AI Weakly #08 - 110 million reasons your firewall isn't a boundary!
AI Weakly is the weekly newsletter for those who make decisions on AI and security without time to waste. Every Tuesday: the facts that matter without the noise.
Issue #8
Top Story —
This week's threat landscape reveals a coordinated escalation across three critical attack surfaces: the FortiBleed campaign has compromised 110 million credentials from 430,000+ firewalls, Cordyceps CI/CD vulnerabilities threaten 300+ repositories at major tech companies, and malicious actors are exploiting AI skill marketplaces and SaaS integrations for supply chain compromise. Active exploitation timelines have compressed to 24 hours (Cisco CUCM), forcing organizations to choose between patching speed and stability. The common thread: attackers are treating infrastructure, development pipelines, and AI systems as credential stores and code execution platforms, not security boundaries. CISOs face a convergence crisis requiring simultaneous action on perimeter security, software supply chain controls, and AI governance.
Weakly Digest —
01 —
FortiBleed: Attackers Turn 430,000 Firewalls Into Credential Stealers, Compromising 110M Credentials
🔴 Critical / Active Exploitation
Russian-speaking threat actors orchestrated a large-scale credential-harvesting campaign targeting FortiGate firewalls globally since February 2026, exploiting brute-force attacks and credential stuffing against exposed management interfaces. The operation has harvested over 110 million credentials from enterprise infrastructure, enabling direct perimeter access and lateral movement.
EDITOR’S NOTE
Treat this as an insider threat at the network perimeter. Immediately audit FortiGate management interface exposure (port 443, 8443) and implement IP whitelisting. If you cannot confirm your firewall management interface is isolated from internet access, assume compromise and rotate all credentials. This is a credential-to-code-execution pipeline—any admin account from FortiBleed can tunnel directly into your network.
02 —
CISA Issues Emergency Patch Deadline for Actively Exploited Cisco CUCM Vulnerability
🔴 Critical / Active Exploitation
CISA mandated emergency patching of a critical Cisco Unified Communications Manager Server vulnerability by Sunday, citing active exploitation in the wild. Attackers weaponized the SSRF and privilege escalation flaw within 24 hours of disclosure, targeting enterprise communications infrastructure at scale.
EDITOR’S NOTE
This is a federal mandate—non-compliance creates regulatory exposure. Prioritize CUCM patching above all other Sunday maintenance windows. If you cannot patch by Sunday, take CUCM offline or air-gap it immediately. Communications infrastructure compromise enables social engineering, call interception, and lateral movement. Verify patches are deployed before re-enabling network access.
03 —
Cordyceps CI/CD Flaws Expose 300+ Repositories to Supply Chain Compromise, Affecting Microsoft and Google
🔴 Critical / Supply Chain Attack
Researchers discovered critical CI/CD workflow vulnerabilities affecting 300+ GitHub repositories at major organizations including Microsoft and Google, enabling attackers to achieve full repository control through exploitable workflow patterns. The Cordyceps campaign also targeted Azure Sentinel and Google's AI Agent Development Kit, demonstrating active targeting of development infrastructure.
EDITOR’S NOTE
Audit your GitHub Actions workflows immediately for exposed secrets in environment variables, overly permissive pull_request_target triggers, and missing branch protection rules. Any CI/CD job that executes untrusted pull request code without approval gates is a Cordyceps vector. Enforce mandatory code review + approval before any deployment, and rotate all GitHub credentials that may have been cached in workflow logs.
04 —
Malicious OpenClaw Skills and Compromised Salesforce OAuth: AI and SaaS Supply Chains Under Attack
🟣 AI/Supply Chain / SaaS Integration Risk
OpenClaw removed five malicious skill packages from ClawHub containing infostealer malware that evaded security controls, while attackers breached Klue (third-party Salesforce vendor) and leveraged stolen OAuth tokens to access customer Salesforce instances. Both incidents demonstrate supply chain compromise through AI skill repositories and SaaS integrations.
EDITOR’S NOTE
Review all OAuth applications connected to Salesforce, Google Workspace, and Microsoft 365 immediately—treat any third-party integration as a potential credential exfiltration vector. For AI systems using third-party skills: require sandboxing, disable network access by default, and audit all installed skills against security advisories. Implement OAuth token scoping (minimal necessary permissions) and add usage monitoring for unusual data access patterns.
05 —
German Court Establishes AI Liability Precedent: Google Held Accountable for LLM Hallucinations
🟣 Regulation / AI Governance
A German court ruled that Google is liable for errors in AI-generated search overviews, establishing that companies cannot use AI inaccuracy as a liability shield. The ruling treats AI systems as organizational agents, mirroring accountability standards applied to human workers and setting precedent for downstream liability across enterprise AI deployments.
EDITOR’S NOTE
This precedent fundamentally shifts risk calculus for enterprise AI integration. Before deploying any LLM in customer-facing or decision-critical contexts, establish governance controls: output review workflows, hallucination detection, and human approval gates. Document AI system limitations in legal/compliance terms and ensure liability insurance covers AI-generated content. Treat LLM outputs as unvetted claims, not facts, and maintain audit trails for AI-assisted decisions.
Also worth reading —
Prompt Injection as Role Confusion: LLMs Bypass Safety Controls via Text Styling Manipulation — Audit internal LLM applications for input validation—treat all user input as untrusted code, not natural language.
AI Coding Agents Tricked Into Running Malware from Benign GitHub Repos — Disable autonomous code execution in AI agents; require manual approval before any agent-generated code runs in production.
Scattered Spider Guilty Pleas: Ransomware Group Linked to 120 Intrusions and $115M in Ransom — Review incident response playbooks for Scattered Spider TTPs: MFA bypass, supply chain compromise, and critical infrastructure targeting.
Cybersecurity Firms Targeted via Fraudulent OpenAI Organization Invites — Train SOC/security teams to verify AI platform invitations through out-of-band channels; treat collaboration features as social engineering vectors.