Weekly exploit waves show how weak edge and automation controls fail

At a glance

What this is: This weekly report surveys active cyber threats and breaches from 3 February to 9 February 2026, with a strong focus on unauthenticated RCE, AiTM compromise, and automation-led cloud intrusion paths.

Why it matters: For IAM, PAM, and NHI practitioners, the report reinforces that exposed credentials, privileged automation, and legacy edge services remain the access layer attackers target first.

By the numbers:

• Attackers attempt access within an average of 17 minutes when AWS credentials are exposed publicly, and as quickly as 9 minutes in some cases.
• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
• Systems with least-privileged AI access had a 17% incident rate versus 76% for over-privileged systems, making poorly scoped AI access 4.5x more likely to lead to a security incident.

👉 Read FireCompass's weekly cybersecurity intelligence report for 3 to 9 February 2026

Context

This report is really about the governance gap between exposed attack surfaces and the speed at which attackers operationalise them. In the primary examples, unauthenticated services, workflow platforms, and end-of-support appliances are treated as easy entry points because defenders often still assume patch windows, perimeter trust, or credential secrecy will hold long enough to react. That assumption is breaking across both cloud automation and identity-related control planes.

The identity angle is most visible where these incidents cross into privileged access, service accounts, and automation credentials. When an internet-facing service or workflow engine exposes tokens, the result is not just compromise of a host, but compromise of the identities that let attackers move across infrastructure, applications, and collaboration systems. That is now a common pattern, not an edge case.

Key questions

Q: What breaks when internet-facing appliances can be exploited before authentication?

A: The security model breaks at the point where exposure is assumed to be safe until patching happens. If an appliance can execute code before login, attackers skip the entire authentication layer, gain privileged access, and use the device as a pivot into adjacent systems. Defenders then need segmentation, rapid patching, and exposure reduction, not just perimeter monitoring.

Q: Why do exposed workflow platforms create such a large identity risk?

A: They often concentrate service tokens, environment secrets, and inherited cloud permissions inside one runtime. When attackers reach that runtime, they do not just compromise an application, they inherit the non-human identities attached to the workflow and can extend into SaaS, cloud, and infrastructure systems. That is why workflow governance must include secret inventory and privilege scoping.

Q: How can security teams tell whether AiTM protection is actually working?

A: Look for controls that prevent session replay, not just successful login. If a session can be reused from a different device, network path, or proxy context after MFA, then the control is failing. Effective protection combines device trust, session binding, proxy hardening, and monitoring for anomalous operator actions.

Q: How should organisations prioritise patching when a flaw is used in targeted attacks?

A: Prioritise the devices and user groups that would create the highest business impact if silently compromised, not just the largest fleet segment. Executive devices, admins, researchers, and access operators usually deserve faster verification because they are more likely to be targeted. The goal is to reduce the attacker’s value per compromise, not only to close the CVE.

Technical breakdown

Unauthenticated RCE on internet-facing appliances

Unauthenticated remote code execution happens when a flaw lets an attacker send crafted input and trigger arbitrary commands without logging in. In the Cisco Unified CM case, packet handling flaws in an exposed integration interface allowed memory corruption and root-level execution. Once that boundary is crossed, the appliance is no longer a service component but an attacker-controlled foothold. From there, attackers can enumerate adjacent systems, pivot through trusted integrations, and use the appliance as a staging point for broader compromise.

Practical implication: treat internet-facing appliances as direct execution surfaces and tighten exposure, patching, and segmentation accordingly.

AiTM session hijacking in operational networks

Adversary-in-the-Middle, or AiTM, attacks sit between a user and a service to intercept or replay authentication material, including sessions that MFA would normally protect. The Romania pipeline case shows why MFA alone is not a complete control when perimeter appliances or proxies are already compromised. Once attackers can relay or manipulate sessions, they can use legitimate consoles and protocols to alter industrial or business systems while appearing to be trusted operators.

Practical implication: pair MFA with device trust, proxy hardening, and session-binding controls so stolen sessions cannot be replayed.

Workflow automation as a credential concentration point

Workflow platforms often store environment variables, service tokens, and cloud credentials in one execution context, which makes them especially valuable to attackers after initial code execution. The n8n chain illustrates how a parser flaw can become cloud compromise when runtime access exposes AWS keys, GCP tokens, or Kubernetes material. In identity terms, the platform becomes a control aggregation layer: one flaw can expose multiple non-human identities and the permissions they carry across SaaS and infrastructure.

Practical implication: isolate automation runtimes, minimize embedded secrets, and review workflow privileges as if they were privileged service accounts.

Threat narrative

Attacker objective: The objective is to turn a public-facing weakness into durable control over identities, workflows, or operational systems that can be monetised or weaponised.

1. Entry occurs through unauthenticated exploitation of exposed services, including Cisco Unified CM, n8n, lighttpd, and legacy perimeter appliances.
2. Escalation follows when attackers convert that initial foothold into root execution, session hijacking, or access to embedded cloud and workflow credentials.
3. Impact includes lateral movement, data theft, ransomware staging, OT disruption, and operational outages across enterprise and critical infrastructure environments.

Breaches seen in the wild

• Cisco Active Directory credentials breach — Kraken ransomware group leaked Cisco Active Directory credentials.
• 230M AWS environment compromise — 230M AWS environments compromised via exposed .env files with cloud credentials.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Exposed automation is now an identity problem, not just a vulnerability problem. When workflow engines and integration platforms store secrets or inherit cloud tokens, a single execution flaw can expose multiple non-human identities at once. That changes remediation priority from patch-only thinking to lifecycle control over credentials, scopes, and runtime isolation. Practitioners should treat automation platforms as privileged identity estates.

Standing trust in perimeter appliances is the new attack multiplier. The report’s perimeter and appliance cases show how attackers convert edge compromise into authenticated movement without ever needing to defeat every downstream control. That exposes a governance gap in organisations that still rely on network position or appliance trust as a boundary. The better model is continuous verification of sessions, devices, and privilege before trust is extended.

Credential exposure windows are too short for slow-response security models. When attackers can act within minutes of public exposure, rotation that happens after detection is already late. This is especially true for service accounts, API keys, and workflow tokens that sit outside normal user lifecycle processes. The practical conclusion is that secrets governance must be measured in minutes and scope, not audit cycles.

Workflow and telecom platforms create hidden privilege chains. The article shows how collaboration systems, CI/CD-like automation, and integration tooling can become pivot points because they inherit broad access to business systems. That is a classic NHI governance failure mode: the identity is not obviously privileged until someone maps its effective reach. Security teams should inventory these hidden paths before an attacker does.

Edge exploitation is accelerating the convergence of cyber and identity governance. The same events that begin as RCE or session hijacking often end as credential abuse, infrastructure control, or ransomware staging. That makes NIST CSF, MITRE ATT&CK, and NHI governance complementary rather than separate workstreams. The practical outcome is a unified control view across exposure, privilege, and operational resilience.

From our research:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to The 2026 Infrastructure Identity Survey.
• Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to The 2026 Infrastructure Identity Survey.
• For a broader identity lens on this risk, see Ultimate Guide to NHIs , Key Challenges and Risks, which connects over-privilege, sprawl, and unmanaged credentials to recurring exposure patterns.

What this signals

Exploitation speed is now fast enough to outpace manual identity response. When public exposure leads to access in minutes, defenders need pre-approved containment paths for service accounts, workflow runtimes, and edge appliances. The operational signal is clear: the shorter the compromise window, the more your programme must rely on automation, segmentation, and scoped identity design rather than human ticket flow.

Credential concentration in automation platforms is becoming a hidden resilience issue. The risk is not only theft of a secret, but theft of the control plane that uses the secret to orchestrate business processes. That means security teams should review workflow tooling with the same seriousness they apply to PAM and cloud identity controls, because one runtime can carry many permissions.

Attack surface management and identity governance are converging around the same failure modes. The practical next step is to connect exposure discovery to privilege review, because a public service with broad access is the highest-value target in the environment. Teams that can correlate those two views will contain more incidents before attackers reach downstream systems.

For practitioners

• Harden internet-facing execution surfaces Prioritise patching, isolation, and removal of direct exposure for collaboration appliances, workflow engines, and lightweight web servers that can execute attacker input before authentication.
• Inventory embedded secrets in automation platforms Review environment variables, connectors, and runtime stores in workflow tools for AWS keys, GCP tokens, Kubernetes material, and other secrets that broaden the blast radius of one compromise.
• Bind sessions to trusted devices and proxies Reduce AiTM risk by enforcing device posture checks, proxy hardening, and session-binding controls so a hijacked session cannot be replayed from a different endpoint.
• Separate privileged automation from general-purpose workloads Place workflow engines, CI/CD runners, and integration hubs in segmented runtime zones with restricted egress and tightly scoped service identities.
• Track exploitation with attack-chain hunting Map alerts to exploit, execution, credential access, and lateral movement stages so telemetry from appliances, logs, and cloud control planes can be correlated quickly.

Key takeaways

• The report shows that attackers still prefer simple entry points with high downstream privilege, especially exposed appliances and automation runtimes.
• The evidence points to a recurring pattern of fast exploitation, session abuse, and credential concentration across cloud and operational systems.
• The control answer is faster exposure reduction, tighter privilege scoping, and stronger session binding before attackers can chain access.

Key terms

• Adversary-in-the-Middle (AiTM): An attack pattern where the adversary sits between the user and the service to capture or replay authentication data and session state. The victim may still log in successfully, which is why the compromise often appears legitimate until privileged actions begin. AiTM is especially dangerous for admin workflows that trust issued sessions too much.
• Exploit Chain: A sequence of vulnerabilities or malicious steps that work together to move from initial exposure to full compromise. In practice, one weakness may not be enough on its own, but chained weaknesses let attackers bypass normal protections and reach code execution, data theft, or device control.
• Workflow Automation: Workflow automation is the use of predefined rules, triggers, and actions to move work through a process without manual handoffs at every step. In identity programmes, it is useful for routing requests, but it does not replace entitlement decisions, revocation, or assurance that access state actually changed.
• Session Binding: A control that ties an authenticated session to the device, connection, or risk context that created it. When applied well, it makes stolen cookies harder to reuse from an untrusted endpoint or a different network context.

What's in the full article

FireCompass's full report covers the operational detail this post intentionally leaves for the source:

• Per-incident remediation guidance for Cisco Unified CM, n8n, lighttpd, and Zimbra environments
• MITRE ATT&CK mappings and IOC examples that support hunt and detection workflows
• Specific hardening steps for exposed appliances, workflow endpoints, and mail infrastructure
• CISA KEV context and patch urgency details for active exploitation cases

👉 FireCompass's full report covers the incident details, remediation notes, and ATT&CK mappings for each case.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management for practitioners responsible for access control. It helps security teams translate identity policy into operational control across human and non-human estates.