The Tools You Trusted Are Now the Attack Surface
Three stories in this cycle describe the same failure, and none of them involve a zero-day in a product nobody owns. A shadowy relay service disables the sandboxes around OpenAI Codex and Claude Code. Five AI coding tools are found to contain flaws that permit code execution and file theft, collected by researchers under the name EMBRACE. A set of Chrome extensions with 13.4 million installs is caught hijacking searches. Different vendors, different attackers, same sentence: the software that generates and runs your work is now the software most likely to be turned against you, and almost nobody has a control that covers it.
That is the thread. It runs through the rest of the file. The same logic holds for the Cisco firewall crash, Fragnesia chained through PHP2Shell, the 2.5 million records at a Sony ISP subsidiary and the 115 GB breach at Summit Public Schools. In each case the thing that failed was trusted by default and inspected by nobody.
The sandbox was the security claim, and the sandbox was turned off
The Dark Reading report on the AI relay service, published 29 October, is the most consequential item this week. A relay service sits between an AI coding agent and the model API, and in doing so it removes the isolation the vendor built around the agent. The sandbox is not decoration. It is the basis on which an enterprise permits an agent to read a repository, write files and run commands. Take it away and you have granted an unattended process with network access and a developer's credential the rights of that developer, minus the developer's judgement.
The EMBRACE findings, reported by Hackread on 29 October, land on top of this. Five AI coding tools, code execution and file theft. These are not obscure utilities. They are the assistants installed on developer laptops this quarter because someone showed the team a demo, and almost none appears in a vulnerability scanner that inventories operating system packages and browsers.
OffSec released a free PHP2Shell lab following its own critical vulnerability discovery, per Hackread on 28 October. Take the practice time seriously for developers, but do not mistake a lab for a control.
The useful question for a CISO is not whether the vendor will patch. It is who, in your organisation, is accountable for what an AI agent is allowed to touch. If the answer is "the platform team, I think", you do not have an answer. You have a sentence with a hedge in it.
Extensions, credentials and the browser as an endpoint
Bleeping Computer's report on 29 October that Chrome extensions with 13.4 million installs were hijacking searches is a reminder that the browser became the primary enterprise endpoint about five years ago and the governance never caught up. An extension that can rewrite search results can rewrite a payment destination, an address in a wire transfer instruction, a password reset link. It requires no exploit and no elevated privilege. It requires a user clicking install, and an IT policy that treats the browser as out of scope.
Layer that with Bleeping Computer's piece of 29 October on the three ways AI agents already operate in your browser. Every one of those agents inherits the user's session cookies, and the session cookie is the strongest authenticator most organisations have deployed widely.
The old argument was that credential theft needs malware. Extensions with declared permissions can read the session. An agent with the same permissions can act on it. Neither trips an endpoint alert tuned to detect a process dropping a binary.
Two pieces of network infrastructure that should have been patched already
Cisco warned on 29 October, per Bleeping Computer, of a new firewall zero-day exploited to crash SSL VPN devices. A crash is denial of remote access for the workforce, and may be more than that. The fix timeline belongs to the vendor, so the only thing within your control this week is knowing which of your appliances are internet-facing, which are past end of support, and whether anyone can tell you without opening three spreadsheets.
CISA's warning on the Fragnesia Linux flaw, chained in PHP2Shell attacks, reported by Bleeping Computer on 29 October, is the sharper one for most enterprises. PHP is still the substrate of a huge amount of internal tooling written by people who have since left. Chains matter more than single flaws because the first step is often a boring configuration weakness rather than a CVE. CISA added two further known exploited vulnerabilities to the catalog on 28 October, which sets the federal remediation clock and, more usefully, gives you a defensible list to hand to the infrastructure team.
The OT side of the file carries three CISA adversarial advisories from 28 October: Hitachi Energy CoreTec, Hitachi Energy's TRO600 series and the Siemens Mendix SAML Module. The last deserves a second read in enterprises that think of themselves as IT-only, because Mendix is how business applications get built outside the application team, and a SAML module in a low-code platform sits directly in the authentication path.
Breaches where the number is not the story
Sony's ISP subsidiary exposed 2.5 million customer records, reported by Bleeping Computer on 28 October. Regulator and press will focus on the count. The operational question is which subsidiary held the data, under which entity's contract, with which notification obligation, and whether the group's incident response playbook covers an entity that is legally separate and operationally thin.
Summit Public Schools lost 115 GB of student and staff data, per Hackread on 28 October. Education keeps appearing on this list because the data is unusually sensitive, the budgets unusually small and the retention policies unusually old. If you sit on a board with a school or supply one, that is a conversation worth having while it is not urgent.
The federal bankruptcy courts contractor told The Record on 29 October that no data was stolen during its intrusion. Believe the statement when the forensics are published. Until then, the useful fact is that a downstream contractor of a court system was reachable, and the courts depend on it. Third-party risk is not a register. It is a question about what the contractor can reach, and the answer is usually more than the contract describes.
The University of New Mexico restored hospital systems and urged staff not to contact the hackers, per The Record on 29 October. The instruction is correct and nearly impossible to enforce without telling staff in advance what to do with an approach, and who to tell, in words they will remember under pressure.
Governments keep demonstrating the same weakness
A cyberattack disrupted Belgian tax services days before a filing deadline, reported by The Record on 29 October. The timing is not luck. Anyone who can read a calendar knows when a revenue authority is least able to absorb downtime, and the same is true of your financial close, your regulatory submission dates, and your peak trading period. Attackers plan around your calendar more reliably than you do.
The FTC is to probe major companies over personalised pricing and pay, per The Record on 29 October. That is a data governance question more than a security one, but it lands in the same place. If your organisation prices individually, the model inputs are personal data and the security review should treat them as such.
An appellate court also struck down a West Virginia law barring disclosure of public officials' personal data, per The Record on 28 October. Whatever you think of the policy, exposure of public-facing personal data now has fewer legal shields in some jurisdictions, not more.
Discord will let search engines index public server messages, per Bleeping Computer on 28 October. The control is trivial and almost nobody has done it: find out whether your organisation has a public Discord server, whether support or community staff discuss customer cases in it, and whether any of that contains identifiers. If the answer is uncomfortable, fix it before the indexing begins rather than after.
Law enforcement had a decent week. Virtualine, a bulletproof hosting service tied to ransomware and cybercrime, was seized, per Bleeping Computer on 28 October. Artem Stryzhak, a Ukrainian affiliate of Nefilim and Hive, was jailed for 70 months, per Hackread on 29 October. Sentences and seizures disrupt, but they do not reduce the number of people willing to buy access. They change the price for a few months.
What the security industry keeps saying to itself
Dark Reading's piece of 29 October, "Threat Modeling With 4 Simple Questions on a White Board", is the best management advice in the file. Four questions, no tooling, no maturity model. Most organisations can answer the first and stall on the second, which is the point of the exercise.
Hackread's "From Rules to AI and Back", published 28 October, describes the correction the industry is making. Detection engineering spent a decade moving from hand-written rules to machine learning and is rediscovering that rules are auditable, explainable and cheap to test. A detection you cannot explain is a detection you cannot defend in an incident review.
There is also the ADEX finding, reported by Hackread on 29 October, that AI is involved in 52 per cent of detected ad fraud schemes and that shopping agents may be the next target. If your organisation runs agentic purchasing, the manipulation surface is the product listing and the review text, not your network perimeter. Worth knowing before finance asks.
And "AI Takes Root in Hospital Corridors", from Dark Reading on 28 October, gives the clinical version of the same argument. A security failure in a care setting moves from data loss to patient harm. That transfers to any safety-adjacent deployment, and security leaders in those sectors should be making the argument themselves rather than waiting for the regulator to.
What to do this week
Name an owner for AI tooling, and give that person the authority to say no. Inventory every AI coding assistant, browser extension and desktop client in use, including the ones installed without a ticket. You cannot govern what you have not listed, and the listing will take a week.
Block the relay services. Any tool that requires you to disable the vendor's sandbox, or routes model traffic through an intermediate the vendor does not operate, comes out of the environment until someone senior signs it back in with a written rationale.
Treat browser extensions as software. Allowlist them, review permissions at install, and re-review when they change hands. The 13.4 million installs in this week's file were not malicious at release. That is the failure mode: legitimate extension, new owner, new purpose.
Patch the internet-facing appliances. Confirm the Cisco SSL VPN estate is on supported firmware, apply the Fragnesia mitigation, and reconcile your asset list with the KEV catalog rather than trusting last quarter's scan.
Write down what happens when a member of staff is approached by an attacker, before it happens. The New Mexico instruction was right, but it needs to be known in advance and rehearsed, or it will be ignored at the moment it matters.
Read your subsidiary and contractor boundaries for notification obligations. Sony's 2.5 million records and the bankruptcy courts intrusion are the same lesson from opposite directions: the entity that holds the data is not always the entity with the playbook.
None of that requires a new platform. All of it requires someone with a name to have looked at the tools everyone else assumed were safe.
Market moves
IonQ agrees to acquire Elisity (up to $1.3B, 12 October 2026)
IonQ, a Nasdaq-listed quantum computing company, has agreed to buy Elisity, which sells identity-based microsegmentation for enterprise networks, in an all-stock deal worth up to $1.3 billion, closing expected in the fourth quarter of 2026. The plan is to put Elisity's policy enforcement next to IonQ's post-quantum cryptography work. IonQ announcement.
If you're a customer: your microsegmentation vendor is about to be owned by a company that sells quantum hardware, not network security. Elisity's roadmap was already shifting toward cryptographic inventory and risk data, which tells you where the next release goes. Ask now what happens to your renewal terms, whether the IdentityGraph roadmap holds, and whether pricing becomes a lever for IonQ's government and post-quantum buyers. The CEO staying on is a good sign, but the buyer's share price fell on the news and it then raised $2 billion in equity. A heavily diluted acquirer with an unprofitable parent is a different kind of counterparty at renewal than a security specialist was. Get a written commitment to support terms longer than your standard three-year cycle.
Vista Equity Partners acquires HID's PKI business unit (undisclosed, 16 October 2026)
HID, an ASSA ABLOY brand, has agreed to sell its PKI business unit to Vista Equity Partners, with closing expected in the fourth quarter of 2026. The unit covers public and private certificate issuance, self-service SSL certificates and on-premise credential and smart card lifecycle management, and it carries roughly $50-60 million of annual sales drawn from ActiveIdentity, IdenTrust, ZeroSSL and Hydrant ID. HID and Vista announcement.
If you're a customer: this is a carve-out, so every contract, support agreement and account team has to be novated to a new legal entity. The press release says business as usual, and carve-outs do usually honour that, but you should not rely on a sentence in a press release. Find out which entity will hold your certificate authority contracts, whether your IdenTrust or Hydrant ID certificates will be reissued under a new root, and what the transition services agreement with ASSA ABLOY covers for on-premise smart card tooling, which is the part most likely to be stranded. Vista's model is disciplined pricing growth, so expect renewal uplifts in year two. Check whether your certificate lifecycle automation depends on an HID integration that will not survive the split.
Proofpoint to acquire Varonis ($6.3B, 20 October 2026)
Thoma Bravo-owned Proofpoint has signed a definitive agreement to buy Varonis, a listed data security company, for approximately $6.3 billion in cash, roughly $49.75 per share. The companies expect to close in the first half of 2027, subject to approvals. Proofpoint announcement.
If you're a customer: you are now on the wrong side of two private equity roll-ups at once. Varonis goes from a public company to a portfolio asset inside a Thoma Bravo platform, which means less transparency on roadmap and results and more leverage for the buyer at renewal. Proofpoint's own statement says plans will only be shared after close, so any roadmap commitment you are given before mid-2027 is not worth the paper. Run a joint inventory now if you buy both, because the overlaps in DSPM, DLP and insider risk are exactly where licences get repriced into bundles. If you are a Varonis customer with a multi-year deal ending in 2027, that renewal will be negotiated by a team under new ownership with a debt to service. Get your data portability and exit terms reviewed before the deal closes, not after.
Workday to acquire C1.ai (undisclosed, 13 October 2026)
Workday has signed a definitive agreement to acquire C1.ai, formerly ConductorOne, an identity governance platform for employees and AI agents, with closing expected by 31 January 2027. Workday announcement.
If you're a customer: an independent identity governance vendor has just been absorbed by an HR and finance system. As a C1.ai customer you now face a choice between being migrated onto Workday's agent system of record and staying on a platform whose roadmap is written for Workday's customers, not yours. If you do not run Workday, ask hard questions about connector support and whether standalone renewal will still be offered in 2028, because the acquisition logic is to make identity governance a reason to buy Workday. As a Workday customer, expect IGA to appear in your renewal as a bundled line item rather than a separate procurement, which is cheaper per head but harder to replace later once joiner, mover and leaver processes depend on it. Either way, contract terms for your identity data leaving the platform are worth checking before the deal closes.