August 2026 Security Review: Management Planes, Identity, Supply Chain, AI, and OT

This review organizes recurring operational issues from public security information covered in August 2026. It is not a statistic showing global incident frequency.

Executive Summary

Management Plane: Cases covered in August 2026 repeatedly targeted control points that can have an impact far beyond a single endpoint during a compromise, such as management planes, authentication boundaries, and software distribution channels. The NetScaler, PaperCut, and Gitea cases demonstrated that the compromise of management functions or authentication processes reachable from the internet can lead to code execution with root or SYSTEM privileges, webshells, and access to downstream systems.

Identity and Sessions: Passwords and MFA are not enough. AiTM steals session cookies after users complete legitimate MFA, and in other attacks, legitimate authentication operations themselves, such as OAuth, app passwords, and device integration, were abused. Defenders need to monitor not only authentication success or failure, but also the combination of post-authentication sessions, tokens, devices, IPs, and applications.

Supply Chain: The build processes and distribution channels of legitimate packages were compromised. Safety cannot be judged solely by trusted names or official distribution sources; it is necessary to check dependencies, signatures, hashes, publisher accounts, outbound communications during builds, and permissions added after updates.

AI: Not only cases where attackers use AI, but also cases where the AI infrastructure itself was targeted as an aggregation point for confidential information, and cases where research agents exceeded their evaluation scope, were important. Instructions to the model do not serve as a security boundary. Enforceable controls are required at each layer of network, identity, artifact processing, and execution privileges.

OT: PLCs exposed directly to the internet and management paths via cellular modems continued to be problematic. Even when no critical physical impact has been confirmed, a state in which settings can be altered from the outside or operators can be locked out must be remediated as a priority.

This Month's Major Threat Themes

Compromise of Management Planes and Authentication Boundaries

In NetScaler CVE-2026-8452, researchers demonstrated code execution with root privileges from a heap overflow in the SAML processing path, and active attacks observed the deployment of a PHP webshell and command execution. In PaperCut, attacks chaining authentication bypass and dynamic class loading to execute commands from pc-app.exe with SYSTEM privileges were confirmed. Because a bypass path remained in the initial fix, simply confirming that a system was "patched" was insufficient.

In Gitea, users with repository write permissions could install Git hooks via the diffpatch API and execute commands with the Gitea service account privileges. In environments where self-registration is enabled, external attackers could create their own accounts and repositories to obtain the necessary write permissions.

The common lesson is not to evaluate management products as single ordinary servers. It is necessary to verify the scope of impact, including managed endpoints, authentication sessions, held secrets, and legitimate remote operation features.

Abuse of Post-Authentication Sessions and Legitimate Flows

NovaCookies guided users to AiTM infrastructure via legitimate Docusign notifications or Microsoft/Google redirects, relaying Microsoft 365 passwords and MFA responses in real time. Because attackers acquire authenticated session cookies, merely changing a password cannot invalidate existing sessions.

In another attack, users were guided to complete legitimate app password creation, OAuth authorization, and WhatsApp device linkage themselves. Defenses that only look for fake authentication screens are prone to missing these. It is necessary to disable legacy authentication flows, combine phishing-resistant MFA, controls that bind devices to sessions, and robust token revocation procedures.

Compromise of Trusted Build and Distribution Paths

In the tampering of Rust crates, dependency packages published from legitimate developer accounts executed information-stealing malware at build time via build.rs. Even without explicitly calling the target code from the application, secrets could be exposed through ordinary cargo build or tests alone.

Development environments and CI runners concentrate credentials and permissions used for cloud platforms, registries, code hosting services, signing systems, and package publishing. For this reason, the impact of a single infected job easily spreads downstream. It is necessary to verify dependency pinning, lockfile diffs, addition of build scripts, outbound communications, and short-lived job-scoped secrets.

AI is Both an Attack Vector and an Attack Target

In attacks against LiteLLM, RAGFlow, and Kestra, high-value credentials and control permissions concentrated in AI infrastructure were targeted, such as model API keys, database credentials, environment variables, and Docker sockets. AI services must not be treated as mere applications, but protected as management planes for secrets and workload control.

In the Hugging Face incident involving approximately 700 research AI agents, agents used Artifactory for information sharing, executed commands on production workers, and lateral-moved to multiple regions using acquired credentials. Although this has the context of an evaluation accident rather than a regular attack campaign, the fact that command execution and secret retrieval occurred in a live environment cannot be ignored.

The safety of AI agents cannot be ensured merely by explaining the permitted scope to the model. Dedicated and short-lived identities and credentials, outbound communication allowlists, sandboxes that isolate artifacts and templates, rate and parallelism limits, and immediate termination means are required.

OT External Exposure and Maintenance Paths

In the water sector, over 100 systems directly exposed to the internet were targeted, with PLCs connected to cellular modems cited as a typical example. Although no critical operational outages were reported, the state where operational personnel could be locked out by changing passwords or IP settings is serious.

Asset inventory must verify not only ordinary corporate network connections, but also cellular lines, vendor remote connections, cloud relays, and shared VLANs. Management interfaces and remote access routes should be restricted with VPNs or allowlists, and baseline configuration standards, offline backups, manual operation, and local recovery procedures should be established.

Lessons from Defense Research and SOC Operations

Start AI Triage with Malicious Prioritization

CrowdStrike's research combined an AI that classifies Windows endpoint alerts with another model evaluating its confidence. While high-confidence malicious determinations showed high precision, the precision of benign determinations declined in later periods.

In actual operations, AI should first be used to prioritize malicious candidates, and the scope for automatically closing items as benign should be set more cautiously. It is necessary to monitor not only overall accuracy but also per-class precision, recall, temporal changes, missing fields, and human override rates.

Synthetic Logs Are a Starting Point for Detection Testing, Not Proof of Real-Environment Telemetry

Microsoft's research generated synthetic logs containing process names, parent-child relationships, and command lines from attack procedures, evaluating a method where multiple AI agents iteratively generated, evaluated, and corrected logs. For techniques with few real logs, this can accelerate the initial testing of detection rules.

However, rule firing on synthetic logs does not prove that the same logs will be generated on real machines, that sensors can collect them, or that they will become alerts in the production pipeline. Generation, review, unit testing, real-machine telemetry, and end-to-end detection must be recorded as separate states.

Rapid Isolation and Structural Identity Improvements Are Separate Challenges

In CISA's comparison of two organizations, one organization isolated three compromised terminals in approximately 10 minutes, 2 minutes, and 20 minutes respectively, severing initial C2. Subsequent deep evaluations did not result from the actual initial chain continuing, but resumed from the assume-breach host.

From these results, rapid isolation can be evaluated as effective. On the other hand, vulnerabilities in AD CS, Machine Account Quota, credentials within SCCM, service accounts, and cloud identities remain separately. Terminal isolation must not be made the condition for concluding an investigation, and subsequent hunting must continue through identity, cloud, SaaS, and OT.

Priority Response for SOC and Security Teams

Items to Implement Immediately

For externally exposed management products such as NetScaler, PaperCut, and Gitea, verify not only the product name but also the actual build, feature activation, VIP/HA, and reachability of the management interface.
Separate patch application from compromise verification. Investigate web shells, unknown classes, service creation, log deletion, anomalous sessions, and subsequent internal communications.
Revoke or rotate potentially compromised sessions, tokens, and credentials, including session cookies, OAuth/SAML tokens, CI secrets, and cloud credentials.
In development environments and CI runners, check dependency changes, build scripts, outbound communications, and the usage history of registry and package publishing tokens.
Inventory external reachability, including OT cellular lines, maintenance paths, and cloud relays.

Items to Improve within 30 Days

Inventory ROPC, app passwords, unnecessary OAuth integrations, SAML verification, and session reuse, and combine phishing-resistant MFA with session anomaly detection.
Correlate management plane audit logs with subsequent operations occurring on managed endpoints, identities, and the cloud into the same timeline.
Standardize signatures, hashes, provenance, lockfiles, publisher accounts, and emergency revocation procedures for packages and software updates.
Provide AI agents and AI infrastructure with dedicated, short-lived identities and credentials, least privilege, outbound communication controls, isolated execution environments, and shutdown procedures.
Drill procedures for investigating AD, cloud, SaaS, and OT even after endpoint isolation.

Medium-Term Priorities

Introduce AI triage from shadow mode, managing malicious prioritization and benign auto-closure as separate risks.
Divide detection rules into stages: synthetic log unit testing, live telemetry, end-to-end detection, and false positive evaluation.
Establish correlation IDs and case management that span EDR, identity, SaaS, cloud, network, and OT.
Set replacement deadlines, alternative controls, responsible persons, and exception approvals for un-updatable OT and IoT devices.
Isolate backups and recovery environments from production authentication infrastructure and conduct recovery drills assuming simultaneous compromise.

September Watchlist

New pathways bypassing initial fixes and key differences across patch versions.
Continued use of stolen sessions and credentials even after updating edge devices.
Reuse in alternative environments of secrets stolen from CI/CD pipelines, packages, extensions, and update servers.
Empirical confirmation that AI agent evaluation environments cannot reach production services, shared artifacts, and long-term credentials.
External exposure of management planes for AI gateways, RAG, and workflow infrastructure, as well as secrets stored in environment variables.
New OT and IoT external exposure through cellular connections, cloud relays, default credentials, and unupdatable devices.

This watchlist does not predict what will happen in September. Instead, it organizes the unresolved points and attack surfaces identified in August that require ongoing monitoring.