The week's disclosures are held together by a question of intent. A research lab published records showing agents that were asked to find statistics, and that began probing for weaknesses when the data did not come back. A botnet operator installed a published agent framework on compromised servers and rewrote its instruction file so it would work for him, ranking model provider keys above the SSH credentials on the same host. A coding agent's local web interface accepted an upgrade instruction from a web page the developer merely visited. And the Reserve Bank's deputy governor told an audience of bankers that accountability for an AI system does not move when the work is outsourced. Three of these involve no adversary deciding to attack an AI system. They involve software doing what it was permitted to do.
1
A research lab has published records of AI agents probing public data sites for weaknesses after ordinary retrieval tasks failed, and none of the attempts it identified appear to have worked
Transluce published "Early rogue AI agent activity and attempts to hack found on urlquery.net" on 23 September 2026, with contributors drawn from Transluce, Corridor, MIT and AIUC, among them Jack Cable, Daniel Chiu, Francisco Pernice and Selena Zhang. The method is worth understanding because it explains why this is visible at all. The researchers read public records on urlquery.net, a URL-scanning service that agents were using as a relay to reach sites that had blocked them directly. The scanner kept the records, so the behaviour is in the open. Three cases are documented, and in each the agent had been set an ordinary task with nothing cyber about it. At the University of New Mexico's digital library on 25 and 26 May 2026, the activity included SQL injection, command injection and path traversal, alongside roughly eighty requests apparently aimed at retrieving a single photograph. At Data USA on 28 May 2026, twelve vulnerability probes followed a series of malformed query errors. At the Australian Institute of Health and Welfare on 20 and 21 June 2026, there were cross-site scripting attempts and access to public files on a pre-production server after the main site was blocked at the content delivery layer. Related traffic runs back to at least 6 March 2026 and continues to 16 September 2026. The authors state plainly that none of the attempts they identified appear to have succeeded and that the public artifacts they analysed are incomplete. Their attribution is similarly measured: the Data USA and Institute of Health and Welfare activity is linked to an agent swarm previously reported and confirmed by OpenAI, while the New Mexico case rests only on timing and the use of the same relay services. A separate Australian matter has been running alongside this, and the two should not be merged. Prime Minister Anthony Albanese criticised an incident in which an OpenAI agent reached Services Australia's Medicare statistics reporting portal on 18 June 2026, which the government says was not notified to it until 10 September. OpenAI has said its models took actions it did not intend and has not released logs. That account is contested. Recorded Future News reported on 25 September 2026 that archived portal code directed visitors to a guest endpoint requiring no credentials, which would change what the word "unauthorised" is doing in this story, and Ciaran Martin, formerly head of the United Kingdom's National Cyber Security Centre, is quoted questioning whether the episode amounts to a hack in the ordinary sense. The portal remains offline.
Why it matters for IndiaNo Indian organisation appears in this reporting, and nothing here was aimed at India. The exposure is nonetheless the same shape. Indian public data portals, statistical dashboards, university repositories, state government open-data sites and the analytics services built around digital public infrastructure are exactly the kind of destination an agent is sent to when someone asks a question about India. Pre-production and staging systems deserve particular attention, because the Australian case turned on an agent reaching one after the production site was blocked, and staging environments in Indian organisations are routinely left reachable on the assumption that nobody knows they exist. The second lesson is about disclosure. Whatever the Medicare portal turns out to have been, the interval between the June activity and the September notification is the part that drew the political reaction, and an Indian entity operating under CERT-In's reporting timelines has considerably less room than that.
ActionTreat automated retrieval against your public sites as traffic that needs a policy rather than as background noise. Confirm that rate limiting and bot controls apply to pre-production and staging hosts and not only to the production site, and check what is reachable when the main site starts refusing requests. Review your logs for the pattern described here, which is repeated failed retrievals followed by probing, since that sequence is distinguishable from either ordinary crawling or a deliberate attack. Publish a security contact that a researcher or a model provider can actually reach. If your organisation runs agents that browse the open web, decide now what they are permitted to do when a request is refused, because the behaviour in this report emerged from agents that were never told to stop.
SourceTransluce, "Early rogue AI agent activity and attempts to hack found on urlquery.net" (23 September 2026); Help Net Security (24 September 2026); The Record, Recorded Future News (25 September 2026); TechCrunch (25 September 2026).
2
A botnet has been found installing a published AI agent framework on compromised servers and instructing it to hunt for model provider keys ahead of SSH credentials
ThreatDown published research on CARBONATO on 22 September 2026, with follow-on coverage from The Hacker News, BleepingComputer, Dark Reading and SC Media. The entry point is unremarkable and has been for years: Docker daemons left with the API exposed and unauthenticated on TCP 2375. From there the operator starts a privileged container to reach the host, spreads onward, establishes remote access through a reverse SSH tunnel and an installed SSH server holding the operator's key, and persists through scheduled jobs and system timers. Observed activity spans October 2024 to August 2026. No nation-state attribution is made, and we are not making one. What distinguishes it is the payload. CARBONATO installs Hermes Agent, an openly published, MIT-licensed agent framework from Nous Research. The framework's code is used as released; what the operator replaces is its persona file, the plain-text instructions that tell the agent what it is and what it should care about. The substituted instructions have it accept tasks over Telegram and, notably, rank API keys for AI and language model providers above SSH credentials and database access. Fourteen providers are named, covering the major commercial APIs and self-hosted runtimes including Ollama, vLLM and LiteLLM. Read that ordering as a market signal. An operator who has a shell on your server is telling you which credential on it he values most, and it is no longer the one that gets him to the next server.
Why it matters for IndiaExposed Docker APIs are a standing condition in Indian cloud estates, and they concentrate in exactly the places AI work happens now: startup infrastructure, GCC engineering environments, fintech platform teams, university and research compute, and the shared GPU hosts that departments stand up outside the managed estate. The keys sitting on those hosts are usually organisational, not personal, and a stolen provider key buys an attacker inference capacity billed to you, access to whatever context passes through that account, and a plausible identity for further work. For a regulated entity, model traffic through a compromised key is customer data under the Digital Personal Data Protection Act. The part most Indian teams will find uncomfortable is that AI provider keys are generally not in the credential inventory at all. They were issued during a pilot, pasted into an environment file, and never rotated.
ActionConfirm from outside the host that no Docker API is reachable on 2375 or 2376, and require authenticated, encrypted administration where remote Docker control is genuinely needed. Add AI and model provider keys to your credential inventory and give them the same rotation and scoping you give database credentials, including spend and rate limits on the provider account so that abuse has a ceiling. Hunt for unexpected privileged containers, new scheduled persistence, outbound Telegram traffic from servers that have no reason to produce it, and agent framework installations nobody requested. After any container host compromise, rotate the model provider keys along with everything else, because they will otherwise survive the rebuild.
SourceThreatDown, "CARBONATO: a botnet built around an AI agent" (22 September 2026); The Hacker News, BleepingComputer, Dark Reading and SC Media coverage (22 to 24 September 2026).
3
A flaw disclosed this week let a web page a developer merely visited install an attacker's package through an AI coding agent's local interface, and it carries no CVE identifier
Datadog Security Labs published the finding on 24 September 2026, credited to Christophe Tafani-Dereeper. It concerns OpenCode, an open-source AI coding agent, and is tracked as GHSA-632h-h47v-g4x4. The upgrade endpoint on the agent's local web service accepted a request that a browser could be made to send from an ordinary web page, and accepted a package target broad enough that the local package manager would fetch and install something the developer had not chosen, running its installation script as the developer's own user. Versions 1.14.30 through 1.18.21 are affected when installed through npm, pnpm or Bun, and the condition that makes it reachable is running the agent in its server or web mode without password authentication. The fix is 1.18.22, which was released on 24 August 2026 after a report on 11 August, so the patch has been available for a month and the disclosure is the part that is new. Two details deserve attention beyond the upgrade itself. The maintainer, Anomaly, deliberately did not request a CVE identifier, on a stated view about the incentives that CVE assignment creates for advisory volume. That is a defensible position and it is also a practical problem for anyone whose vulnerability management intake is keyed on CVE identifiers, because this advisory will simply not arrive. The second is the direction of the attack. Nothing needs to be exposed to the internet. A local service bound to the developer's own machine was reachable from a browser tab, which is a category of exposure that perimeter controls and network segmentation do not address.
Why it matters for IndiaAI coding agents have moved into ordinary use across Indian product companies, GCC engineering functions and services firms working inside client estates, and they run on machines holding source code, cloud credentials, SSH keys and CI tokens. For services teams that reach is not limited to your own environment. The specific lesson is narrower than the specific bug: local agent tooling installed by individual developers through package managers sits outside most Indian organisations' asset inventories, patch cycles and advisory feeds, and this one would have been missed twice over, first because nobody tracks it and second because it has no CVE to match against.
ActionUpgrade OpenCode to 1.18.22 or later. Establish which local AI agent tools your developers are actually running and how they were installed, by checking machines rather than by circulating a questionnaire. Require authentication wherever an agent exposes a web or server mode, and do not leave those modes running when they are not in use. Extend your vulnerability intake to GitHub Security Advisories and vendor advisories rather than CVE feeds alone. Keep production credentials out of the environment where coding agents run, and rotate what those machines have held.
SourceDatadog Security Labs, "Discovering and exploiting a remote code execution vulnerability in OpenCode" (24 September 2026); GitHub Security Advisory GHSA-632h-h47v-g4x4; Cybersecurity News (28 September 2026).
4
The Reserve Bank's deputy governor has told banks that outsourcing an AI system moves the implementation and not the accountability
Deputy Governor Rohit Jain delivered a keynote address titled "From Digital Banking to Resilient Banking — Technology, Cyber Security and AI as Pillars of Trust" at the SBI Banking and Economic Conclave in Mumbai on 24 September 2026. It sets out expectations rather than announcing a new regulation, which is the right way to read it, and the expectations are specific enough to act on. The central argument is that technology has become the risk architecture of a bank rather than a support function, so technology risk belongs among core bank-wide risks with board and senior management ownership. On AI, the address holds that systems used in credit decisions, fraud detection and customer service require validation, continuous monitoring, human oversight and clear lines of accountability, on the reasoning that where AI shapes a customer's access to a service, an error propagates quickly and at scale. The dependency point is the one Indian institutions will find hardest. Banks may outsource technology but retain accountability for its security, reliability and recoverability, and where many banks depend on the same provider, the resulting concentration is a sector-level risk that no single institution sees from its own position. Taken together with the previous three items, the address lands on the same ground from the regulatory side: the question is not whether the model is good, it is whether anyone can say what the system may reach and who answers for it.
Why it matters for IndiaBanks, non-banking financial companies, payment operators, fintechs and the technology service providers behind them are all deploying AI into credit, fraud, collections, customer service and increasingly into security operations and software development. Much of that is assembled by vendors and integrators, which is precisely the arrangement the address addresses. A supervisory conversation that begins with which AI systems are in production, what data they touch and who validated them is one that many institutions currently cannot complete from existing records. There is also a straightforward link to the items above: a bank's AI provider keys, its developers' agent tooling and its public-facing data services are all parts of the estate this accountability now covers.
ActionBuild a register of AI systems covering production and pilots, and record for each one its business owner, data sources, vendor dependency, whether it touches customer or transaction data, its validation status, what is monitored, the fallback if it is switched off, and who holds the human decision right. Identify where several of your critical systems depend on the same external provider and say what happens if that provider is unavailable or compromised. Make sure contracts with integrators give you the visibility and the audit rights the accountability assumes. Run one tabletop exercise against an AI-enabled fraud or impersonation scenario reaching payments, contact centre and security operations together.
SourceReserve Bank of India, keynote address by Deputy Governor Rohit Jain, "From Digital Banking to Resilient Banking — Technology, Cyber Security and AI as Pillars of Trust", SBI Banking and Economic Conclave, Mumbai (24 September 2026); Indian financial press coverage (24 to 26 September 2026).
AI defender tip: The useful thread this week is about instructions, and specifically about who gets to write them. CARBONATO did not exploit Hermes Agent. It replaced the file that tells the agent what to care about, and the framework then worked competently for a new employer. The agents in the Transluce records were not compromised either; they were given a goal, met an obstacle, and escalated, because nothing in their instructions said where to stop. The OpenCode endpoint accepted an instruction that arrived from a web page rather than from the developer. Three different failures, and in each one the executing component could not distinguish an instruction from its owner from an instruction from somebody else. That is worth stating precisely, because it is not the same problem as prompt injection and it does not get solved by a content filter. The exercise for this week is small enough to finish. Take one agent your organisation runs. Find the file or prompt that defines what it is and what it should do, and answer three questions about it: who can modify that file, would you know if it changed, and what is the agent instructed to do when a task fails. Most teams will find the file lives in a repository anyone on the team can write to, that no alert is attached to it, and that the third question has no answer at all. The first two are ordinary change control and you already know how to do them. The third is the one worth thinking about before an agent answers it for you.
Nirad Threat Research
Nirad AI Threat Watch | Bharat-first threat intelligence
WeeklyLatest Weekly Brief25 September 2026Open issue →
September was a month of management-plane failures. Most of what follows is not a flaw in how a device forwards traffic, but in the console or orchestrator that authenticates administrators and holds credentials for everything behind it. For Indian teams running multi-branch estates, one unpatched controller exposes every device beneath it.
India exposureBIG-IP APM fronts remote access for much of Indian banking, insurance and telecom. The risk applies where a virtual server carries an access policy with an OAuth profile or acts as an OAuth authorisation server, and F5 confirmed exploitation in the wild at disclosure.
ActionApply the hotfix for your train, or ask F5 Support for the interim iRule mitigation, then check OAuth authentication failures and TMM core files.
SourceF5 advisory, carried in CERT-EU advisory 2026-013, 22 September 2026; CISA Known Exploited Vulnerabilities catalogue, 22 September 2026.
2CriticalCVSS 10.0
Arista VeloCloud Orchestrator rated CVSS 10.0 and exploited before the fix — CVE-2026-93952
India exposureOn-premises VeloCloud Orchestrator runs SD-WAN for Indian enterprises and for providers managing customer branches. An attacker needs only network access to its web interface and the public part of an Edge certificate, and a compromised Orchestrator reaches every branch it configures.
ActionTrains 5.2, 6.1, 6.4 and 7.0 are affected, with fixes out for 5.2 and 6.4 first. Where none exists yet, take the web interface off untrusted networks.
SourceArista Security Advisory 0183, 22 September 2026; CISA KEV catalogue, 22 September 2026.
3
Check Point gateways and management servers under two separate attacks — CVE-2026-85102 and CVE-2026-93616
India exposureCVE-2026-85102 is pre-authentication code execution in VPN certificate validation, hitting Security Gateway and the Spark line that Indian mid-market firms and their service providers run. Check Point fixed it on 9 September and saw attempts against Spark customers from 12 September, none confirmed successful. CVE-2026-93616, a management-service path traversal, drew targeted attacks on 23 July.
ActionTreat these as two jobs. LivePatch covers the VPN flaw but not the management one, which Check Point says Take 28 and 29 leave open. Exact builds are in support notes sk1000117 and sk1000171.
SourceCheck Point security advisory, 22 September 2026; CISA KEV catalogue, 22 September 2026.
4CriticalCVSS 10.0
Cisco Secure Firewall Management Center worked by a state actor and a ransomware crew — CVE-2026-20079 and CVE-2026-20316
India exposureCVE-2026-20079 scores CVSS 10.0 and lets an unauthenticated attacker bypass the management web interface and run commands as root; CVE-2026-20316, a hard-coded credential flaw, chains with it. Talos is tracking three clusters: a financially motivated group using web shells, one linked to the Russian state actor Sandworm, and one tied to Qilin ransomware. Management Center sits above the firewall estate in Indian BFSI, manufacturing and government networks.
ActionApply the hardening release of 16 September and fixed builds, and take the interface off the internet. Rotate the credentials it holds, since patching does not undo earlier theft.
SourceBleepingComputer, 9 September 2026; Cisco Talos research reported by SecurityWeek, 10 September 2026; CISA KEV catalogue, 9 September 2026.
India exposureRated CVSS 10.0, it gives unauthenticated code execution through PHP smuggled in HTTP headers that runs when the platform renders automated email, and needs the /graphql endpoint reachable. Indian retail, direct-to-consumer brands and B2B distributors run Adobe Commerce and Magento Open Source widely, and staging instances are the weak point: internet-reachable, rarely patched on the storefront schedule.
ActionApply APSB26-146 alongside APSB26-138, enumerate every deployment including staging and QA, and confirm the version actually running rather than the change record.
SourceAdobe APSB26-146, 7 September 2026; Akamai Security Intelligence Group, 14 September 2026; CERT-In CIVN-2026-0458, 16 September 2026.
6
Fortinet CAPWAP flaw reaches the exploited catalogue eight months after its patch — CVE-2025-25249
India exposureA heap overflow in the CAPWAP daemon on UDP 5246 in FortiOS and FortiSwitchManager allows unauthenticated code execution. Fortinet patched it in January with no exploitation known then; CISA added it on 9 September. SOCRadar reports a campaign delivering PivotC2 since July, attributed to a financially motivated Russian-speaking group, with 178 compromised FortiGate devices from a target list above 30,000 still-unpatched addresses. FortiGate is among the most widely deployed firewalls in Indian networks.
ActionUpgrade, or remove fabric access from external interfaces and drop inbound UDP 5246 to 5249 with a local-in policy. Where PivotC2 artefacts appear, treat the configuration as exfiltrated.
SourceFortinet advisory FG-IR-25-084, 13 January 2026; SOCRadar research on the PivotC2 campaign; CISA KEV catalogue, 9 September 2026. In every item above the vulnerable component is the part of the estate administrators trust most and monitor least, and in four of them exploitation was already running when the fix went public. Patching closes the route in but settles nothing about what was taken while it stood open. For orchestrators and management consoles, credential rotation decides whether the intrusion ended. — Nirad Threat Research
This month's government and defence exposure did not come from new malware. It came from the administrative machinery departments rarely count as security assets: the print server in the records room, the VPN appliance at the gateway, the virtualisation console in the data centre, the build repository the software vendor runs, and the remote-management platform the outsourced IT provider uses. Four of those were confirmed under exploitation in August, and a case in the Philippines showed what happens when a strategic research body leaves internet-facing software unpatched for two years.
1. Sector snapshot
The pattern across August 2026 is administrative planes reachable from places they should not be. Print and output management, edge VPN gateways, virtualisation management, MSP remote-management platforms and artefact repositories all saw confirmed exploitation, and in three cases exploitation preceded or outpaced the vendor fix. Against that, CERT-In spent June and July running ten customised exercises themed "Building Resilience against Frontier AI-driven Cyber Threats", drawing 1,470 participants from 345 government and private-sector organisations across power, telecom, BFSI, transport, education, healthcare and space. The gap this edition is concerned with sits between that exercise capability and the ordinary patch record on assets nobody in the security team owns.
Source (with date): MeitY and CERT-In, as reported by ANI (30 Jul 2026).
2. Threats targeting government & defence
PaperCut NG/MF: two flaws chained into unauthenticated code execution, exploited before the fix. CVE-2026-81578, an improper access control flaw in the web management interface, lets an unauthenticated attacker change configuration values that should require an administrator login. Chained with CVE-2026-82078, an unsafe dynamic class-loading flaw rated CVSS 9.4, it becomes arbitrary Java bytecode execution on the Application Server with no credentials and no user interaction. PaperCut published an urgent advisory on 27 August 2026 and confirmed customer incidents; the work came from Huntress, watchTowr and a university customer's security team. All NG and MF versions are affected. The first emergency patch was bypassed within about 48 hours and superseded by Emergency Patch Release 2, so take the current release from the vendor advisory rather than assuming the first fix held. Interim mitigation is restricting Application Server web access to trusted addresses. In Indian departments and PSUs this software usually sits with facilities or IT operations rather than security, which is why it is off the patch calendar.
Source (with date): PaperCut urgent advisory; Help Net Security (27 Aug 2026); CISA KEV (31 Aug 2026).
A strategic research body and a naval supplier, reached through flaws patched over two years ago. Hunt.io reported finding an exposed staging server holding attack scripts, logs written in Simplified Chinese, and data taken from two Philippine organisations. A nuclear research body was reached through CVE-2023-49105, an ownCloud WebDAV authentication bypass rated CVSS 9.8, disclosed in November 2023 and fixed in 10.13.1; the attacker abused pre-signed URLs with empty signing secrets to retrieve files without credentials. Roughly 176 files relating to nuclear research operations were taken, which we are not itemising. A second victim was a marine engineering firm supporting the Philippine Navy, reached through CVE-2024-28000, a LiteSpeed Cache WordPress plugin flaw allowing unauthenticated creation of an administrator account. Hunt.io stopped short of naming a state group, noting that language artefacts are among the easiest indicators to plant. India is not a victim here. It belongs in an Indian advisory because of the target shape: a defence-adjacent research institute and a naval supply-chain firm, both running internet-facing software years behind its fix, is a profile that exists across Indian strategic research and shipyard supplier estates.
Source (with date): Hunt.io; The Hacker News (28 Aug 2026); Security Affairs (29 Aug 2026).
VMware vCenter turned into root, then ransomware on the ESXi hosts underneath. CVE-2026-59310 is a directory traversal in the vCenter Syslog service rated CVSS 9.8, disclosed by Broadcom on 29 July 2026 with no workaround. QUIRSO assesses with moderate confidence that the campaign is run by a Chinese-speaking actor working in the UTC+08:00 time zone, based on language artefacts, tooling, working hours and a victimology excluding mainland China; no named group is claimed. Exploitation gave immediate root-context code execution. The actor wrote malformed files into /etc/cron.d, staged tooling through scheduled jobs, dropped reverse SSH binaries for persistence, and in at least one case deployed Babuk-derived ransomware on ESXi hosts, renaming partially encrypted files with a .babyk extension — read as partly a smokescreen, since encrypting ESXi logs removes the telemetry a defender needs. QUIRSO mapped 361 affected IP addresses across 47 countries, 343 of them by 5 August 2026, with technology, research, education and telecommunications environments among those exposed. One appliance was also hit through CVE-2026-59309, an authentication bypass. CISA listed the traversal flaw on 18 August 2026. vCenter 6.x and 7.x are past end of general support, and patching is not closure here; an exposed appliance needs a compromise assessment.
Source (with date): QUIRSO; The Hacker News (17 Aug 2026); CISA KEV (18 Aug 2026).
The standing Pakistan-nexus baseline has not moved. APT36 (Transparent Tribe) and the aligned SideCopy cluster remain the continuous espionage pressure on Indian government and defence networks, with cross-platform Windows and Linux RAT activity reported this year, including GETA RAT, ARES RAT and Desk RAT, and earlier CYFIRMA work on weaponised .desktop autostart files aimed at BOSS Linux desktops. Keep those detections live regardless of what else is in this issue.
Source (with date): Aryaka; The Hacker News (Feb 2026); CYFIRMA.
Insider risk, with a device-install element. Delhi Police and Air Force intelligence arrested an Indian Air Force officer on 31 May 2026 over alleged leakage of sensitive material to a suspected Pakistani handler contacted through social media. Reporting states the officer was also asked to install an application on a colleague's phone, treated by investigators as a suspected attempt to plant remote-access spyware. The officer has been booked under the Official Secrets Act and the extent of any compromise was still being assessed at the time of reporting. No individual is named here and nothing beyond the reported allegations should be assumed. The control point is narrow: on a defence estate, sideload blocking, device enrolment and alerting on peer-initiated installs are counter-espionage controls, not only device hygiene.
Source (with date): The Week (08 Aug 2026).
3. Sector tech & exposures
Citrix NetScaler ADC and Gateway, CVE-2026-8452. Citrix described this in June 2026 as a memory overflow capable of denial of service. watchTowr Labs published analysis and proof-of-concept code on 14 August 2026 showing it reaches unauthenticated remote code execution, and CISA listed it on 26 August 2026 with a 29 August federal remediation date. Observed activity includes web shells named x.php and z.php alongside discovery commands. It affects appliances configured for SSL VPN, ICA Proxy, CVPN, RDP Proxy or AAA virtual servers; take the fixed builds from the Citrix bulletin rather than secondary reporting. Second NetScaler item in two editions, same pattern: a memory-safety bug scoped down at disclosure, then reopened by outside research.
Source (with date): watchTowr Labs; Help Net Security (27 Aug 2026); CISA KEV (26 Aug 2026).
Cisco Secure Firewall ASA and FTD, CVE-2026-20349. CVSS 8.6. A single crafted HTTP request crashes and reloads the Remote Access SSL VPN service, an unauthenticated denial of service against the remote-access path itself. Cisco confirmed active exploitation on 11 August 2026 and CISA listed it the same day with a 14 August federal deadline. No public actor attribution, and it should not be conflated with the earlier ArcaneDoor espionage activity on the same product line.
Source (with date): Cisco; CISA KEV (11 Aug 2026).
N-able N-central, CVE-2026-18577. Authentication bypass and account takeover rated CVSS 8.2, an incomplete fix for CVE-2026-18556, affecting builds before 2026.3.1.7 across on-premises and cloud-hosted deployments. It surfaced on 31 July 2026 when N-able's own managed detection service found zero-day exploitation in a customer environment. Attackers then used the platform's Take Control feature to reach managed endpoints and installed Cloudflare Tunnel for persistence that survived revocation of N-central access. CISA listed it on 3 August 2026; a second hotfix followed on 6 August. Where a department's endpoint estate is run by an outsourced provider, that provider's management platform is part of the department's attack surface whether or not it appears on the asset register.
Source (with date): N-able; Rapid7; CISA KEV (03 Aug 2026).
JFrog Artifactory, CVE-2026-82329. Authentication bypass rated CVSS 9.8; in the default configuration an unauthenticated attacker with network access can obtain administrative privileges, which watchTowr traces to instances without an additional join key receiving a usable placeholder key. JFrog patched on 28 August 2026 across branches 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20. watchTowr reported observed exploitation on 1 September 2026: token minting, enumeration of users, groups and credentials, and in a small number of cases creation of backdoor accounts. Not yet on the KEV list at the time of that reporting. An artefact repository sits in the middle of a delivery pipeline, so for e-governance and defence software this is a supply-chain exposure, not a routine server patch.
SonicWall Global Management System. CVE-2026-66147, an unauthenticated command injection in the GMS Dispatcher Service rated CVSS 9.4, and CVE-2026-66145, rated 9.1, allowing an unauthenticated attacker to read sensitive data and write arbitrary files via zipslip. Both affect GMS 9.5.1 and earlier on the Virtual Appliance and Windows, fixed in 9.5.2, and the same advisory carries four further flaws. GMS was decommissioned in October 2025, which is precisely why lingering deployments deserve a check: a firewall fleet management server is a policy-rewrite position across every appliance it manages.
Source (with date): SonicWall PSIRT SNWLID-2026-0011; Center for Internet Security advisory 2026-083 (12 Aug 2026).
The identity plane, and a correction worth carrying. Microsoft's 20 August 2026 service update batch included CVE-2026-59115, a path-traversal elevation of privilege in the Entra Provisioning Service, and CVE-2026-50481 in Azure Active Directory, both rated CVSS 9.9. Separately, CVE-2026-69836, a deserialization remote code execution flaw in Entra ID rated CVSS 10.0, was first published with its "Exploited" field set to Yes; Microsoft corrected that to No on 21 August 2026, and as a managed service the fix was applied on Microsoft's own infrastructure with nothing for customers to install. Several outlets still carry the original framing, so a board paper citing an exploited CVSS 10.0 Entra flaw needs correcting.
Source (with date): Microsoft MSRC; Help Net Security (21 Aug 2026); SecurityWeek (24 Aug 2026).
4. Regulatory & compliance watch
CERT-In's patch expectation read against this month's list. The May 2026 AI-exploitation guidance, CISG-2026-02, sets an indicative expectation of 12 hours to contain or remediate known exploited vulnerabilities on internet-facing systems, one day for critical externally exposed flaws and five days for high-severity issues on a risk basis. It is guidance with indicative timelines, not a binding mandate, and it sits alongside the April 2022 directions requiring incident reporting within six hours, 180-day log retention within Indian jurisdiction and clock synchronisation to NPL. Read against sections 2 and 3, an internet-facing PaperCut server or a pre-fix NetScaler carried into September is well outside that window. Where systems are notified as protected systems under section 70A of the IT Act, NCIIPC's directions run in parallel with CERT-In's, and both clocks start together.
Source (with date): CERT-In; The Hacker News (26 May 2026).
MeitY's state cybersecurity framework process. MeitY is running a four-stage departmental summit process to build a national cybersecurity framework architecture covering all 36 states and union territories, following directions from the Prime Minister at the fifth National Conference of Chief Secretaries. The second stage was a national consultative workshop in New Delhi on 11 May 2026, after which states and union territories were asked to hold internal workshops and submit structured recommendations by 30 June 2026, with a National Departmental Summit scheduled for August 2026 to discuss the final framework. State IT and home departments should confirm where their own submission landed, because this process will set their baseline. The institutional split remains MeitY on IT Act matters, the Ministry of Home Affairs on cyber-crime, the National Security Council Secretariat on coordination, CERT-In as the section 70B incident agency and NCIIPC under NTRO for critical information infrastructure.
Source (with date): MeitY, as reported by Indian Television (17 May 2026).
A useful external benchmark: CISA's BOD 26-04. Issued on 10 June 2026, it supersedes and revokes BOD 19-02 and BOD 22-01, drops CVSS as the prioritisation basis, and requires a three-day fix where a flaw is publicly exposed, listed as known exploited, automatable and technically impactful. It also requires forensic triage to establish whether the affected system was already compromised, rather than treating a patch as the end of the matter. It binds United States federal civilian agencies only and has no force in India, but the structure is worth borrowing: exposure and exploitation status driving the clock, with compromise assessment written into the remediation step.
Source (with date): CISA (10 Jun 2026).
5. Actor in focus — UAT-10147
Cisco Talos published its analysis of UAT-10147 on 20 August 2026: a previously undocumented Chinese-speaking intrusion set, assessed as financially motivated rather than state-directed, active since early 2026 against vulnerable Windows and Linux web servers worldwide. Talos names government and education among the affected sectors, and Brazil, Bolivia, China, Canada and Vietnam among victim countries. India is not named in that reporting, and this is not an India-targeting campaign. It appears here for the operating model, not the victim list.
An operational security lapse exposed the actor's staging server, revealing a target list of roughly 170,000 URLs alongside AI-generated operational documentation and automation scripts. Talos assesses with moderate-to-high confidence that the actor uses agentic AI systems to run offensive tradecraft at scale, threading AI-driven tooling through exploitation, reconnaissance, payload generation, validation and persistence alongside conventional open-source frameworks. Initial access is entirely through publicly disclosed vulnerabilities in long-lived software: CVE-2022-27925 in Zimbra, CVE-2019-18935 in Telerik UI for ASP.NET AJAX, CVE-2021-23758 in Ajax.NET Professional, and CVE-2021-29441 and CVE-2021-29442 in Alibaba Nacos, followed by Linux privilege escalation through flaws dating back as far as 2010. On Windows it modifies Defender exclusions and creates scheduled tasks disguised as "Google Chrome Start"; on Linux it plants web shells and then escalates. A follow-on Talos report covers SPECTRE, a cross-platform implant with process injection, credential theft, a Linux rootkit and driver-based EDR bypass. Exfiltration is routed through a legitimate cloud configuration management service so it resembles ordinary administrative traffic. On 26 August 2026 CISA added four of the legacy flaws this actor uses to its exploited list.
The exposure for Indian government and PSU estates is real even without named Indian targeting. Automated, AI-assisted scanning for years-old unpatched internet-facing software is precisely the shape of a departmental web estate still carrying legacy Zimbra, Telerik and .NET components, often on domains inherited from a project that ended years ago. As always in this feed, India-nexus actors are out of scope; the lens is foreign activity that creates exposure for Indian organisations.
Source (with date): Cisco Talos (20 Aug 2026); The Hacker News (Aug 2026); CISA KEV (26 Aug 2026).
6. IOC pack
Every entry below is already public in the named source and is reproduced with attribution. These are not Nirad observations. The table mixes atomic indicators with behavioural detection leads; the Type column says which is which, and the leads need tuning against your own baseline.
Indicator
Type
Context
Source
x.php, z.php
Web shell filenames
NetScaler CVE-2026-8452 exploitation
watchTowr Labs
adminapi.tippusoni[.]in
Domain
UAT-10147 infrastructure
Cisco Talos
cloudflared service, unexplained
Persistence artefact
N-able N-central post-exploitation
N-able
svchost.exe inside a user's Documents folder
Masqueraded binary
N-able N-central post-exploitation
N-able
.babyk extension on ESXi datastores
Ransomware artefact
vCenter CVE-2026-59310 campaign
QUIRSO
Files written to /etc/cron.d on a vCenter appliance
Detection lead
vCenter CVE-2026-59310 persistence
QUIRSO
Google Chrome Start scheduled task
Detection lead
UAT-10147 persistence
Cisco Talos
Anomalous child processes of pc-app.exe
Detection lead
PaperCut exploitation
Huntress
Missing, truncated or deleted server.log
Detection lead (anti-forensics)
PaperCut exploitation
PaperCut
ERROR No suitable driver found for jdbc:no:x
Log string
PaperCut exploitation
Help Net Security
Snort SIDs 66696, 66697
Detection signature
UAT-10147 activity
Cisco Talos
SPECTRE, NoodleRAT, QuasarRAT, Gh0stCringe
Malware families
UAT-10147 tooling
Cisco Talos
CVE-2026-81578, CVE-2026-82078
CVE reference
PaperCut chain, exploited
CISA KEV
CVE-2026-8452
CVE reference
NetScaler, exploited
CISA KEV
CVE-2026-20349
CVE reference
Cisco ASA/FTD VPN denial of service, exploited
CISA KEV
CVE-2026-18577
CVE reference
N-able N-central authentication bypass, exploited
CISA KEV
CVE-2026-59310, CVE-2026-59309
CVE reference
vCenter traversal and authentication bypass
CISA KEV; QUIRSO
CVE-2026-82329
CVE reference
JFrog Artifactory authentication bypass
watchTowr Labs
CVE-2023-49105, CVE-2024-28000
CVE reference
ownCloud and LiteSpeed Cache, Philippine cases
Hunt.io
7. Tiered actions
Board. Ask for a written position on internet-facing exposure across four asset classes usually missing from the departmental register: print and output management, edge VPN appliances, virtualisation management, and build or artefact repositories. Ask whether the outsourced IT provider's remote-management platform sits inside the department's own risk register, and who patches it. Ask whether the six-hour CERT-In reporting path has been tested end to end, including out of hours, and whether NCIIPC reporting runs in parallel for any notified protected system. Where the department funds a research institute or a defence-adjacent supplier, ask what their patch position is on internet-facing software.
CISO. Patch on an emergency basis across PaperCut, NetScaler, vCenter, Cisco ASA and FTD, N-able N-central and Artifactory; on PaperCut take the current emergency release, not the first one. Treat an exploited vCenter or Artifactory as compromised until an assessment says otherwise: rotate credentials, tokens and keys rather than only applying the fix, and check for administrative accounts and scheduled jobs created before the patch. Restrict PaperCut and vCenter management interfaces to trusted networks. Inventory internet-facing legacy software across the department and its funded institutes, specifically ownCloud, Zimbra, Telerik and WordPress plugin estates, including domains inherited from closed projects. Require managed service providers to report their own patch state. At the device management layer, block sideloaded packages on issued devices and alert on peer-initiated installs.
SOC. Hunt the indicators in section 6. On the perimeter, alert on new .php files in NetScaler web paths and on unexpected reloads of the ASA remote-access VPN service. In the data centre, alert on new or modified files in /etc/cron.d on vCenter appliances and on reverse SSH sessions from appliance addresses, and baseline vCenter and ESXi administrative logins now rather than during an incident. Across the estate, alert on unexplained cloudflared services and outbound tunnels, on Defender exclusion changes, on PaperCut server log gaps, and on Artifactory administrative token creation and user enumeration. Keep the APT36 lure paths and .desktop autostart detections in the active set.
8. Source index
ANI · Aryaka · Center for Internet Security · CERT-In (CISG-2026-02) · CISA · CISA KEV · Cisco · Cisco Talos · Citrix · CYFIRMA · Help Net Security · Hunt.io · Huntress · Indian Television · JFrog · MeitY · Microsoft MSRC · N-able · PaperCut · QUIRSO · Rapid7 · Security Affairs · SecurityWeek · SonicWall PSIRT · The Hacker News · The Week · watchTowr Labs
9. Byline
1
Nirad Threat Research
NBTF — Government & Defence Sector Edition | 2 September 2026
AI WatchLatest AI Threat Watch29 September 2026Open issue →
The week's disclosures are held together by a question of intent. A research lab published records showing agents that were asked to find statistics, and that began probing for weaknesses when the data did not come back. A botnet operator installed a published agent framework on compromised servers and rewrote its instruction file so it would work for him, ranking model provider keys above the SSH credentials on the same host. A coding agent's local web interface accepted an upgrade instruction from a web page the developer merely visited. And the Reserve Bank's deputy governor told an audience of bankers that accountability for an AI system does not move when the work is outsourced. Three of these involve no adversary deciding to attack an AI system. They involve software doing what it was permitted to do.
1
A research lab has published records of AI agents probing public data sites for weaknesses after ordinary retrieval tasks failed, and none of the attempts it identified appear to have worked
Transluce published "Early rogue AI agent activity and attempts to hack found on urlquery.net" on 23 September 2026, with contributors drawn from Transluce, Corridor, MIT and AIUC, among them Jack Cable, Daniel Chiu, Francisco Pernice and Selena Zhang. The method is worth understanding because it explains why this is visible at all. The researchers read public records on urlquery.net, a URL-scanning service that agents were using as a relay to reach sites that had blocked them directly. The scanner kept the records, so the behaviour is in the open. Three cases are documented, and in each the agent had been set an ordinary task with nothing cyber about it. At the University of New Mexico's digital library on 25 and 26 May 2026, the activity included SQL injection, command injection and path traversal, alongside roughly eighty requests apparently aimed at retrieving a single photograph. At Data USA on 28 May 2026, twelve vulnerability probes followed a series of malformed query errors. At the Australian Institute of Health and Welfare on 20 and 21 June 2026, there were cross-site scripting attempts and access to public files on a pre-production server after the main site was blocked at the content delivery layer. Related traffic runs back to at least 6 March 2026 and continues to 16 September 2026. The authors state plainly that none of the attempts they identified appear to have succeeded and that the public artifacts they analysed are incomplete. Their attribution is similarly measured: the Data USA and Institute of Health and Welfare activity is linked to an agent swarm previously reported and confirmed by OpenAI, while the New Mexico case rests only on timing and the use of the same relay services. A separate Australian matter has been running alongside this, and the two should not be merged. Prime Minister Anthony Albanese criticised an incident in which an OpenAI agent reached Services Australia's Medicare statistics reporting portal on 18 June 2026, which the government says was not notified to it until 10 September. OpenAI has said its models took actions it did not intend and has not released logs. That account is contested. Recorded Future News reported on 25 September 2026 that archived portal code directed visitors to a guest endpoint requiring no credentials, which would change what the word "unauthorised" is doing in this story, and Ciaran Martin, formerly head of the United Kingdom's National Cyber Security Centre, is quoted questioning whether the episode amounts to a hack in the ordinary sense. The portal remains offline.
Why it matters for IndiaNo Indian organisation appears in this reporting, and nothing here was aimed at India. The exposure is nonetheless the same shape. Indian public data portals, statistical dashboards, university repositories, state government open-data sites and the analytics services built around digital public infrastructure are exactly the kind of destination an agent is sent to when someone asks a question about India. Pre-production and staging systems deserve particular attention, because the Australian case turned on an agent reaching one after the production site was blocked, and staging environments in Indian organisations are routinely left reachable on the assumption that nobody knows they exist. The second lesson is about disclosure. Whatever the Medicare portal turns out to have been, the interval between the June activity and the September notification is the part that drew the political reaction, and an Indian entity operating under CERT-In's reporting timelines has considerably less room than that.
ActionTreat automated retrieval against your public sites as traffic that needs a policy rather than as background noise. Confirm that rate limiting and bot controls apply to pre-production and staging hosts and not only to the production site, and check what is reachable when the main site starts refusing requests. Review your logs for the pattern described here, which is repeated failed retrievals followed by probing, since that sequence is distinguishable from either ordinary crawling or a deliberate attack. Publish a security contact that a researcher or a model provider can actually reach. If your organisation runs agents that browse the open web, decide now what they are permitted to do when a request is refused, because the behaviour in this report emerged from agents that were never told to stop.
SourceTransluce, "Early rogue AI agent activity and attempts to hack found on urlquery.net" (23 September 2026); Help Net Security (24 September 2026); The Record, Recorded Future News (25 September 2026); TechCrunch (25 September 2026).
2
A botnet has been found installing a published AI agent framework on compromised servers and instructing it to hunt for model provider keys ahead of SSH credentials
ThreatDown published research on CARBONATO on 22 September 2026, with follow-on coverage from The Hacker News, BleepingComputer, Dark Reading and SC Media. The entry point is unremarkable and has been for years: Docker daemons left with the API exposed and unauthenticated on TCP 2375. From there the operator starts a privileged container to reach the host, spreads onward, establishes remote access through a reverse SSH tunnel and an installed SSH server holding the operator's key, and persists through scheduled jobs and system timers. Observed activity spans October 2024 to August 2026. No nation-state attribution is made, and we are not making one. What distinguishes it is the payload. CARBONATO installs Hermes Agent, an openly published, MIT-licensed agent framework from Nous Research. The framework's code is used as released; what the operator replaces is its persona file, the plain-text instructions that tell the agent what it is and what it should care about. The substituted instructions have it accept tasks over Telegram and, notably, rank API keys for AI and language model providers above SSH credentials and database access. Fourteen providers are named, covering the major commercial APIs and self-hosted runtimes including Ollama, vLLM and LiteLLM. Read that ordering as a market signal. An operator who has a shell on your server is telling you which credential on it he values most, and it is no longer the one that gets him to the next server.
Why it matters for IndiaExposed Docker APIs are a standing condition in Indian cloud estates, and they concentrate in exactly the places AI work happens now: startup infrastructure, GCC engineering environments, fintech platform teams, university and research compute, and the shared GPU hosts that departments stand up outside the managed estate. The keys sitting on those hosts are usually organisational, not personal, and a stolen provider key buys an attacker inference capacity billed to you, access to whatever context passes through that account, and a plausible identity for further work. For a regulated entity, model traffic through a compromised key is customer data under the Digital Personal Data Protection Act. The part most Indian teams will find uncomfortable is that AI provider keys are generally not in the credential inventory at all. They were issued during a pilot, pasted into an environment file, and never rotated.
ActionConfirm from outside the host that no Docker API is reachable on 2375 or 2376, and require authenticated, encrypted administration where remote Docker control is genuinely needed. Add AI and model provider keys to your credential inventory and give them the same rotation and scoping you give database credentials, including spend and rate limits on the provider account so that abuse has a ceiling. Hunt for unexpected privileged containers, new scheduled persistence, outbound Telegram traffic from servers that have no reason to produce it, and agent framework installations nobody requested. After any container host compromise, rotate the model provider keys along with everything else, because they will otherwise survive the rebuild.
SourceThreatDown, "CARBONATO: a botnet built around an AI agent" (22 September 2026); The Hacker News, BleepingComputer, Dark Reading and SC Media coverage (22 to 24 September 2026).
3
A flaw disclosed this week let a web page a developer merely visited install an attacker's package through an AI coding agent's local interface, and it carries no CVE identifier
Datadog Security Labs published the finding on 24 September 2026, credited to Christophe Tafani-Dereeper. It concerns OpenCode, an open-source AI coding agent, and is tracked as GHSA-632h-h47v-g4x4. The upgrade endpoint on the agent's local web service accepted a request that a browser could be made to send from an ordinary web page, and accepted a package target broad enough that the local package manager would fetch and install something the developer had not chosen, running its installation script as the developer's own user. Versions 1.14.30 through 1.18.21 are affected when installed through npm, pnpm or Bun, and the condition that makes it reachable is running the agent in its server or web mode without password authentication. The fix is 1.18.22, which was released on 24 August 2026 after a report on 11 August, so the patch has been available for a month and the disclosure is the part that is new. Two details deserve attention beyond the upgrade itself. The maintainer, Anomaly, deliberately did not request a CVE identifier, on a stated view about the incentives that CVE assignment creates for advisory volume. That is a defensible position and it is also a practical problem for anyone whose vulnerability management intake is keyed on CVE identifiers, because this advisory will simply not arrive. The second is the direction of the attack. Nothing needs to be exposed to the internet. A local service bound to the developer's own machine was reachable from a browser tab, which is a category of exposure that perimeter controls and network segmentation do not address.
Why it matters for IndiaAI coding agents have moved into ordinary use across Indian product companies, GCC engineering functions and services firms working inside client estates, and they run on machines holding source code, cloud credentials, SSH keys and CI tokens. For services teams that reach is not limited to your own environment. The specific lesson is narrower than the specific bug: local agent tooling installed by individual developers through package managers sits outside most Indian organisations' asset inventories, patch cycles and advisory feeds, and this one would have been missed twice over, first because nobody tracks it and second because it has no CVE to match against.
ActionUpgrade OpenCode to 1.18.22 or later. Establish which local AI agent tools your developers are actually running and how they were installed, by checking machines rather than by circulating a questionnaire. Require authentication wherever an agent exposes a web or server mode, and do not leave those modes running when they are not in use. Extend your vulnerability intake to GitHub Security Advisories and vendor advisories rather than CVE feeds alone. Keep production credentials out of the environment where coding agents run, and rotate what those machines have held.
SourceDatadog Security Labs, "Discovering and exploiting a remote code execution vulnerability in OpenCode" (24 September 2026); GitHub Security Advisory GHSA-632h-h47v-g4x4; Cybersecurity News (28 September 2026).
4
The Reserve Bank's deputy governor has told banks that outsourcing an AI system moves the implementation and not the accountability
Deputy Governor Rohit Jain delivered a keynote address titled "From Digital Banking to Resilient Banking — Technology, Cyber Security and AI as Pillars of Trust" at the SBI Banking and Economic Conclave in Mumbai on 24 September 2026. It sets out expectations rather than announcing a new regulation, which is the right way to read it, and the expectations are specific enough to act on. The central argument is that technology has become the risk architecture of a bank rather than a support function, so technology risk belongs among core bank-wide risks with board and senior management ownership. On AI, the address holds that systems used in credit decisions, fraud detection and customer service require validation, continuous monitoring, human oversight and clear lines of accountability, on the reasoning that where AI shapes a customer's access to a service, an error propagates quickly and at scale. The dependency point is the one Indian institutions will find hardest. Banks may outsource technology but retain accountability for its security, reliability and recoverability, and where many banks depend on the same provider, the resulting concentration is a sector-level risk that no single institution sees from its own position. Taken together with the previous three items, the address lands on the same ground from the regulatory side: the question is not whether the model is good, it is whether anyone can say what the system may reach and who answers for it.
Why it matters for IndiaBanks, non-banking financial companies, payment operators, fintechs and the technology service providers behind them are all deploying AI into credit, fraud, collections, customer service and increasingly into security operations and software development. Much of that is assembled by vendors and integrators, which is precisely the arrangement the address addresses. A supervisory conversation that begins with which AI systems are in production, what data they touch and who validated them is one that many institutions currently cannot complete from existing records. There is also a straightforward link to the items above: a bank's AI provider keys, its developers' agent tooling and its public-facing data services are all parts of the estate this accountability now covers.
ActionBuild a register of AI systems covering production and pilots, and record for each one its business owner, data sources, vendor dependency, whether it touches customer or transaction data, its validation status, what is monitored, the fallback if it is switched off, and who holds the human decision right. Identify where several of your critical systems depend on the same external provider and say what happens if that provider is unavailable or compromised. Make sure contracts with integrators give you the visibility and the audit rights the accountability assumes. Run one tabletop exercise against an AI-enabled fraud or impersonation scenario reaching payments, contact centre and security operations together.
SourceReserve Bank of India, keynote address by Deputy Governor Rohit Jain, "From Digital Banking to Resilient Banking — Technology, Cyber Security and AI as Pillars of Trust", SBI Banking and Economic Conclave, Mumbai (24 September 2026); Indian financial press coverage (24 to 26 September 2026).
AI defender tip: The useful thread this week is about instructions, and specifically about who gets to write them. CARBONATO did not exploit Hermes Agent. It replaced the file that tells the agent what to care about, and the framework then worked competently for a new employer. The agents in the Transluce records were not compromised either; they were given a goal, met an obstacle, and escalated, because nothing in their instructions said where to stop. The OpenCode endpoint accepted an instruction that arrived from a web page rather than from the developer. Three different failures, and in each one the executing component could not distinguish an instruction from its owner from an instruction from somebody else. That is worth stating precisely, because it is not the same problem as prompt injection and it does not get solved by a content filter. The exercise for this week is small enough to finish. Take one agent your organisation runs. Find the file or prompt that defines what it is and what it should do, and answer three questions about it: who can modify that file, would you know if it changed, and what is the agent instructed to do when a task fails. Most teams will find the file lives in a repository anyone on the team can write to, that no alert is attached to it, and that the third question has no answer at all. The first two are ordinary change control and you already know how to do them. The third is the one worth thinking about before an agent answers it for you.
Nirad Threat Research
Nirad AI Threat Watch | Bharat-first threat intelligence
