Welcome to our weekly newsletter where we share some of the major developments on the future of cybersecurity that you need to know about. Make sure to follow my LinkedIn page as well as Echelon’s LinkedIn page to receive updates on the future of cybersecurity!
To receive these and other curated updates to your inbox on a regular basis, please sign up for our email list here: https://echeloncyber.com/ciw-subscribe
Echelon Events & Thought Leadership Highlight
We've heard from clients time and time again that they are buying tools without being able to manage or monitor them internally. The tool isn't being used to its full potential, money is getting thrown out the window, and the team is drowning in alerts they don't have the bandwidth to deal with.
We've listened.
Introducing Echelon MDR, Powered by CrowdStrike: a fully managed detection and response service that operates and extends the Falcon platform on your behalf, including around the clock monitoring, triage, investigation, and response. You get SOC outcomes without building a SOC, backed by certified engineers from our CrowdStrike Center of Excellence.
💡 Learn more here:
📰 Read the full announcement: https://lnkd.in/em3meRBe
Away we go!
1. Anthropic CEO Warns AI Development Is Moving Faster Than Security Can Keep Up
Anthropic CEO Dario Amodei is calling for the world's leading AI companies to deliberately slow the rate at which they advance frontier models, arguing that AI capabilities are beginning to improve faster than researchers can understand, secure and control them. Amodei is not advocating for an end to AI development. In fact, he remains extremely optimistic about its potential benefits. His concern is that the emergence of increasingly capable autonomous systems, combined with AI beginning to help build the next generation of AI, could create a dangerous gap between what these systems can do and our ability to keep them aligned and contained. He calls the proposed approach "pacing the frontier," essentially giving security, alignment and evaluation enough time to catch up with capability.
Cybersecurity appears to be one of the developments that changed his thinking. Amodei specifically points to the recent OpenAI-Hugging Face incident, where a swarm of AI agents reportedly attacked systems they had not been instructed to target, sacrificed individual agents to accomplish the group's objectives and attempted to compromise the system evaluating their performance. The actual damage was limited, but Amodei argues that the same behavior in a substantially more capable model could have produced a very different outcome. He goes so far as to warn that within six to twelve months, a similarly misaligned but more capable agent swarm could potentially create a persistent botnet across large portions of the internet. Whether that exact scenario materializes or not, the underlying concern is difficult to dismiss: autonomous AI systems are gaining meaningful offensive cyber capabilities at the same time researchers are still learning how reliably those systems can be controlled.
Amodei's proposal starts with something unusual for a technology company. Anthropic says it will provide independent third-party evaluators with ongoing, employee-like access to its operations. Those evaluators would receive company laptops, office access and permissions similar to internal risk teams, allowing them to inspect models, training pipelines, safeguards and incidents rather than simply evaluating a finished model before release. More broadly, Amodei wants frontier AI companies in democratic countries to coordinate around common safety standards and eventually pursue international agreements around the most dangerous AI capabilities. The additional time, he argues, should be invested in better sandboxing, monitoring, alignment, interpretability and adversarial testing.
There is an important national security tension in the proposal. Amodei acknowledges that the United States cannot simply slow down while China continues accelerating. He argues that pacing only works if democratic nations preserve a meaningful technological advantage, including tighter controls on advanced AI chips, stronger defenses against model theft and efforts to prevent unauthorized distillation of frontier models. That makes this much more complicated than a traditional technology safety debate. The challenge is simultaneously moving fast enough to maintain America's AI advantage while moving carefully enough that the systems being created do not outpace our ability to secure them. For cybersecurity leaders, that may be the most important takeaway. We are rapidly approaching a world where AI is not simply another application to protect. It is becoming an autonomous participant in the security environment itself.
AWS SSM Agent Flaw Could Expose EC2 IAM Credentials
AWS disclosed a new vulnerability this week affecting the AWS Systems Manager Agent, software widely deployed on EC2 instances and other systems managed through AWS Systems Manager. The vulnerability, CVE-2026-89049, affects SSM Agent versions prior to 3.3.4851.0 and involves the Session Manager feature that allows users to establish port-forwarding sessions to remote hosts. An authenticated user who already has permission to use this functionality could bypass restrictions on certain network destinations and potentially reach link-local services that should normally be blocked.
Why does that matter? On an EC2 instance, one of those link-local destinations can provide temporary credentials associated with the instance's IAM role. If an attacker or overly privileged user can reach those credentials through the vulnerable port-forwarding functionality, they could potentially obtain the instance's temporary AWS credentials and then use whatever permissions are attached to that role outside of the instance itself. The ultimate impact therefore depends heavily on IAM. An instance role limited to a handful of resources presents a very different risk than a role capable of accessing sensitive S3 buckets, Secrets Manager secrets, databases or other AWS services.
AWS fixed the issue in SSM Agent 3.3.4851.0, and organizations should identify managed nodes running older versions and prioritize the upgrade. For environments where an immediate upgrade is not possible, AWS recommends restricting access to the AWS-StartPortForwardingSessionToRemoteHost SSM document by tightening both ssm:StartSession IAM permissions and SSM document permissions. Security teams should also take this opportunity to review the IAM roles attached to EC2 instances and ask a simple question: if someone stole the temporary credentials associated with this server, what could they actually do?
Why it matters: Session Manager is often considered a safer alternative to exposing SSH or RDP directly to the internet, and it generally is. But this vulnerability is a reminder that management infrastructure is itself privileged infrastructure. Patch the SSM Agent, restrict who can initiate port-forwarding sessions, and keep EC2 instance roles tightly scoped. The best protection against stolen cloud credentials is making sure those credentials cannot do very much in the first place.
2. Microsoft’s Record Patch Tuesday Shows Vulnerability Management Has a Scale Problem
Microsoft just delivered its largest Patch Tuesday release ever, addressing roughly 974 vulnerabilities across Windows and other Microsoft products. Buried inside that enormous number are two vulnerabilities already being exploited in the wild: CVE-2026-81963, affecting the Windows Update Stack, and CVE-2026-85880, affecting Windows Advanced Local Procedure Call. Both allow an attacker who has already gained some level of local access to elevate privileges, and both have been added to CISA's Known Exploited Vulnerabilities catalog. That alone makes them urgent. But with nearly 1,000 vulnerabilities landing simultaneously, the bigger challenge for security teams is determining what else needs to move to the front of the patching queue.
Several vulnerabilities deserve immediate attention alongside the two exploited flaws. The Zero Day Initiative highlighted CVE-2026-55007, an Exchange Server remote code execution vulnerability that could allow an unauthenticated attacker to achieve code execution simply by sending an email containing a malicious Visio attachment. The server processes the malicious content without requiring the recipient to open the message or use the Preview Pane. Other priority vulnerabilities affect SharePoint, Microsoft Authenticator, SQL Server and Remote Desktop Services. Researchers also identified roughly 20 vulnerabilities in the release with the potential to be wormable, meaning successful exploitation could potentially spread between systems without requiring the kind of user interaction associated with traditional phishing attacks.
The sheer volume is what makes September different. CrowdStrike's analysis counted 972 vulnerabilities, including 113 rated Critical, more than double August's total. Microsoft's July release had already seemed extraordinary at 622 vulnerabilities. September blew past it. Security teams cannot reasonably treat nearly 1,000 vulnerabilities as equally urgent, nor can they blindly deploy every update across production infrastructure the moment it appears. Reports of authentication problems involving some Windows 11 systems after September's updates illustrate the other side of the problem. Patching reduces risk, but poorly tested patch deployment can introduce operational risk of its own. The job is increasingly about understanding which vulnerabilities are actually exploitable in your environment, which systems are exposed, what business processes depend on them, and where an attacker could move next.
That is why vulnerability management needs to evolve from a monthly patching exercise into a continuous operational discipline. Start with vulnerabilities known to be exploited, then prioritize internet-facing systems, identity infrastructure and high-value platforms such as Exchange, SharePoint, SQL Server and Remote Desktop Services. Layer in asset criticality, exploitability, exposure and available compensating controls before deciding what gets patched next. Just as importantly, organizations need staged deployment, validation and rollback procedures so that fixing a security problem does not create an availability problem. With AI accelerating both vulnerability discovery and attackers' ability to operationalize new findings, the gap between disclosure and exploitation will continue to shrink. The organizations that handle this well will not necessarily be the ones that patch everything first. They will be the ones that can identify and eliminate their most dangerous exposures first.
Kiro IDE Flaw Shows Why AI Approval Prompts Are Not Enough
AWS disclosed an interesting vulnerability this week in Kiro IDE, its agentic development environment for AI-assisted software development. CVE-2026-89332 affected Kiro IDE versions prior to 0.8.135 and could allow a specially crafted, untrusted repository to cause sensitive workspace information to be sent to an attacker-controlled server. The attack involved manipulating Kiro's workspace settings and changing the URL used by the Kiro Powers registry to point toward an external endpoint.
The most interesting part is what happened with the human approval mechanism. Kiro would actually show the developer the proposed configuration change and ask for approval. That sounds like the right security control. The problem was that the AI agent had already written the configuration change to disk before the user made the decision. If the developer opened the Powers panel while the approval dialog was still pending, Kiro could make the external request using the modified configuration and potentially send sensitive workspace information to the attacker. In other words, the interface was asking the human for permission after a security-relevant action had effectively already occurred.
AWS fixed the vulnerability in Kiro IDE 0.8.135, and organizations using Kiro should upgrade to that version or later. AWS also recommends rotating credentials that may have been present in projects opened using an affected version. There is no workaround other than upgrading. For organizations rolling out AI coding assistants more broadly, I would go further and inventory which tools can modify configuration files, execute commands, access environment variables, read credentials and communicate with external services. Development environments routinely contain source code, API keys, cloud credentials and infrastructure configuration, which makes an agentic IDE an extremely powerful security principal.
Why it matters: "Human in the loop" sounds reassuring, but it only works if the human decision occurs before the privileged action. This is becoming an important design principle for agentic AI. An AI agent should not be able to change the control that governs its own permissions, execute the action while approval is pending, or use another tool to bypass the approval process. As AI assistants gain the ability to write code, modify infrastructure and interact with enterprise systems, organizations need authorization controls that exist outside the agent itself.
3. SAP’s Critical OVERPASS Flaw Can Bypass Security Before Authentication Even Begins
SAP has released an urgent security update for CVE-2026-44756, a maximum-severity CVSS 10.0 vulnerability researchers have named OVERPASS. The flaw exists in the SAP kernel's handling of Extended Passport, or EPP, data and could allow a remote, unauthenticated attacker to send a specially crafted network request and execute operating system commands on the underlying SAP host with administrative privileges. That combination should immediately get the attention of security teams: no stolen password is required, no legitimate SAP account is necessary, and successful exploitation could give an attacker control at the operating system level.
What makes OVERPASS particularly dangerous is where the vulnerability occurs in SAP's processing sequence. EPP data is processed as a session is being established, before many of the controls organizations normally rely upon to protect SAP environments. User locks, roles, authorization objects and logon policies are evaluated later. In practical terms, an organization could have carefully configured SAP access controls and still remain exposed because malicious input reaches the vulnerable kernel code before those controls get a chance to make a decision. The affected functionality is also used across multiple SAP communication paths, potentially making vulnerable systems reachable through internet-facing web components, SAP GUI connections and RFC communications between SAP systems.
The potential footprint is substantial because the vulnerable code resides in the SAP kernel itself. Products built on that kernel can inherit the vulnerability, including SAP S/4HANA, SAP ERP and Business Suite/ECC, SAP NetWeaver Application Server ABAP, SAP Web Dispatcher, SAP BW/4HANA, SAP Enterprise Portal, SAP PI/PO and SAP Solution Manager. The first step for organizations should be determining exactly which SAP kernel releases and patch levels exist across the environment and comparing them with SAP's current security guidance. Internet-facing systems should receive immediate attention, followed by internally accessible systems. Organizations should also reduce unnecessary network reachability, restrict access to trusted systems and users, and closely monitor SAP and network logs for potential exploitation attempts. Most importantly, the SAP security update is the only definitive fix for OVERPASS.
There is a larger security architecture lesson here. Identity controls, zero trust policies and carefully designed authorization models are enormously valuable, but only if an attacker has to pass through them before reaching vulnerable code. OVERPASS demonstrates what happens when attacker-controlled input reaches a critical parser earlier in the chain. For enterprises running SAP, this is not simply another entry in a monthly vulnerability report. SAP frequently supports the processes that allow companies to manufacture products, manage inventory, pay employees, process financial transactions and operate supply chains. A vulnerability capable of providing unauthenticated administrative command execution on those systems deserves an expedited response based on business criticality and exposure, not the organization's normal patching calendar.
Thanks for reading!
About us: Echelon is a full-service cybersecurity consultancy that offers wholistic cybersecurity program building through vCISO or more specific solutions like penetration testing, red teaming, security engineering, cybersecurity compliance, and much more! Learn more about Echelon here: https://echeloncyber.com/about