Assessing risk at the speed of change, coordinated disclosure, and the news – Danielle Russell – ESW #484
Interview - Danielle Russell - The Attack Surface Changed: Who Reassesses Risk After the Approval?
The attack surface now changes faster than any team can reassess it, as employees add integrations, grants, and agents to apps long after they were approved. Danielle Russell, VP of Product at Nudge Security, explains what continuous reassessment looks like in practice: which changes deserve a response, which work agentic AI can take on, and where analysts still make the call. She also makes the case that security still owns the risk after approval, even when it never saw the change that created it.
Segment Resources:
- Modernize your TPRM program with adaptive risk management for SaaS and AI
- Nudge Security Unveils Adaptive Risk Management press release
- The security work nobody wants to do is the risk nobody’s watching
- OAuth grants pile up faster than you can review them BleepingComputer
This segment is sponsored by Nudge Security. Visit https://securityweekly.com/nudge to learn more about them!
Topic Segment - Coordinated Disclosure
An AI-found PHP flaw sat unfixed since 2024, a PoC video leaked, and a vendor broke the embargo early, citing active exploits.
Coordinated disclosure in 2026 is:
- 75% - Too slow for AI world
- 13% - Vendor Credit Race
- 13% - This is fine ????????️????
- 0% - Working as designed
- 0% - Other (tell me)
Mike's thoughts: Only a few folks think coordinated disclosure is working as designed, based on last week’s vibe check. Everyone else lands somewhere between "too slow" and the dog sitting in the burning room. I think the old disclosure window was built for a world where a human found the bug, a human wrote the fix, and disclosed it responsibly (most of the time). Now AI finds flaws faster than vendors can ship patches, so any kind of embargo stops being a grace period. It becomes a head start for whoever else found the same bug. I don't think shorter deadlines fix this. The fix side has to get as fast as the find side, which is actually the hardest part of the puzzle to solve in cyber.
Enterprise Security News
Finally, in the enterprise security news,
- A little funding
- making software liable for cyber breaches
- we have a new biggest bank heist ever!
- more freezers defrosted
- a company builds malware into their product on purpose
- AI pentesting frameworks are lowering the script kiddy bar
- AI hosting company hacks their competitor
- there’s a new SSH bug that could be very, very bad
- even MSPaint gets a vulnerability
All that and more, on this episode of Enterprise Security Weekly.
Danielle has spent over a decade helping B2B technology companies gain a deep understanding of the challenges faced by IT and security teams in order to keep customer needs at the center of product development. Prior to joining the founding team at Nudge Security, Danielle led product marketing for AT&T Cybersecurity. Her professional experiences span cybersecurity, enterprise networking, telecommunications, and brief, but joyous detours into public radio and environmental sustainability work.
The hardest part of defending an enterprise today isn't finding security gaps. It's managing complexity.
Hybrid infrastructure. Legacy systems. Cloud. AI. Third-party risk. Regulatory requirements. Nation-state threats. And somehow you're expected to make all of it work together.
If you're responsible for securing government or critical infrastructure environments, join us for the Government Security Virtual Summit on November 18. Hear how security leaders are modernizing defenses, reducing complexity, and building resilient security programs that stand up to today's threat landscape.
Security Weekly listeners can register for free at https://securityweekly.com/govsec using the discount code CSS26-SW
Adrian Sanabria
- FUNDING/M&A courtesy of the Security, Funded newsletter #268 – Let’s Get [Infi]sical
FUNDING
- &Truth (US) · $70.0M Seed | formal verification for software security, investors undisclosed
- Infisical (US) · $40.0M Series B | encrypted secrets management platform, led by Elad Gil
- Overwatch Data (US) · $15.0M Series A | threat intelligence platform, led by Mouro Capital
- REGULATION: UK to look at making software companies liable for cyber breaches
- BREACHES: Chained PHP2Shell Exploit Roots 25 Servers
We finally have evidence of PHP2Shell being used successfully in the wild, but it wasn't easy. The targets were Palo Alto Firewalls, since they use PHP for their web interfaces. This, combined with a local privilege escalation vulnerability that was published in Q2 2026, attackers got root on the devices and were able to pivot into the company proper.
The exploits had to be tuned for specific models of firewalls, resulted in a lot of crashes, but eventually worked for attackers.
Overall, it's a very informative writeup that goes far beyond the initial exploitation.
- BREACHES: 29 October 2026 Binance Security Incident: Initial Findings and Response Update
How the attack happened, based on what Binance is sharing so far.
- June 2026 - Wallet Engineer falls for malvertizing via Google search (probably) and downloaded a pre-pwned version of Homebrew. This was detected and contained, but not until after the attackers got some details about other wallet engineers.
- September 2026 - a second wallet engineer gets woo'ed by a hiring scam through a real job-hunting platform. Engineer then felt for the old malware-posing-as-a-coding-interview trick (i.e. ClickFix). This also used Homebrew as the attack vector (likely because it will look pretty normal in most Mac-heavy engineering environments).
- October 20 2026 - Using the second wallet engineer's access, attackers used an internal AI tool to compromise the original wallet engineer victim, as well as a third wallet engineer. (no details on how this happened).
- October 29 2026 - attacker logged into the third engineer's computer and used a container deployment token from the first engineer's computer to deploy a container and trigger a malicious script to begin the wallet theft attack
- BREACHES: Suspected cyberattacks target US military, European supermarket freezers
You know what? Maybe all the Internet exposed dry tinder just needs a spark and we need a digital forest fire to clear out generations of tech debt. I don't see it getting cleaned up any other way.
- CYBERCRIME: Cops bust botnet of 1.3M infected Android TV boxes
Videostrong intentionally build malware into the products they were selling consumers and then sold access to the resulting botnet to criminals. Is unethical manufacturer a new category of adversary?
- ATTACKS: The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources
Old attack type, new technology to abuse. It even has a MITRE ATT&CK TTP: T1496.001.
- ATTACKS: Threat Actors Abuse AI Pentesting Framework
Following the insights into cybercriminals' use of Cairn from NorForge, this is starting to resemble a pattern.
Both Cairn and ARTEX are open-source agentic penetration testing frameworks. They are both designed to go through all the phases of a penetration test - recon, enumeration/vuln identification, exploitation, lateral movement, data exfiltration, etc - all in pursuit of the provided goal.
In the Cairn example we discussed previously, prompts were as basic as "fetch credit cards", which actually worked!
In this case, the threat actor used a combination of DeepSeek 4.1, GLM 5.3, and Grok 4.6. Claude Code was also used to help plan monetizing stolen data.
This is a concerning trend, as these agentic pentesting frameworks are proving to be effective at finding flaws in proprietary company applications - the kind of vulns that don't get a CVE, because they only exist in one company.
- ATTACKS: Railway attempts to hack its competitor with AI (Tweet from mRr3b00t)
It's like the whole "boys will be boys" argument in court and will probably age just as well.
The details here are wild.
- Josh Manders, founder of Primcloud asks the founder of Railway, Jake Cooper, why his employees are trying to hack him.
- They own up to it immediately - within minutes, we know that Jake Runzer was the one doing it. Says he was just building a harness to agentically sign up for services.
- Josh provides screenshots of Jake actively trying to steal credentials. He also adds that Jake signed up with a throwaway Proton account and a fake name, but used his personal credit card.
- At the same time, Josh waves away suggestions that he should press charges: "bro it happened in the middle of the night, calm your tits" <- so if it happened at 2pm, the FBI would be on the case right now?
- Jake Cooper claims that this was something an employee did of their own accord, on their own personal time.
This is going to happen a lot more in the future.
Reactions from the security community:
- Azeria on X (@Fox0x01): "The plausible deniability problem is real. We’re seeing people increasingly shifting blame onto their AI agent, using the observability problem as an excuse for its malicious actions. People used to be afraid of getting caught doing computer crimes. Now it’s just a casual "oops my agent went off the rails, not my fault".
- Marcus Hutchins on X (MalwareTechBlog): This thread is absolutely WILD. TL;DR founder finds rival company trying to hack his networkk. He posts about it tagging said company. Both the dude responsible and the founder jump in like "yeah, our bad, our AI went off the rails" as if they just accidentally bumped into someone on the sidewalk.
- Justin Elze (@HackingLZ): Woah
- ESSAYS: We urgently need to monitor AI agents’ actions in real time
My kneejerk response to this title was, "uh... DUH!"
While there are plenty of observability tools out there, this research is more focused on identifying the actions/behaviors that are most important to monitor and working towards a standard.
It seems almost unbelievable that so many years in, and with the ability to vibe code complex apps in hours, we're still trying to figure out how to monitor this technology. Heck, the largest AI tech companies in the world spent most of August trying to figure out if their model testing committed any crimes.
- SQUIRREL: PAINT2Shell
- VULNERABILITIES: SSHHOLE
This is very, very, very bad. If you have SSH open to the Internet anywhere, you have some analysis and DFIR work to do.
