🛡️ CISO Intel — Sunday, 07-06-2026

Due to API rate limiting, here is today’s briefing:

Sunday, 07-06-2026. Reduced monitoring, skeleton crew, everyone’s at brunch. Ideal conditions for an attacker. Here’s what dropped while the world was offline.

🔴 Critical Threats & Active Exploitation

[Clear — enjoy it]

🛡️ CVEs Worth Your Attention

CVE-2026-30963 | Projectcapsule Capsule < 0.13.0 | CVSS not explicitly stated but high impact | Privilege escalation in Kubernetes multi-tenancy. Tenant admins can hijack namespaces by abusing namespace/status and namespace/finalize subresources, bypassing tenancy validation. This is a nasty bypass of isolation. | PoC: No (but technical details are public)

CVE-2026-11400 and CVE-2026-11401 | AWS Aurora PostgreSQL using AWS Advanced JDBC/Go Wrapper | Privilege Escalation. If you’re running Aurora PostgreSQL with these wrappers, check your versions. | PoC: No

⚡ New TTPs & Attack Research

Microsoft AI Red Team dropped an updated taxonomy of agentic AI system failure modes (v2.0). They highlight new categories and expand mitigations. This isn’t just theory; it’s grounded in a year of red team engagements against deployed systems. They specifically call out OpenClaw (launched Jan 2026) which accumulated 336k GitHub stars and spawned 2,100 agents in 48 hours, then immediately had 512 vulnerabilities, including CVE-2026-25253 (one-click RCE via WebSocket hijacking). Over 1,800 exposed instances were leaking API keys. This is the new attack surface, folks. T1588.006 (Obtain Capabilities: AI/ML Model) and T1195.003 (Supply Chain Compromise: Compromise of Third-Party Software Component) are directly relevant here.

🏗️ DevSecOps & Cloud Security

AWS updated their security documentation: Session revocation timings for permission changes are now 30 minutes, down from 1-2 hours. This significantly reduces the window for an attacker who gains temporary access. Good to see. Databricks announced user authorization for Databricks Apps will be enabled by default in early June 2026 for workspaces with compliance security profiles. This ensures apps act with the identity of the user, enforcing existing permissions. Important for least privilege. Databricks also announced ai_extract and ai_classify SQL AI Functions will be available by default for compliance-profiled workspaces in mid-July 2026. This adds AI capabilities for data processing but also introduces new data flow considerations for security.

🔧 Patches & Vendor Releases

[Clear — enjoy it]

🧪 Threat Intel & Malware

[Clear — enjoy it]

🌐 Industry, Brand & Internet Security

ICANN announced the ICANN87 Annual General Meeting will be held in Bali, Indonesia, from 17-22 October 2026. No immediate security implications, but relevant for domain security policy watchers. ICANN also introduced payment testing for 2026 Round Applicants. This is part of new gTLD processes, mostly administrative but good to see security considerations in financial transactions. ICANN sent a Notice of Termination to registrar Domus Enterprises LLC dba DOMUS (IANA #731) on May 29, 2026. This is a strong enforcement action, indicating a breach of registrar agreement, often due to non-compliance with data accuracy or security policies.

🤖 AI & LLM Security

Microsoft blogged about securing CI/CD in an agentic world, specifically a Claude Code GitHub action case. They identified a prompt injection pathway allowing access to workflow secrets under specific conditions. This is a critical reminder that AI integrations in your pipelines are new attack surfaces. T1552.006 (Obtain Credential: CI/CD Pipeline) is the direct outcome. Azure OpenAI Service experienced elevated error rates in multiple regions on May 29, 2026, due to a platform issue. While mitigated, it highlights the reliability and potential cascading impact of issues in large-scale AI services. MeitY (India’s Ministry of Electronics and Information Technology) issued an advisory to intermediaries and platforms, emphasizing due diligence obligations for AI/LLM/Generative AI use. They must prevent unlawful content, bias, and discrimination, and label outputs from under-tested models as fallible. Non-compliance could lead to prosecution. This is a significant regulatory move for AI safety and security. Google reportedly disrupted a criminal group using AI to exploit an unknown digital vulnerability. This is a real-world example of AI being weaponized to find zero-days, escalating the threat landscape.

📋 Compliance & Regulatory

MeitY (India) advisory mandates intermediaries ensure AI models don’t host unlawful content, bias, or threaten electoral integrity. Under-tested models must be labeled as fallible. This is a direct, actionable requirement for any company operating AI services in India.

💡 Marcus’s Take

The AI threat landscape is evolving faster than many realize. We’re seeing not just theoretical prompt injection, but AI being used to find zero-days and compromise CI/CD pipelines. The sheer speed of adoption, like with OpenClaw, means vulnerabilities are surfacing at an alarming rate, often exposing credentials. Defenders need to integrate AI security into their SDLC now, not later. Treat every AI component and agent as a potential attacker, and every prompt as untrusted input. The regulatory hammer is coming down, too, as seen with MeitY’s advisory; ignore it at your peril. The fundamentals still apply, but the attack surface is exploding.