Week in Review: Five Times This Week the Control Worked Fine and the Label, the Ceremony or the Boundary Around It Did Not
- Patrick Duggan
- 5 hours ago
- 7 min read
Every so often a week's findings rhyme, and this one rhymed hard enough to be worth naming.
Five separate stories, five different vendors, five different technologies. In not one of them did the security control fail. WebAuthn's cryptography held. V8's isolation held. Zimbra's patch worked. Microsoft's classifiers did what classifiers do. What failed, every single time, was something around the control — the identifier that lets your tooling name it, the ceremony that provisions it, or the small piece of glue at its boundary.
That is a different problem from the one most security programmes are built to solve, and it is worth twenty minutes of your week.
1. The label failed: TrueConf, and the nine days that followed
On August 11 we published a post about a 9.8 unauthenticated RCE in TrueConf Server that had been exploited since September and had no CVE. The identifiers existed — they lived in a Russian registry that Western scanners do not speak. Our argument was simple: a bug your tooling cannot name is a bug your tooling cannot find, and the labelling failure is the story.
On August 20, CISA added [CVE-2026-72529](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-72529) and [CVE-2026-72530](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-72530) to the Known Exploited Vulnerabilities catalogue. Both TrueConf Server. Both exactly the class we described.
Comparator stated side by side, the way we insist on doing it: ours August 11, CISA August 20 — a nine-day gap, on our own analysis of a public patch and a foreign registry, not on somebody else's research we re-dated. That is what a defensible lead looks like here, and it is worth being precise about what kind of lead it is: not a detection scoop, an analysis one. We read a registry other people ignore. Anybody could have. Nobody did.
2. The label failed again, twice more, in five weeks
Today we published on GHSA-864f-rcv7-6rh4 — a type confusion in isolated-vm, the Node.js library people migrated to after vm2 spent years being escaped in public. Sandboxed code corrupts host memory; the researchers escalated it to hijacking the host's control flow. Every version through 7.0.0 affected, fixed in 6.2.0 and 7.0.1, roughly a million downloads a week, and no CVE assigned.
That makes four data points in five weeks on the same seam:
Date | Product | Identifier |
Jul 27 | n8n sandbox escape around a February patch | GHSA-gv7g-jm28-cr3m — no CVE |
Aug 11 | TrueConf 9.8 unauth RCE, exploited since September | BDU-only — no CVE, then CVEs on Aug 20 |
Aug 19 | MLflow SSRF, the AI control plane | CVE-2026-64849 — CISA KEV |
Aug 20 | isolated-vm host-RCE escape | GHSA-864f-rcv7-6rh4 — no CVE |
Read the pattern rather than the rows: the infrastructure layer underneath AI systems is being found faster than it is being labelled. Your SBOM tooling keys on CVE. Your ticket workflow has a field called CVE. Your patch SLA is written in CVSS, and CVSS attaches to CVEs. A GHSA with no CVE flows through part of that plumbing and falls out of the rest — which is why, a month later, nobody can answer "were we exposed?" from the system of record.
That is a plumbing problem, and plumbing problems are fixable in an afternoon. Wire the advisory feed into the same queue as everything else.
3. The ceremony failed: passkeys
A $10,000 toolkit called iAuthFlow V2, analysed by Abnormal Security, does not break WebAuthn. It never touches the private key, never forges an attestation, never defeats origin binding. It waits for you to authenticate successfully, then uses that session to enroll a passkey of its own — reportedly about six seconds after login.
Then you reset the password. Then you revoke sessions. The attacker's credential is still there, because a passkey is not governed by a password and was not derived from a session.
The finding that makes this structural rather than a single product bug: a Cornell study in the same month described the identical gap being used to backdoor accounts past password resets in intimate-partner abuse. Different researchers, different motive, entirely different threat model, same seam — enrollment is a privileged action gated only by an authenticated session, and account recovery was never modelled as an attack surface.
The operational change is one sentence: containment is no longer about revoking what the attacker took, it is about auditing what the attacker added. And the six seconds that defeat your runbook also emit a log line — alerting on "passkey added" is cheap, quiet, and almost nobody has turned it on.
4. The defence and the attack surface were the same component: Copilot
Håkon Måløy's Copilot for Word worm has now survived 144 days, at least two Microsoft fixes, and a full model upgrade to GPT-5.5 — which he defeated the day after it shipped. Hidden white-on-white instructions in a source document are read by Copilot as operator instructions; it tampers with the output (his demo silently halves financial figures, which is worse than deleting them because it survives review) and re-embeds itself into the generated document. The next person who uses that document as source material arms the next one.
No macro. No executable. No C2. Nothing to hash.
Måløy's own explanation of why the patches keep losing is the most important sentence anyone published this week: a model has to read untrusted content in order to judge whether that content is safe. The classifier is a model. It ingests the hostile text to rule on it. The defence and the attack surface are the same component, so every fix that teaches the model to spot bad prompts loses to a rewording — which is exactly the loop he documented four times.
Our standing position on this beat is that the interesting question is never does injection work, it is which agent held — and we report that flat in both directions. On August 2 we named three coding agents that did not hold, including one built by a company we work alongside every day. Here, there is not even a boundary to draw. The assistant's whole job is to read the document.
5. The conditional failed: Zimbra
[CVE-2026-73570](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-73570), CVSS 8.9, unauthenticated OS command injection. Zimbra shipped the fix on July 20. CERT Polska confirmed active exploitation this week. CISA added it to KEV on August 21 with a federal deadline of August 24 — tomorrow, as this publishes.
Thirty-four days between the patch and the confirmation. And the exposure notice is a trap: the bug needs the optional zimbra-snmp package installed, snmp_notify enabled, and the swatchdog service running. Two of those read as "only if you chose SNMP." The third is enabled by default. An administrator answering from memory at 4pm on a Friday gets this wrong, which is precisely the population — self-hosted mail, no security team, slow patch cycle — that attackers price in.
CERT Polska's detection guidance is free and runnable tonight: check /var/log/zimbra.log for service restarts nobody scheduled, and look for files created in the last 30 days in the two Jetty webapps directories and /tmp.
What we got wrong this week
We enumerate these because a review that only lists wins is marketing, and because the failures are usually more useful than the finds.
Our own morning brief said there were zero gaps this morning. There were four. The self-hosted sweep runs on our infrastructure at 12:10 UTC, correlates each headline against our corpus, and today it graded all ten items as covered. It even flagged its own result — it prints a saturation warning that says, in effect, zero gaps is a claim, not a result, go spot-check two receipts. Good instrument. But the matcher had demoted the Copilot worm, the passkey kit and the isolated-vm escape to "related" on bare vendor-name matches — we publish about Microsoft and npm constantly, so a Microsoft match proves nothing about this Microsoft story. Four real gaps, reported as none. The fix is a stricter demotion rule for tokens that are common in our own corpus; the lesson is the older one, that green is a claim, not evidence.
Three posts went out today with no cover image. Our publisher generates a cover from a cover_prompt: line in the frontmatter. Leave that line out and it ships bare — no warning, no error, exit code zero. A silent default is a bug even when it is technically correct behaviour. Fixed, covers backfilled, and the rule now says to verify the cover by reading the live page rather than trusting the publish log.
And we finally removed a foot-gun we had already written a rule about. There were two blog publishers in the tree. One attaches the reader-feedback widget every post points at; the other does not, and quietly ships posts that cannot collect the feedback they ask for. Writing a rule saying "use the good one" did not stop the wrong one being picked up. Renaming the file to something nobody can select by accident did. When a rule keeps getting violated, the fix is usually not a louder rule.
The through-line, if you take one thing
Look at where each failure actually sat. Not in the cryptography, the isolation, the patch or the classifier — those did their jobs. It sat in the identifier (no CVE, so no ticket), the ceremony (enrollment, gated only by a session), the native glue at the boundary (the one memory-unsafe component every safe-language sandbox needs), and the conditional notice (three ANDs, one of them default-on).
Those are all edges. Security programmes are organised around components, and the components are mostly fine. This week the whole industry's bad news lived in the seams between them.
Capped where we always cap it at 95 percent: the isolated-vm flaw has no public exploitation as of writing, the iAuthFlow analysis rests on seller demonstrations rather than a captured sample, and we hold no first-party telemetry on the Zimbra campaign — CERT Polska found that, and the credit is theirs.
If one of these five lands in your environment this week — a GHSA with no CVE that your scanner never queued, a passkey nobody remembers enrolling, a Jetty directory with a file in it — I would genuinely like to hear how it went, including the boring outcome where you looked and everything was clean. Clean results almost never get published and they are half the data. Rate this post below.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=week-in-review-five-times-this-week-the-control-worked-fine-and-the-label-the-ceremony-or-the-boun
Comments