Weekly Threat Intel: Agentic AI Abuse and September 2026 CVEs
Agentic-AI abuse, the September 2026 CVE wave and ransomware tradecraft — this week’s defensive checklist.
Why Time Synchronization Breaks: NTP, PTP and the Leap-Second Problem
How NTP and PTP keep infrastructure clocks honest, why leap seconds took down Cloudflare and Reddit, and how to run time sync you can trust.
Kubernetes Security Fundamentals: RBAC, Pod Security and the Controls That Matter
The Kubernetes security layers that stop real cluster compromises: control plane, RBAC, Pod Security Admission, network policy and image supply chain — with a ten-point audit checklist.
SBOMs in Practice: SPDX vs CycloneDX and What Actually Breaks
SPDX vs CycloneDX compared honestly, how to generate SBOMs that match production, and the failure modes that sink real adoption — plus the EU CRA deadlines now in force.
ADS-B and GNSS Spoofing: Aviation’s Position Data Has No Authentication
ADS-B broadcasts aircraft position worldwide with no authentication — and GNSS spoofing corrupts it. The attacks, the documented incidents since 2022, and why there is no quick fix.
EFB safety and human factors, from battery fires to failure planning
EFB Safety & Human Factors: Battery Fires, Failure Policy and the Future
EFB operational safety: lithium thermal runaway containment, failure & redundancy policy, human factors and common-mode risk — plus AI-era EFBs from 2026 on.
Securing the EFB with DO-326A, hardening, signed data, monitoring and incident response
Securing the EFB: DO-326A, Hardening and Defense-in-Depth
How the industry defends EFBs: DO-326A/ED-202A airworthiness security, MDM hardening, signed chart data, AID isolation and continuous monitoring.
Cybersecurity threats, the attack surface, published research and real attack chains
EFB Cybersecurity: Attack Surface, Real Threats and Published Research
The EFB attack surface mapped: device tampering, chart data poisoning, AID attacks, malicious updates and supply chain — with real published aviation research.
Snowflake-Related Arrests: UNC5537’s Kitchener Pinch
On October 30, 2024, Canadian authorities arrested a 26-year-old Kitchener, Ontario man on a US warrant connecting him to the Snowflake-account intrusions tracked by Mandiant as UNC5537 — the crew behind the Ticketmaster, Santander, and AT&T disclosures that dominated 2024’s data-theft calendar. The arrest, first reported in early November by Bloomberg identifying the suspect as Connor Riley Moucka, illuminated the infostealer-credential-to-cloud kill chain and the market for stolen data. This account reconstructs the campaign, the arrest, and the MFA lessons that outlast it.
Regulations and certification under FAA AC 120-76E, EASA AMC 20-25 and ICAO Doc 10020
EFB Regulations & Certification: FAA AC 120-76E, EASA AMC 20-25 & ICAO Doc 10020
EFB regulatory framework explained: FAA AC 120-76E/AC 91-78A, EASA AMC 20-25, ICAO Doc 10020, OpSpecs, Part-IS — and the operational approval process step by step.
CVE-2024-10924: Really Simple Security’s 2FA Betrayal
On November 6, 2024, Wordfence researcher István Márton disclosed CVE-2024-10924 — a CVSS 9.8 authentication bypass in Really Simple Security, the plugin securing four million WordPress sites, whose two-factor onboarding endpoint failed to validate the requesting user, granting attackers admin sessions on sites with incomplete 2FA enrollment. Patched same-day in 9.1.2, NVD-published November 14, the flaw became 2024’s definitive case study in security-plugin risk. This account walks the vulnerable code path, the four-million-site patch sprint, and why the ecosystem’s auth surface extends far past WordPress core.
Tool Hijacking: The 2024 Papers That Predicted Agent Attacks
By November 2024, AI-agent security research had already documented the attack class that production incidents would later make infamous. InjecAgent (March 2024, ACL Findings) benchmarked 1,054 indirect-injection scenarios across 30 agents, finding ReAct-prompted GPT-4 attacked successfully roughly a quarter of the time. Breaking Agents (July 2024) demonstrated malfunction amplification through agentic loops. Together with 2023’s foundational indirect-prompt-injection work, they mapped how tools, descriptions, and fetched content become command channels. This survey walks the papers, the hijack taxonomy, and the controls that predate the incidents.