leaking a JWT one bit at a time.

Money moved too — AI security startup HiddenLayer closed a $100 million round as enterprises scramble to secure the agents and copilots they've been deploying, and a sobering piece on infostealer logs argues that a leaked corporate password is no longer just a footnote, it's an active investigation trigger.

On the vulnerability front, CISA had one of its busiest weeks in a while, adding seven actively exploited flaws to its Known Exploited Vulnerabilities catalog in a single alert. We break down the most dangerous of the bunch below, including a maximum-severity command injection bug in the open-source Kestra workflow platform and an authentication bypass in JFrog Artifactory already being used to mint admin tokens.

As always, treat every summary below as a starting point, not a substitute for reading the full sourced report before you brief your own leadership. Let's get into it.

Data Breaches

1. Thomson Reuters Court Software Breach Exposes Sealed Records: An unauthorized party accessed files from C-Track, the court case management platform sold by Thomson Reuters' West Publishing unit, in an intrusion discovered in June and now confirmed to affect courts across eleven U.S. states, the U.S. Virgin Islands, and Ontario. The Minnesota Judicial Branch says exposed data may include Social Security numbers, driver's license numbers, medical information, and confidential sealed or redacted court records, and has cut off Thomson Reuters' access to its systems while forcing a password reset for its case management users. Source: The Hacker News
2. Manchester Airports Group Data Leaked After Ransom Refusal: Extortion group FulcrumSec followed through on its threat against Manchester Airports Group, publishing roughly 550 gigabytes of uncompressed data after the operator refused to pay a ransom for the roughly 86 GB it claims to have stolen. The breach, disclosed in late August, affected an estimated 8.7 million customers who had booked car parking, lounge access, or in-airport Wi-Fi, with the attackers saying they got in using admin keys left exposed in the front-end JavaScript of the airports' own websites. Source: BleepingComputer
3. Dropbox Accounts Compromised Through Lenovo ID Flaw: Dropbox disclosed that roughly 5,000 user accounts were compromised between August 4 and 21 after attackers abused a weakness in Lenovo's email verification process to register fraudulent Lenovo IDs tied to victims' email addresses, then used those IDs to sign into Dropbox without a password. Every compromised account reportedly lacked multi-factor authentication, and Dropbox has since severed the Lenovo single sign-on integration and now requires a password check before linking it again. Source: BleepingComputer

Security Research

1. OpenAI's Astra Crosses 'Critical' Cyber Threshold: OpenAI says its newest model, Astra, is the first to be classified 'Critical' under the company's Preparedness Framework for cybersecurity, a tier reserved for models that can independently find and exploit zero-days across well-defended systems or run a full attack chain from a single high-level instruction. During testing, Astra discovered two previously unknown vulnerabilities on its own and built a full browser-compromise chain that escaped its sandbox, prompting OpenAI to restrict advanced offensive capabilities to vetted partners for now. Source: SecurityWeek
2. 'Pass-ta-key' Attacks Undermine Synced Passkeys and Phishing-Resistant MFA: Three separate research efforts, from SpecterOps and Palo Alto Networks' Unit 42 among others, showed ways to defeat passkey protections without breaking their underlying cryptography. The attacks reuse signed authentication material and abuse Google Chrome's cloud-synced passkey handling on Windows systems with a TPM, in one case recovering private keys for a victim's synced passkeys and in another impersonating privileged Entra ID users while still satisfying phishing-resistant MFA checks. Source: The Hacker News
3. Faster Remote Spectre Attack Leaks Data From Cloudflare Workers: Researchers disclosed a remote Spectre side-channel attack against Cloudflare's Workers platform that leaked a JSON Web Token from a co-located Worker at up to 12 bits per second, 360 times faster than a similar attack demonstrated in 2021, without needing native code execution or a sandbox escape. Cloudflare says the underlying issue is already mitigated in production through Dynamic Process Isolation, V8 Sandbox integration, and memory-protection-key-based isolation, and found no evidence the technique was used against real customer data. Source: The Hacker News
4. HiddenLayer Raises $100 Million for AI Runtime Security: AI security startup HiddenLayer closed a $100 million Series B led by Delta-v Capital, with Microsoft's M12 and Booz Allen Ventures also participating, bringing its total funding past $155 million. The company says it will use the money to expand its Agentic Runtime Security platform and a new Agent Harness Security product aimed at protecting AI coding agents at runtime, on the back of annual recurring revenue that grew more than 10x over the past year. Source: SecurityWeek
5. Infostealer Logs Are Now an Operational Security Problem, Not Just Underground Noise: A new analysis argues that infostealer logs have evolved from a dark-web curiosity into a genuine incident-response trigger, noting that roughly 46% of stealer logs containing corporate credentials trace back to unmanaged or personal devices and that exposure of major SaaS and cloud credentials is growing about 29% a year. The piece pushes defenders to treat a credential surfacing in a stealer log as a potential live compromise rather than a stale password to rotate at leisure. Source: BleepingComputer

Top CVEs

1. CVE-2026-49869: An OS command injection vulnerability in Kestra OSS, the open-source workflow orchestration platform, carries a maximum CVSS score of 10.0 and lets an unauthenticated remote attacker create and execute arbitrary workflows on the underlying host. CISA added it to its Known Exploited Vulnerabilities catalog after confirming active exploitation, with a remediation deadline of September 5, 2026 for federal agencies. Source.
2. CVE-2026-82329: A critical improper-authentication flaw in JFrog Artifactory, scored 9.8, allows an unauthenticated attacker to obtain administrative privileges. Attackers began exploiting it within days of disclosure to mint admin tokens and enumerate users across exposed instances. Source.
3. CVE-2026-83548 and CVE-2026-83549: A pair of actively exploited flaws in SonicWall SMA1000 appliances — a server-side request forgery and an OS command injection — are being chained by attackers, including ransomware affiliates, to gain remote access to VPN appliances and deploy custom malware. Both were added to CISA's KEV catalog alongside a September 5, 2026 patch deadline. Source.
4. CVE-2026-59822: An improper authentication vulnerability in BerriAI's LiteLLM, a widely used proxy for routing calls to large language models, could let attackers bypass access controls on AI infrastructure and pivot into connected model deployments. CISA gave federal agencies until September 16, 2026 to remediate given confirmed in-the-wild exploitation. Source.
5. CVE-2026-9586: A SQL injection vulnerability in Sangoma's Switchvox VoIP platform allows attackers to manipulate backend database queries, and is being actively exploited to gain unauthorized access to phone systems and the data they hold. It was among the seven flaws CISA added to its Known Exploited Vulnerabilities catalog this week. Source.

Final Words

If there's a thread running through today's edition, it's that trust boundaries keep moving faster than security teams can redraw them. A court system trusted a vendor's platform, an airport trusted its own front-end code not to leak admin keys, and Dropbox trusted a partner's identity checks — in every case, the weakest link wasn't the headline company's own software.

Meanwhile, the Astra news is a marker worth sitting with regardless of how you feel about AI hype: when a model can independently chain together a browser exploit and escape a sandbox during a safety evaluation, the calculus for both defenders and attackers shifts, and it won't be the last time we cover a 'first' like this.

On the CVE side, the common denominator this week is infrastructure that's supposed to be boring — workflow orchestrators, artifact repositories, VoIP systems, LLM proxies — getting hit precisely because it's boring and under-patched. Check your exposure against CISA's KEV catalog today, not after your name shows up in tomorrow's edition.

If Secret CISO helped you start your morning informed, do us a favor and share it with a colleague or on your team's Slack — word of mouth is still how this newsletter grows. Stay vigilant, stay informed, and see you in the next edition of Secret CISO!