One Week, Nine Flaws, No Easy Fix

The week's cybersecurity news, as compiled by SecurityWeek, spans a ransomware developer's prison term in Switzerland, a maximum-severity SAP vulnerability, and a zero-click flaw that allowed silent AI agent takeovers. Nine separate developments touched on cloud token defense, WordPress plugin exploitation, camera firmware, and a $35 million funding round for AI agent monitoring. The common thread is that attackers and defenders are both moving deeper into automated systems.

Ransomware Developer Gets 13 Years

A Zurich court sentenced a Ukrainian IT specialist to nearly 13 years in prison for developing ransomware used in extortion attacks on companies including Stadler Rail, according to SecurityWeek. The court identified him as the lead developer behind the Lockergoga, MegaCortex, and Nefilim ransomware families. It described his role as closer to a technical consultant than the operation's mastermind.

Prosecutors estimated total damages from the campaign at roughly $123 million. The verdict remains subject to appeal. The case is among the longer sentences handed down for ransomware development, though the court's characterization of the defendant's role differed from a leadership position.

The sentence reflects a judicial assessment that the defendant's technical contribution was central to the extortion operations, even if he did not direct them. The distinction between developer and organizer may matter in how the verdict is read by other courts handling similar cases.

A Maximum-Severity SAP Flaw

Organizations using SAP have been warned about CVE-2026-44756, a maximum-severity flaw in its Extended Passport processing code that lets unauthenticated attackers trigger memory corruption before any login check occurs. Onapsis discovered the vulnerability and dubbed it OVERPASS. Researchers from Pathlock and nullFaktor confirmed remote code execution is achievable over HTTP/HTTPS and NGRFC in lab testing.

SecurityWeek reported that public technical write-ups released within 48 hours of the patch lower the bar for exploit development. The bug touches a wide range of SAP products, including S/4HANA, NetWeaver, and Business Suite. SAP is urging emergency patching of internet-facing systems.

The memory corruption occurs in the Extended Passport processing path, which handles authentication assertions before login validation. Because the flaw is reachable before any credential check, an unauthenticated attacker on the network can trigger it. The affected products span SAP's core business application stack, making the patching scope broad.

Plugin4Shell and Silent AI Takeover

Researchers at Air's security lab disclosed Plugin4Shell, a zero-click flaw affecting Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. The flaw lets an attacker controlling a plugin's repository swap a pinned, reviewed commit for malicious code without tripping the SHA-pinning check.

Because the affected agents check out a requested commit without verifying what actually landed, an attacker can name a branch after the pinned hash so git resolves to it instead. Background auto-updates then push the malicious version to already-installed plugins with no user action, according to SecurityWeek.

Anthropic and OpenAI have shipped fixes for Claude Code and Codex. Microsoft has not yet patched Copilot. Google says the deprecated Gemini CLI will not be fixed at all. The disclosure highlights the supply-chain risk in plugin ecosystems where pinned commits are treated as immutable verification.

WordPress Plugin Fuels Webshell Uploads

Defiant says attackers have exploited a critical file-upload flaw in the WooCommerce Wholesale Lead Capture plugin, blocking more than 100,000 exploit attempts since the bug was disclosed in February. The flaw lets unauthenticated visitors bypass file-type checks and upload PHP webshells because the plugin trusts an attacker-supplied list of allowed extensions instead of its own configuration.

Site owners are urged to update to version 2.0.3.2 and check for suspicious PHP files, particularly in the uploads directory. The attack volume indicates automated exploitation, and the plugin's trust of client-supplied extension lists is the root cause.

The vulnerability is in the plugin's file-upload handler, which validates against an attacker-controlled allowlist rather than the server's own settings. That design choice enables unauthenticated visitors to upload executable PHP files. Defiant's telemetry shows the exploitation attempts have been sustained since February.

Cloud Token Theft Defenses Published

NIST and CISA have published a final joint report giving federal agencies and cloud providers implementation guidance for protecting the signed tokens and identity assertions that underpin single sign-on, federation, and API access. The report addresses token validation, secrets management, and detection at scale.

The guidance incorporates feedback gathered through CISA's Joint Cyber Defense Collaborative on an earlier draft. It builds on NIST's existing security and privacy controls guidance and supports Secure by Design principles, according to SecurityWeek. The focus on token validation reflects the role signed tokens play in cloud identity systems.

Tokens and identity assertions are the foundation of modern cloud authentication. When they are stolen or forged, single sign-on and federation trust models break down. The joint report aims to give agencies and providers concrete implementation steps for validation and secrets management.

Black Axe Extraditions and Bounty Hunter Twist

Five leaders of the Cape Town chapter of Nigeria's Black Axe crime syndicate have been extradited from South Africa to New Jersey to face wire fraud and money laundering conspiracy charges. Prosecutors say the group ran romance scams and advance-fee schemes against US victims from 2011 to 2021.

The defendants, arrested in South Africa in 2021, also face related wire fraud and identity theft counts tied to business email compromise. The extradition moves the case into US federal court, where the conspiracy charges carry substantial penalties.

Separately, CrowdStrike has tied an npm-based information stealer called PhantomRaven to a financially motivated actor who moonlights as a bug bounty hunter. The JavaScript malware, distributed through typosquatted npm packages, is assessed with high confidence to have been written by an LLM based on its verbose comments and placeholder code.

It harvests system details plus CI/CD environment variables from GitHub Actions, GitLab CI, Jenkins, and CircleCI. CrowdStrike found no evidence the stolen data is sold on criminal marketplaces, suggesting the operator uses it purely to flag compromises for bounty payouts.

TP-Link Camera Flaws Patched

OPSWAT researchers found two flaws in TP-Link's Tapo C200 security camera, including an authentication bypass that lets an attacker on the network replay a value from the camera's own challenge-response process to gain admin access without a password. A second bug allows a denial-of-service attack by sending oversized Wi-Fi credential data during device onboarding, crashing the camera's HTTPS service.

TP-Link fixed both issues, tracked as CVE-2026-15315 and CVE-2026-15316, in firmware V5_1.4.6 released in August. The authentication bypass is particularly notable because it does not require guessing credentials, only replaying a value the camera itself produced during the challenge-response handshake.

AI Agent Risks and Funding

Mandiant's latest AI Risk and Resilience report finds that attackers have moved from prompting AI chatbots for research to letting autonomous agents run entire intrusions. The report cites incidents where a hijacked coding assistant helped spread a self-propagating worm across roughly 100 repositories and a compromised CI/CD credential let an attacker co-debug exfiltration tools with an LLM in real time.

Separately, the report flags a new financial risk category, detailing a case where a corrupted value sent an accounting agent into a runaway reasoning loop that racked up over 15,000 API calls and roughly $50,000 in cloud costs in under an hour. Raindrop, designed to detect unknown failures in autonomous agents, announced a Series A funding round of $35 million, adding to last year's $15 million seed round.

Raindrop continuously analyzes agent behavior to surface silent and emerging failure modes, and to help AI systems repair and learn from them. The funding and the Mandiant report both point to growing attention on how autonomous agents behave when they fail or are manipulated.

What the Week Means for Defenders

The developments share a pattern: automated systems, whether AI agents, CI/CD pipelines, or plugin auto-updates, are being used as attack surfaces. The SAP flaw requires emergency patching of internet-facing systems. The Plugin4Shell flaw shows that pinned commits and review processes can be bypassed when an agent checks out a branch named after the hash it expects.

For businesses, the practical takeaways are to prioritize the SAP patch, update the WooCommerce Wholesale Lead Capture plugin to 2.0.3.2, and apply the TP-Link firmware fix. For security teams managing AI coding agents, the Plugin4Shell disclosure suggests verifying that auto-update mechanisms and commit pinning are functioning as intended, especially where Microsoft Copilot remains unpatched.

The Mandiant report's financial risk example, a runaway agent generating $50,000 in cloud costs in under an hour, suggests that agent monitoring and cost controls are becoming part of the security perimeter. The NIST and CISA token guidance addresses the identity layer that underpins cloud access, which is where many of these automated workflows authenticate.

The ransomware sentencing in Switzerland and the Black Axe extraditions show that law enforcement continues to pursue both developers and organizers. The PhantomRaven case adds a different angle: an operator who appears to use stolen CI/CD data not for resale but to claim bug bounties, which could complicate how defenders interpret indicators of compromise from npm packages.

For readers, the most immediate actions are the SAP emergency patch and the plugin and firmware updates. The broader implication is that agentic AI, plugin supply chains, and cloud token flows are now part of the same defensive problem set, and the guidance and tooling around them are still catching up to how attackers are using them.