Three stories today and they rhyme: the tools you installed to stay safe, the pipeline you trust to ship code, and the agent you handed the keys to are all getting turned back on you. The attack surface isn't the perimeter anymore. It's the stuff inside the perimeter you stopped questioning.
FortiBleed is locking admins out of their own firewalls
The device at the edge of your network is now the foothold. The FBI and U.S. Secret Service are warning that FortiBleed, a credential-harvesting campaign against Fortinet firewalls, has compromised 86,644 devices and is locking out administrators. What makes it ugly is the follow-through: attackers are creating new accounts and deleting existing accounts and passwords to prevent legitimate access — so the box that's supposed to keep intruders out is being used to keep you out.
The operator's take: a security appliance is still software, and a firewall with a public management interface is just an internet-facing server with extra privileges. Two moves tonight: get management planes off the public internet and behind a VPN or allowlist, and treat your edge gear as in-scope for the same credential rotation and MFA you demand everywhere else. And build the muscle for the worst case now — if an attacker nukes the admin accounts, do you have out-of-band console access and a known-good config to restore from, or are you locked out of your own border?
The npm supply chain worm is back
If FortiBleed is the front door, this is the delivery truck you already waved through. Researchers say the Shai-Hulud worm has resurfaced inside npm: the Tensorlake package, version 0.5.144, shipped obfuscated malware that harvests credentials and executes remotely supplied code. The detail that should worry every engineering leader is the provenance — StepSecurity reported the first rogue commit reached the project on October 7, 2026 under a maintainer's name, meaning it came through the project's own release pipeline, complete with faked workflow names designed to look routine.
The operator's take: your dependency tree is a trust decision you make hundreds of times a day without noticing. A compromised maintainer account turns "pin to latest" from convenience into a loaded gun. Pin versions, require integrity hashes, and don't let CI auto-pull new releases the moment they publish — add a cooling-off window and provenance checks before a new version touches a build that can reach your secrets. And rotate any credential your build system can see, because a worm that harvests tokens doesn't stop at the machine it landed on.
AI coding agents fell at Pwn2Own
Now the part everyone is racing to adopt. At Pwn2Own, researchers compromised OpenAI Codex and LiteLLM, with a full-takeover chain on LiteLLM that combined SSRF with code injection earning a $40,000 bounty. The framing from the event is the real headline: LLM gateways and coding agents are now live attack surfaces, not hypothetical risk scenarios.
The operator's take: an AI gateway is a proxy that makes outbound calls and often runs code on your behalf — which is to say it's a textbook SSRF target wearing a friendly UI. If you've put an LLM router in front of your models or dropped a coding agent into your dev loop, it needs the same scrutiny as any other service that touches your network and your repos: locked-down egress, least-privilege credentials, no standing access to production, and logging you'd actually review. The convenience of "let the agent handle it" is exactly the convenience an attacker wants to inherit.
Also on my radar
- Oracle Health's breach keeps getting bigger. The Texas Attorney General disclosed that Oracle's healthcare division suffered a breach affecting nearly 20 million individuals, including Social Security numbers and medical records, with roughly 3 million Texas residents impacted — when your EHR vendor is the breach, your incident response is largely watching someone else's.
- China's compute is closing the gap. A SemiAnalysis model, by way of the Financial Times, puts China's operational AI compute at about 24GW against roughly 56GW in the US, with another 50GW planned or under construction across 1,000+ facilities — the buildout is a two-horse race now, and that shapes where capacity and pricing go next.
- Power and permits are the new bottleneck. Finland's permitting agency ordered Google's local subsidiary to suspend land-altering work at two data-center sites after hundreds of hectares were cleared without completed environmental reviews — the constraint on AI isn't just chips, it's the land, power, and politics underneath them.
The throughline: the industry spends like the frontier is where the action is, but today's losses all came from the trusted middle — the firewall, the package registry, the agent you gave a token to. None of those are exotic. They're the parts of the stack you stopped looking at because they were supposed to be on your side. Audit the things you trust most; that's where the next breach is already living. That's the Signal for today.
Paul Sapio is the CIO of Mikhail Education and a full-stack AI engineer. Open to contract work in security, networking, AI, and SaaS development — reach out.