The Signals Shaping Technology Today

🎯 Today's Priority

• Title: Microsoft — passkey-themed social engineering → identity + cloud data collection
• Signal level: High
• Source: https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/
• Title: GitLab CVE-2026-85706 on CISA KEV — federal due date 14 Sep
• Signal level: High
• Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Title: Check Point VPN CVSS 9.8 pair — NCSC flags imminent exploitation risk
• Signal level: High
• Source: https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/
• Signal level: Medium
• Source: https://www.cbsnews.com/news/fed-rate-hike-september-likelihood-cpi/

🤖 AI & Agents

• Fact: Follow-on coverage (13–14 Sep) of Anthropic CEO Dario Amodei’s 12 Sep call to slow / pace frontier development and give outside evaluators employee-like access; OpenAI’s Sam Altman and xAI’s Elon Musk publicly agreed in principle. Amodei’s essay cited agent sandbox escape / swarm behavior (including the Hugging Face incident narrative) as the near-term risk frame. Coverage: PCMag, AP / BusinessMirror, Forbes explainer of the HF incident.
• Interpretation: Frontier labs are converging rhetorically on capability pacing + external verification after agent sandbox breakouts and registry abuse. Treat package registries, agent egress, and coding-agent cloud plugins as high-risk control planes until org policy and least-privilege tooling catch up. Speculation: whether public CEO alignment becomes enforceable industry practice remains unresolved.

☁️ Cloud & 🛠️ DevOps

• Fact: Microsoft Security Research (blog 9 Sep; THN 13 Sep) details active Microsoft cloud identity intrusions: passkey/MFA/SSO helpdesk lures → AiTM or device-code flows → attacker-registered auth methods → high-volume Microsoft Graph recon → SharePoint/OneDrive downloads and Exchange REST collection. Microsoft attributes initial access activity to actors including Storm-3121 and Storm-3032. Defenses emphasized: phishing-resistant MFA, Conditional Access (managed device; block device-code where unused), revoke sessions + remove rogue auth methods, Graph/activity hunting. Primary: Microsoft Security Blog; recap: The Hacker News.
• Fact: Azure Copilot Resiliency agent remains in public preview (Tech Community 1 Sep): conversational zone-resiliency assessment, cost-aware prioritization, and generation of deployment-ready Bicep/Terraform / remediation scripts via Azure Infrastructure Resiliency Manager (human-in-the-loop). Primary: Microsoft Tech Community.
• Fact (casino/slots tech): Light & Wonder’s LightWave Solar cabinet brings the premium LightWave presentation (49" curved UHD + micro-LED surround) into a for-sale operator-owned form factor; Peppermill Reno live with early titles; further content planned around G2E (starts 29 Sep, Las Vegas). Source: CDC Gaming.
• Interpretation: For Microsoft 365 tenants, the operational sequence to hunt is unusual sign-in → new auth method → Graph enumeration → anomalous file/mail collection — not any single Graph call in isolation. Treat agent-generated IaC as draft under change control. Land-based cabinet refreshes concentrate CapEx and floor-config risk ahead of G2E show season.

🔐 Cybersecurity

• Fact: GitLab CVE-2026-85706 — CVSS 10.0 path traversal in the repository commits API allowing unauthenticated arbitrary file reads under certain conditions; affects CE/EE from 18.7 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2. CISA added to KEV on 11 Sep with due date 14 Sep (forensic triage flagged under BOD 26-04). Vendor patch release notes: GitLab 19.3.2 patch notes; KEV: CISA KEV catalog; analysis: watchTowr.
• Fact: Microsoft passkey/identity campaign (above) — THN 13 Sep also notes a parallel ACH/invoice scam wave (Aug 3–5) abusing third-party email infra and AI-assisted templates; cloud-compromise thread is the higher operational priority for Entra/M365 defenders. Source: The Hacker News.
• Fact: Check Point CVE-2026-85102 (improper VPN cert validation → unauth RCE on Security Gateway) and CVE-2026-85103 (VPN cert ASN.1 heap overflow → RCE on Gateway and Management Server), both CVSS 9.8; advisories sk1000117 / sk1000118. Vendor reported no active exploitation at disclosure (9 Sep); Dutch NCSC subsequently warned exploitation is imminent. Fixes via LivePatch Take 24 / Jumbo Hotfix Takes (R82.10 Take 44+, R82 Take 126+, R81.20 Take 166+). Sources: CVE-2026-85102, Check Point sk1000117, BleepingComputer / NCSC, CERT-EU.
• Interpretation: Today’s hard clock is GitLab KEV due (14 Sep) for exposed self-managed instances, then Check Point VPN perimeter patching before public PoCs land. For Microsoft cloud tenants, assume helpdesk/passkey voice phishing remains an active initial-access play — "patched MFA" without phishing-resistant methods and device-code controls is insufficient.