Security Monitor 2026-10-03 - Weekend Edition

Informational security guidance. Not certification. Not a substitute for scoped human review.

Executive Summary

The day's center of gravity is the AI agent orchestration layer itself. AWS disclosed four flaws in Loom for AWS and SageMaker Unified Studio (authentication bypass, OAuth2 token and cloud-credential theft, SSRF to internal credential endpoints, and cross-user code execution). GitLab shipped a critical (9.9) prompt-sandbox escape in its self-hosted AI Gateway.

CISA added the two DIVD Zammad zero-days to KEV, converting the 10-01 "update to v7" guidance into a federal deadline of October 5. Microsoft's 2026 Digital Defense Report quantified the shift: the median time from vulnerability discovery to weaponization is now well below 24 hours, with 2026 on track for a record ~72,000 CVEs.

The operational imperative is concrete and vendor-specific. If you run Loom for AWS, upgrade to 1.7.0 now and rotate the OAuth2 and IAM session credentials it handled. If you run a self-hosted GitLab AI Gateway, move to 19.2.4/19.3.2/19.4.1 immediately. If you run Zammad, the KEV entry means the patched-release-or-offline action is now a deadline, not a recommendation. Continuity clocks still open today: Cisco Catalyst SD-WAN Manager CVE-2026-76504 is due today (October 3); FortiMail CVE-2026-104286 is due tomorrow (October 4) with no patch yet.

Headline Developments

1. AWS patches four AI agent platform flaws enabling auth bypass, token and credential theft MEDIUM

Source: GBHackers - AWS AI Agent Vulnerabilities Let Attackers Bypass Authentication and Steal Credentials (Oct 2)
- AWS published security bulletins on October 2 covering three flaws in Loom for AWS (an AWS Labs open-source agent-orchestration platform) and one in the SageMaker Distribution startup process used by SageMaker Unified Studio.
- CVE-2026-103956 (Loom, before 1.6.1) is the highest-impact flaw: a missing-authentication issue in Loom's authentication dependency that lets any network client gain full administrative control of the agent control plane when no identity provider is configured, then register malicious tool servers, retrieve stored integration credentials, and alter IAM role policies.
- CVE-2026-103957 (Loom, before 1.7.0) is unsafe OAuth2 discovery processing: a user with mcp:write or a2a:write scope could point the backend at a malicious well-known discovery URL that discloses OAuth2 client secrets or another user's access token to an attacker-controlled endpoint.
- CVE-2026-103958 (Loom, before 1.7.0) is an SSRF-style outbound-request flaw in the MCP tool-server / Agent2Agent remote-connection logic that can reach a container credential-vending endpoint and return temporary AWS credentials. CVE-2026-104019 is an OS command-injection flaw in SageMaker Space startup scripts that lets a project member execute code in another member's Space and, with Trusted Identity Propagation, obtain another member's execution-role credentials.
- AWS's remediation: upgrade Loom to 1.7.0 (not 1.6.1), configure a Cognito user pool or external IdP before exposing Loom beyond loopback, ensure LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV is not set in production, then rotate OAuth2 client secrets, revoke/reissue affected tokens, rotate exposed IAM session credentials, and review CloudTrail. Restart affected SageMaker Studio Spaces to pick up patched images (fixed in 2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5, 4.4.3).

Why this matters: This is the same failure mode that has run through every agent-platform story this month, now on a first-party AWS Labs surface: the agent orchestration control plane is unauthenticated or weakly authenticated by default, and the blast radius is the credentials and IAM roles attached to the agents it runs. The rating is MEDIUM rather than HIGH because no in-the-wild exploitation is confirmed and CISA's record shows no public PoC, but the defensive action is concrete and available now: a specific version, a specific configuration gate, and a credential-rotation step. The credential-theft path (CVE-2026-103957/103958) is the most important line, because the value of an agent platform to an attacker is not the platform itself but the cloud identities it brokers.

Pattern callout: Extends the "the agent's supply chain is the supply chain" pattern (09-13 through 10-03) at the agent-orchestration layer specifically. The 10-01 iteration was the DIVD Zammad CVEs (agent-chained exploitation of a ticketing tool); this one is the agent platform's own control plane (Loom, SageMaker). Together they reinforce that the boundary is the identity and credential surface the agent touches, not the model, and that the defensive action is credential hygiene plus an authenticated control plane, not a WAF.

2. GitLab patches critical 9.9 prompt-sandbox escape in self-hosted AI Gateway MEDIUM

Source: The Hacker News - GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers (Oct 2)
- GitLab disclosed CVE-2026-90970 on October 2, a critical (CVSS 9.9) flaw in the AI Gateway that connects a GitLab instance to AI models, fixed in gateway versions 19.2.4, 19.3.2, and 19.4.1.
- The flaw is in the prompt template of a custom flow on the Duo Agent Platform: a logged-in user with Duo Agent Platform access could escape the prompt-template sandbox via a specially crafted flow configuration and reach arbitrary command execution on the gateway.
- Only self-hosted gateway deployments are in scope; GitLab.com, GitLab Dedicated, and self-managed instances using a GitLab-hosted gateway do not need to act, and GitLab had already updated its hosted gateways and notified self-hosted customers before publishing the advisory.
- CISA added an assessment to the CVE record on October 2 listing exploitation as "none" (no known active exploitation), and the advisory lists no workaround and no way to check whether a gateway was attacked before it was updated.
- Affected range is every gateway from 18.1.6 through the 19.1 line (no fixed version is listed below 19.2.4), so older self-hosted gateways have no in-place fix in the advisory.

Why this matters: This is the cleanest public example yet of the "prompt sandbox is the boundary" failure mode: the isolation mechanism that is supposed to keep an agent's model output out of the host is itself the thing that gets defeated, and the result is arbitrary command execution on the gateway. The rating is MEDIUM: there is a concrete, deployable fix (a named gateway version) and an active risk in any self-hosted deployment, but no confirmed exploitation to respond to. The defensive action is specific: if you run your own GitLab AI Gateway, update to 19.2.4/19.3.2/19.4.1 now, and note that there is no post-hoc way to confirm whether it was attacked, so treat an unpatched gateway as a suspect.

Pattern callout: Extends the "the agent's supply chain is the supply chain" pattern (09-13 through 10-03) and adds a new sub-theme: the prompt-sandbox / agent-flow isolation boundary is itself an attack surface. This pairs with the AWS Loom story (Story 1) on the same day, where the agent platform's control plane is the surface; the recurring lesson is that the isolation and authentication that wrap an agent are the real boundary, and when they fail the impact is command execution on the host.

3. CISA adds the two DIVD Zammad zero-days to KEV HIGH

Source: Windows Forum - CISA KEV Adds Exploited Zammad Flaws: Upgrade to 7.2.0 and Hunt for Root Compromise (Oct 2). Primary confirmation: CISA KEV catalog (dateAdded 2026-10-02, dueDate 2026-10-05 for both CVEs).
- CISA added the two Zammad vulnerabilities from the DIVD breach, CVE-2026-102489 (session hijack leading to unauthenticated remote code execution as the zammad service user) and CVE-2026-102490 (local privilege escalation to root), to the Known Exploited Vulnerabilities catalog on October 2.
- The KEV entry converts the 10-01 disclosure (first reported via DIVD and Merlon Security) from a vendor/victim advisory into a federal remediation requirement under the BOD 22-01 / BOD 26-04 framework, with a remediation deadline of October 5.
- Zammad is an open-source helpdesk/ticketing platform (more than 2,000 customers, roughly 55,000 users) that commonly runs on Linux or in Docker, and a service desk holds sensitive data while sitting close to the rest of the network, which is what makes the KEV addition material for a broad IT audience.
- The guidance is to upgrade to a patched release (7.2.0) or take the instance offline, and to hunt for root-compromise indicators consistent with the agent-chained exploitation DIVD described (session hijack, code execution as the zammad user, local privilege escalation to root, lateral movement to other services).
- No new victim count, first-attack timestamp, or additional CVE is disclosed in this window; the new material is the KEV status and the federal deadline, which is what elevates the story from a 10-01 HIGH advisory to a standing compliance item.

Why this matters: The substance of the flaw and the exploitation chain were already public in the 10-01 brief; what is new is the enforcement dimension, which changes the operational posture for anyone running Zammad from "the victim is asking you to update" to "CISA has set a federal deadline and expects a hunt." The rating is HIGH because confirmed exploitation is real (the DIVD breach, the agent-chained root compromise) and the KEV entry makes the deadline binding; the defensive action is unchanged but now time-boxed: upgrade to the patched release or isolate the instance, and run the hunt for the specific agent post-exploitation signature. This is the first time the "agent as attacker" thread has a KEV entry, which is a milestone for the pattern.

Pattern callout: Extends the "exploited flaws move to KEV and stay exploited" pattern (09-17 through 10-03) and the "the agent as attacker" thread (DIVD, 09-29; Zammad CVEs 10-01). The prior iteration (10-01) established the two CVEs and the agent-chained chain; this iteration adds the KEV entry and the federal deadline (October 5), which is the first time an AI-agent-attributed breach has entered the KEV catalog. That moves the story from a single-victim advisory to a standing federal remediation item, and it is the concrete proof that the "agent as attacker" thread now has the same enforcement weight as any other exploited flaw.

4. Microsoft 2026 Digital Defense Report: median discovery-to-weaponization now under 24 hours CONTEXT

Source: Help Net Security - AI is giving attackers a head start, Microsoft warns (Oct 2); also Microsoft Security Blog - Insights from the 2026 Microsoft Digital Defense Report (Oct 1).
- Microsoft's 2026 Digital Defense Report, covering July 2025 to June 2026 and drawing on 165 trillion daily security signals, states that the median time from vulnerability discovery in the wild to weaponization has fallen to well below 24 hours, and that the number of CVEs tracked for 2026 is on track for a record of an estimated 72,000.
- The report frames this as a near-term period in which attackers collect the benefits of AI first and defenders have to move quickly to close the gap, describing discovery and weaponization as now reducible to simply writing a prompt in many cases, and expecting a multi-year period in which known, unpatched vulnerabilities pile up and well-funded attackers may stockpile zero-days found this way.
- Phishing was the initial vector in 23% of the intrusions Microsoft's incident responders investigated in the window, up from 7% a year earlier; exploits against public-facing applications rose from 15% to 24%. In 52.2% of intrusions that began with valid accounts, attackers harvested more credentials once inside, and 18.4% involved active password-spray campaigns.
- The report documents state-actor AI adoption: Chinese state actors using AI tools to search for vulnerabilities and exploitation tips, Russian actors using "vibe coding" and AI-generated tooling to scale operations, and North Korean actors increasing AI use for persona development, social engineering, malware creation, and agentic workflows, with the March 2026 Axios npm package compromise listed among North Korean supply-chain activity.
- The report also documents malware that actively hunts for AI coding tools: the s1ngularity malware, spread through trojanized Nx npm packages, looked for Claude Code, Gemini CLI, and Amazon Q CLI on victim systems.

Why this matters: This is the data backbone for the patching-backlog pressure that has underpinned every exploited-flaw story this month, and it is the first time a major vendor has put a sub-24-hour median on discovery-to-weaponization. The rating is CONTEXT because there is no CVE to patch and no single defensive action to deploy; the value is that it quantifies the window in which the unpatched device or appliance is safe, and it is the strongest public confirmation that "patch slow, triage by CVSS" is no longer a defensible posture. The credential-harvesting stat (52.2% of valid-account intrusions) is the number to pair with the AWS Loom credential-theft story (Story 1): the identity and credential surface is where the attack actually lands, and the report says it is landing faster.

Pattern callout: Extends the "the agent's supply chain is the supply chain" pattern (09-13 through 10-03) and the "exploited flaws move to KEV and stay exploited" pattern (09-17 through 10-03) with a time-to-weaponization anchor. The 10-01 iteration (Google GTIG) was the RCE-ratio anchor (AI-discovered flaws nearly twice as likely to be RCE); this one is the speed anchor (sub-24-hour median to weaponization). Read together, the two give the pattern its two quantitative edges: the flaws are more dangerous per entry (GTIG) and the window to respond is shorter (Microsoft). The defensive implication is that the patching backlog is not just bigger, it is more dangerous per entry and the response window is shorter, which is exactly the pressure the KEV pipeline (Story 3) is meant to manage.

Pattern Analysis

Recommended Actions

Immediate (this week):

1. If you run Loom for AWS, upgrade to version 1.7.0 now, configure an identity provider before exposing Loom beyond loopback, and rotate the OAuth2 client secrets and IAM session credentials it handled. The four AWS flaws (Story 1) enable authentication bypass, OAuth2 token and cloud-credential theft, SSRF to internal credential endpoints, and cross-user code execution. CVE-2026-103956 (before 1.6.1) is the highest-impact; CVE-2026-103957 and CVE-2026-103958 (before 1.7.0) are the credential-theft and SSRF paths. Ensure LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV is not set in production, then review CloudTrail for suspicious activity during the affected window.

2. If you run a self-hosted GitLab AI Gateway, update to 19.2.4, 19.3.2, or 19.4.1 immediately. The prompt-sandbox escape (Story 2, CVE-2026-90970, CVSS 9.9) lets a logged-in user with Duo Agent Platform access reach arbitrary command execution on the gateway. There is no workaround and no way to confirm whether the gateway was attacked before it was updated, so treat an unpatched gateway as a suspect and hunt for unexpected command execution on the gateway host.

3. If you run any version of Zammad, upgrade to the patched release (7.2.0) or take the box offline, and run the hunt for the agent post-exploitation signature. The two CVEs (CVE-2026-102489, CVE-2026-102490) are now in CISA's KEV catalog (Story 3) with a federal due date of October 5. The hunt signature is the DIVD-described chain: session hijack, remote code execution as the zammad user, local privilege escalation to root, and lateral movement to other services.

4. If you run Cisco Catalyst SD-WAN Manager, patch CVE-2026-76504 today and restrict the Manager API to trusted networks. The CISA federal deadline is today (October 3) (continuity). Apply the fix, limit the management API to a dedicated management network, and review Manager logs for unauthorized admin-API calls.

5. If you run FortiMail, remove public management access or disable IBE support now, and hunt for the file-write artifact. The CISA federal deadline is tomorrow (October 4) and the corrected releases are still upcoming (continuity). The containment step is the only available action before the patch ships. Hunt for unexpected files on the appliance, modified configuration, and any signs of mail-flow tampering.

6. If you run Apple endpoints (iOS, iPadOS, macOS), confirm the 26.7.1 / 15.8.1 updates are on every device in the fleet. The CoreGraphics zero-day (CVE-2026-86950) is in KEV, the federal deadline was yesterday (October 2), and the first public PoC plus a candidate WhatsApp PDF delivery path are public (continuity). If you can't update immediately, restrict PDF and file handling on affected devices and monitor for unexpected process launches triggered by document open events.

This month:

1. Audit your agent-orchestration inventory and confirm that every agent platform in your environment is authenticated, scoped, and monitored. The AWS Loom and SageMaker flaws (Story 1) and the GitLab AI Gateway flaw (Story 2) are both on the agent-orchestration and prompt-sandbox layer. The defensive implication is that the agent platform's control plane is a first-class attack surface, not a developer tool, and it deserves the same authentication, egress control, and audit logging rigor as any production API.

2. Adopt the Microsoft Digital Defense Report's sub-24-hour weaponization median (Story 4) as the operational basis for your patching SLA. If the median time from discovery to weaponization is now under 24 hours, then the "patch slow, triage by CVSS" heuristic isn't defensible. Re-rank your open CVE queue to weight RCE-class and credential-theft-class flaws higher, and prioritize the agent-orchestration and inference-infrastructure categories that GTIG (09-30) and Microsoft (Story 4) both identify as the largest concentrations.

3. Build SOC detection for the specific agentic post-exploitation behavior described in the DIVD case (Story 3, 10-01). The agent's signature is a rapid, self-sequencing chain: session hijack, remote code execution as a low-privilege user, privilege escalation to root, and lateral movement to other services, all in seconds. That is a distinct pattern from human-driven post-exploitation, and it is now the reference case for a KEV-listed flaw, so it should be in your SOC's detection rules and your incident-response playbook.

Ongoing:

1. Maintain a KEV patching backlog that covers infrastructure, endpoints, management APIs, and agent-orchestration platforms. The Zammad KEV addition (Story 3) extended the KEV pipeline to an AI-agent-attributed breach, and the FortiMail and Apple additions (10-01, 09-30) extended it to a mail security appliance and consumer/enterprise endpoints. The patching scope now includes every Apple device, every edge appliance, every management API, and every agent platform in the fleet, not just the data path.

2. Treat the agent platform's control plane and the prompt-sandbox isolation boundary as first-class attack surfaces in your threat model. The recurring pattern across Loom (Story 1), GitLab AI Gateway (Story 2), OpenAI, Anthropic, and the earlier agent-orchestration CVEs is the same: the isolation and authentication that wrap the agent are the real boundary, and when they fail the impact is command execution on the host or credential theft from the platform. A WAF or model-level guardrail isn't a substitute for an authenticated, egress-controlled, and monitored agent control plane.

Relevant Risk Summary

Sources

• GBHackers - AWS AI Agent Vulnerabilities Let Attackers Bypass Authentication and Steal Credentials
• The Hacker News - GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers
• Windows Forum - CISA KEV Adds Exploited Zammad Flaws: Upgrade to 7.2.0 and Hunt for Root Compromise
• CISA Known Exploited Vulnerabilities Catalog
• Help Net Security - AI is giving attackers a head start, Microsoft warns
• Microsoft Security Blog - Insights from the 2026 Microsoft Digital Defense Report

Generated: 2026-10-03 08:50 EDT | Window: past 24h | Sources: GBHackers, The Hacker News, Windows Forum, CISA KEV, Help Net Security, Microsoft Security Blog