Welcome to The Cybersecurity Pulse (TCP)! I’m Andrew Richards, a security practitioner working at the intersection of AI security, operations, and governance at Tennessee Valley Authority. I’ll be partnering with Darwin to bring you my perspective on the security developments, emerging technology, and industry news worth paying attention to. Subscribe to receive the latest updates! 📧
Howdy! 👋🏽
This is Andrew filling in for Darwin who just celebrated his 30th birthday~! On the personal front, my $dayjob has been keeping me busy at the forefront of AI governance. As you can imagine, it’s a handful and a lot of whiplash.
Aside from that, it’s been a rough week for AI infrastructure. Fireworks AI got hacked, and the fallout is still spreading. OpenAI’s AI found 948 paths to root in Linux, and a Chinese open-weight model came close in performance to a restricted frontier model on offensive tasks. Finding bugs is getting cheap. Fixing them isn’t.
I’ve also been contributing to AISECA, our open-source AI security initiative, and I’m sharing some of that work below.
Cool, let’s get into it!
Prepare your team for the threats targeting their work
The attacks targeting your finance team may look different from those targeting HR or IT. Adaptive Security combines AI-native security awareness training with realistic phishing simulations tailored to employees’ roles, risks, and company policies. Give your team practice recognizing impersonation, verifying payment requests, and reporting suspicious messages. Turn real-world threats and your own policies into interactive lessons that prepare employees to respond confidently when it matters.
🗞️ TLDR
💬 Fireworks breach reaches Notion: AI chat transcripts were exposed; Notion disconnected Fireworks and disabled Insights.
🛠️ N-central taken offline: N-able shut hosted environments and urged on-prem shutdowns after disclosure of 33 alleged zero-days.
🐛 sshole bypasses SSH authentication: An actively exploited OpenSSH flaw allows authentication bypass on certain musl-based systems without PAM.
🐧 OpenAI produces 948 exploits: Its pipeline generated working local privilege-escalation exploits on Linux for about $1.21M in API credits.
🧰 Claude expands security controls: Inference hooks reach GA; security center and detection-only local Cowork EDR launch in beta.
👀 Palo Alto acquisition talks: Reported talks involve Clutch for roughly $500M and a separate potential deal for Beacon.
💰 Daylight raises $80M: Goldman Sachs Alternatives led the Series B for AI-assisted MDR, with Okta Ventures participating.
🤝 Vanta signs for Pillar: The acquisition adds AI security technology, with integrated runtime enforcement planned for summer 2027.
💾 Dreeze unveils $33M seed: Zerto veterans launch cloud application recovery; AWS is GA, Azure remains in early access.
Plus: a password-checking edge case, a researcher’s explanation for an unintended intrusion, and a media-server cleanup that takes more than a patch.
🔥 Picks of the Week
Fireworks breach exposes Notion AI chat transcripts
Fireworks expanded its October breach disclosure on November 9. Attackers accessed account and billing information, plus secrets, datasets, and incomplete model weights for some customers. Fireworks also disclosed further activity: a cloud provider was breached on October 23, giving the attacker a route into its development machines the next day.
Notion says the incident affected fewer than 1% of workspaces. Fireworks initially identified synthetic test data, then confirmed a separate dataset containing AI chat transcripts used by Notion’s Insights feature. Most lacked user or workspace labels, but the text itself could still contain identifying or sensitive information.
Notion disconnected Fireworks, disabled Insights, and stopped serving open-weight models through the provider. Affected customers can review their exposed data and should rotate credentials pasted into those chats.
Fireworks says it has found no impact to its Inference, Training SDK, or Nexus services, which default to zero data retention. That assurance has a specific scope: customer data held in other datasets was still exposed.
Nvidia investigates alleged spying targeting Jensen Huang
Nvidia’s board opened an independent investigation on November 8 into reports that CEO Jensen Huang was targeted by a foreign intelligence operation. Independent directors and outside counsel will oversee the review.
Reuters reports that Huang acknowledged an affair. The investigation follows reporting linking the woman involved to Chinese intelligence.
The board says it has no reason to believe Nvidia’s secrets or national security were compromised. Huang has committed to cooperating, and the board continues to support his leadership.
This is a very loaded story that is still unfolding, but my biggest takeaway is that AI trade secrets are one of the highest forms of currency today. Even more valuable than money or gold. Security teams must keep this front of mind esp. those working at frontier model labs and any layer of the AI stack (i.e, inference, laser, data centers etc.)
Your vendor’s vendor is your problem, too
A clean vendor review from last year only tells me so much. Employees connect approved apps to other critical systems, AI agents get enabled, and vendors add subprocessors or change privacy policies. Fireworks showed how far that chain can extend: attackers reached its development machines through a compromised cloud provider. Your vendor’s vendor can be the breach path, too.
Nudge Security’s adaptive risk management keeps recalculating SaaS and AI risk as those conditions change. It uses more than 30 factors, including how widely an app is used, what it connects to, which agents can act through it, vendor breach history, and controls like SSO and MFA. For each app, it also lists the control gaps and prioritizes them by how much fixing them could reduce risk.
Paid partnership with Nudge Security.
sshole turns a password-checking error into an authentication bypass
OpenSSH’s CVE-2026-123158 affects certain Linux systems using musl without PAM. With password authentication enabled and specific account configurations, a long password can authenticate to an account whose password field is *. It does not affect every OpenSSH installation.
Researcher Özgün Kültekin explains how an error return from crypt() can match that supposedly unusable password field. CISA added it to KEV on November 9. On affected Alpine cloud configurations, passwordless doas can turn that access into root.
Install OpenSSH 10.6p2 or the distro fix and restart sshd.
OpenAI produces 948 working Linux privilege-escalation exploits
OpenAI says an autonomous research pipeline reproduced 1,724 Linux kernel vulnerabilities and produced 948 working local privilege-escalation exploits in an October run. The reported API bill was about $1.21M.
The pipeline scanned code, reproduced findings in isolated environments, tested exploitability, and generated candidate patches. Human researchers then reviewed the outputs and prioritized reports to maintainers. The main targets used a stock desktop OS, rather than a deliberately weakened challenge environment.
These are local privilege-escalation exploits: an attacker needs a foothold before using them. The results apply to the configurations tested.
Patching was already moving during the research. By the end of the ten-day run, 61 of the identified privilege-escalation bugs had been patched upstream, 43 had staging patches, and 299 were being discussed publicly.
AISECA offers a starting point for AI security
One challenge I’ve encountered in AI governance is figuring out what good AI security actually looks like. There’s plenty of guidance, but translating it into specific risks, controls, and priorities isn’t always straightforward.
That’s part of what drew me to AISECA (AI Security Alliance), a practitioner-led, vendor-agnostic open-source initiative I’ve had the opportunity to contribute to alongside other security professionals. The framework organizes AI-specific risks, including prompt injection, data leakage, and unsafe agent behavior, into progressive maturity tiers. For me, its value has been a starting point for evaluating risks, not a requirement to implement every control.
AISECA also offers a free, anonymous interactive assessment, with no registration required, to identify applicable risks and prioritize improvements.
DeepSeek narrows the offensive AI gap in enterprise-network tests
Vals AI found that DeepSeek V4.1 Flash completed about 73% of objectives across two simulated enterprise networks, versus 81% for OpenAI’s restricted-access GPT-6 Sol Daybreak. On the harder Lighthouse range, Daybreak completed 27 of 31 objectives; DeepSeek completed 21.
These were multi-step intrusion exercises involving exploitation, credential theft, and lateral movement. Vals scored recovered objective markers, rather than accepting the agents’ claims of success. Both ranges were controlled environments, not observed attacks on businesses.
DeepSeek’s weights can be downloaded and run locally, putting a capable offensive model within reach without admission to a restricted cyber program. A local deployment also sits outside the provider-side monitoring and access revocation available through a hosted API.
🧪 Threats & Research
SAP fixes four CVSS 10.0 flaws, including ICM2SHELL
SAP released 35 new security notes, including four CVSS 10.0 flaws. Onapsis demonstrated unauthenticated RCE through WebSocket reassembly in ICM and Web Dispatcher: ICM2SHELL, CVE-2026-76964 and CVE-2026-89126. Commands run as <sid>adm, the account owning the SAP installation.
The other 10.0s affect SAP Gateway and the SAML2 service provider. Onapsis had not observed ICM2SHELL exploitation in the wild. Prioritize exposed ICMs and Web Dispatchers, checking the latter separately from their backends. The advisory lists fixed kernel patch levels, including exceptions where a numerically higher build remains vulnerable.
Able2Shell prompts a worldwide N-central shutdown
N-able took hosted N-central offline and told on-premises customers to shut their servers down after researcher Sean Bales published 33 alleged zero-days on November 8.
The Able2Shell research describes authentication bypasses, credential theft, and chains leading to RCE or root. One chain abuses XML external entity processing to steal a trusted session, create an administrator account, and execute commands. The researcher tested N-central Appliance 2026.4.0.31; the full affected-version range was not yet vendor-confirmed.
N-central is an RMM platform. Compromising it can give an attacker a route to the customer systems an MSP manages, not just the management server.
N-able said it had found no evidence of active exploitation in its environments. Follow its restoration guidance, and review authentication activity from November 8 onward for unexpected access.
Barracuda confirms exploitation of an ESG root-access chain
Barracuda says attackers have exploited two flaws against a small number of organizations. On Email Security Gateway, chaining CVE-2026-116606 with CVE-2026-111560 can bypass authorization and execute commands as root.
The attacker must be able to reach the Admin UI, but does not need valid credentials for the first step. The command-injection flaw also affects five other Barracuda product lines; those do not share ESG’s pre-auth bypass. Verify that the November 2 patches actually reached each appliance. Outdated firmware can require multiple updates, and disabled automatic patching requires manual remediation.
WorkOS attributes its breach to a researcher’s unintended AI intrusion
An update to our TCP 152 coverage: WorkOS says a researcher running ARTEX accepted responsibility for the intrusion, describing an agent that escaped its test environment. WorkOS and an independent forensics firm matched the researcher’s evidence to the incident.
The breached internal tool had internet-exposed APIs, a predictable development credential in production, no rate limits, and detection gaps. Customer sales and support data was retrieved. The researcher says it was deleted and not shared.
WorkOS published indicators and remediation details. It has not disclosed the technical mechanism behind the reported sandbox escape.
Plex2Shell cleanup requires more than installing the update
QNAP warns that four Plex Media Server flaws are being chained for unauthenticated RCE, with compromised servers running miners and proxy software. The vulnerabilities are in Plex, not QTS or QuTS hero.
Update to 1.43.3.10861 or later. If an affected Plex instance was internet-accessible, QNAP says to treat the NAS as potentially compromised. Its cleanup guide covers preserving logs, reinstalling Plex, checking persistence, signing out Plex sessions, and resetting credentials. Updating closes the entry point; it does not remove an attacker’s existing files.
🛠️ Security Products, Tools & Programs
Claude makes inference hooks GA and adds EDR inside Cowork
Anthropic’s prompt and pre-tool-call hooks are now generally available, connecting supported Claude products to an organization’s security tools before prompts or tool calls proceed.
The new security center compares settings with Anthropic’s recommendations, but remains in beta. So does EDR integration inside the local Cowork VM on macOS and Windows. Supported sensors report to the organization’s existing EDR console and run in detection mode only. They do not block activity, and this integration does not cover cloud Cowork sessions.
Sysdig combines agent context with kernel-level runtime evidence
Sysdig AI Defense is now generally available. It instruments agent harnesses to capture tools, MCP calls, arguments, and targets, then pairs that context with kernel-level activity across endpoints and cloud environments.
Policies can alert, hold actions for review, or block them. Sysdig also records the session, the authority used, and the policy decision. The useful distinction is between what the agent said it intended to do and which processes actually ran. Policies start in alert mode before a team moves them into enforcement.
AWS adds Nitro isolation for individual pods and tasks
AWS Nitro Sandboxes give individual EKS pods, ECS tasks, and EC2 workloads their own lightweight VM under the Nitro Hypervisor. Multiple untrusted workloads can share one EC2 instance with separate hardware-backed isolation boundaries.
AWS says the feature is available on most Nitro-based instances in all commercial regions, at no additional charge. Cryptographic attestation can gate secret release on a sandbox proving its integrity. This provides workload isolation; it does not decide whether an agent’s otherwise permitted API call or data access is appropriate.
Teleport Beams adds delegated identity to isolated agent runtimes
Teleport Beams is generally available after a March public beta. Agents start without standing privileges, propose an execution plan, and receive only approved roles after review by a human or an LLM judge. A separate runtime executes the approved work.
Beams connects to infrastructure without placing reusable secrets in the agent environment. Ephemeral micro-VMs provide network controls, while model and protocol traces support investigation. The delegated identity and approval workflow determine what an agent can reach; VM isolation contains the environment where it runs.
💰 Industry, Funding & M&A
Vanta signs a deal for Pillar, with enforcement planned for 2027
Vanta signed a definitive agreement to acquire Pillar Security. Calcalist reports a roughly $150M cash-and-stock deal; Vanta did not disclose terms.
The plan connects Pillar’s AI testing and runtime controls with Vanta’s governance context and audit evidence. The integration has a schedule: inventory and runtime monitoring in January 2027, red teaming in spring, and runtime enforcement in summer. The paid AI Governance offering is due in January.
Daylight raises an $80M Series B for AI-assisted MDR
Daylight raised an $80M Series B led by Growth Equity at Goldman Sachs Alternatives, with Okta Ventures participating.
The round brings total funding to $120M. Daylight pairs AI agents with security engineers, offering fully managed operations, co-managed delivery, or forward-deployed engineering support. The agents handle routine detection and response work while engineers handle decisions requiring human judgment. Daylight also investigates AI activity alongside identity, endpoint, cloud, and SaaS telemetry. Funding will support hiring, product development, and expansion across the U.S., EMEA, and APAC.
Bay launches with $50M for agent discovery and runtime enforcement
Bay emerged from stealth with $50M across two rounds:
Series A: $37M, led by Battery Ventures.
Seed: $13M, co-led by YL Ventures and Striker Venture Partners, previously undisclosed.
Bay combines agent discovery, posture management, session visibility, and runtime enforcement across endpoints, cloud infrastructure, and SaaS. It says it evaluates proposed actions locally with context from the full session, without an additional persistent endpoint agent or network proxy. The product is available now; the funding will expand engineering and commercial teams.
Dreeze announces $33M seed for cloud application recovery
Dreeze emerged from stealth with $33M in seed funding, co-led by Norwest and Bessemer Venture Partners, with Claltech participating.
Its Application Revival platform maps dependencies, backs up data and supporting resources, and rebuilds infrastructure, configurations, identities, and connections in dependency order. Recovery tests check whether the application actually comes back online, including the resources a data restore alone can miss.
The platform is generally available on AWS. Azure remains in early access, with GA planned for early 2027.
WhiteMatter raises $20M for its Guardian-agent approach
WhiteMatter, formerly QuilrAI, raised a $20M Series A led by Blumberg Capital, with Crew Capital and Sprout & Oak participating.
The platform combines pre-deployment governance with runtime controls. Its stated approach pairs enterprise agents with dedicated Guardian agents that enforce policy on their actions, provisioning additional Guardians as new agents appear. WhiteMatter also routes AI traffic through a controlled gateway. The funding supports research, development, and commercial expansion. The company is based in San Francisco and Austin.
Cogent adds Specular’s external attack validation
Cogent announced an agreement to acquire Specular, whose AI agents probe internet-facing assets and validate exploitable attack paths. Terms were not disclosed.
Cogent already combines vulnerability findings with internal asset context and remediation workflows. Specular adds an outside view: which exposed weaknesses an attacker can actually reach and exploit. Founder Peyton Smith, formerly a red team leader at CrowdStrike, will join as head of offensive security. The intended workflow connects external validation to prioritization and remediation in the same platform.
Palo Alto reportedly pursues Clutch and Beacon
Palo Alto Networks is reportedly in talks to acquire Clutch Security for roughly $500M. Clutch focuses on non-human identities and the credentials agents use to reach enterprise systems.
Calcalist separately reports talks for Beacon Security, which brings security data and context into agent-driven investigation and response. No price was disclosed for Beacon. Both stories concern negotiations, not announced acquisitions; the targets address different problems despite sharing the AI-security label.
Cyera reportedly targets a $20B valuation
Cyera is in advanced talks to raise roughly $800M, according to Calcalist.
The proposed valuation is about $20B.
That compares with $12B in June. Calcalist says September’s investment extended that earlier round. Cyera has not announced the new financing.
Interested in sponsoring TCP?
Sponsoring TCP not only helps me continue to bring you the latest in security innovation, but it also connects you to a dedicated audience of 20,000+ CISOs, practitioners, founders, and investors across 135+ countries 🌎
Disclaimer
The insights, opinions, and analyses shared in The Cybersecurity Pulse are my own and do not represent the views or positions of my employer or any affiliated organizations. This newsletter is for informational purposes only and should not be construed as financial, legal, security, or investment advice.