The week's most striking number is ten hours. That is how long it took an attacker using AI agents to go from a public web service to root control of an enterprise environment. The number that should worry a board more, though, is four years. That is how long three server-side API keys sat in the public JavaScript of three UK airport websites before anyone looked. Speed and standing access are the same problem seen from two ends, and this week produced a clear example of each.
Unit 42 published its account of an intrusion in which a human attacker set the objective and handed tactical execution to AI agents. The investigation, published September 2, describes agents that mapped internal microservices, combed source repositories for hard-coded tokens, used those tokens to reach the secrets management system, harvested master administrative credentials, hijacked CI/CD workflows to exfiltrate cloud access keys, and finally turned the victim's own AI endpoints into attack infrastructure. More than 50 MITRE ATT&CK techniques were chained in under ten hours, work Unit 42 puts at roughly two weeks for a coordinated human team. No zero-day was involved. What changed was the time between steps.
For US filers, the operational consequence lands on the SEC's four business day clock under Item 1.05, which starts at the materiality determination rather than at discovery. An intrusion that completes in ten hours does not give an incident response function ten hours of warning; it gives it a forensic reconstruction after the fact. This maps directly to Threat Detection and SOC, and it is a detection and containment speed problem before it is a disclosure problem.
Manchester Airports Group disclosed on August 27 that an unauthorized third party had obtained customer data tied to car park, lounge and Fast Track bookings and in-airport Wi-Fi sign-ups across Manchester, Stansted and East Midlands. MAG confirmed email addresses, phone numbers, vehicle registrations and postcodes were accessed, and stated that no payment details were held in the affected system and that aviation security was never compromised. Reporting has put the population at roughly 8.7 million customers.
MAG has not confirmed how the access was obtained. On September 7, security researcher Scott Helme published an analysis that tested the attacker's public claim against archived copies of the sites' JavaScript bundles. He found three distinct server-side marketing platform API keys, one per airport, present in publicly served code from mid-2022 until August 2026 and never rotated. Helme sells a product in this space, which is worth noting, but the method is reproducible from public archives. The keys existed to credit a marketing email with a page view. The authority attached to them extended to exporting and deleting the customer database. That gap between what a credential needed and what it could do is the Identity Access and Fraud story of the week, and a US operator with the same exposure would be looking at state breach notification statutes and an FTC Section 5 question about reasonable security.
The transitional period under UAE Federal Decree-Law No. 6 of 2025 closes on September 16, 2026. Article 62 extends the licensing perimeter to platforms, protocols, APIs and infrastructure that facilitate or enable licensed financial activity, even where the provider is not itself a bank or insurer, and maximum administrative fines rise to AED 1 billion.
The direction of travel matters more to a US audience than the jurisdiction does. A regulator has concluded that the entity holding the enabling authority should carry the supervisory obligation, which is the same reasoning US firms already meet through third-party service provider requirements in state financial regulation and through vendor obligations flowing out of NIST CSF 2.0 governance. Firms with UAE financial sector operations or customers should be treating September 16 as fixed. No extension has been announced.
Rapid7 Labs documented a previously undocumented Linux toolkit used against South Korean automotive and media organizations, published September 4. Rather than dropping a web shell, the operators recompiled the victims' own HAProxy load balancer to include a backdoor, using the product's native filter API, memory pools and scheduler. The implant harvests session cookies and credentials, selectively injects scripts into pages served to targeted visitors, and scrubs HAProxy's own connection counters as it goes. Command traffic terminates at the load balancer and never reaches a backend, so no backend logs it. Rapid7 attributes the activity to DPRK-linked actors with medium confidence.
This lands hardest on any organization that treats edge infrastructure as plumbing. Rapid7's own conclusion is the useful one: components that terminate TLS and handle user traffic need the same integrity controls as application servers, and their own logs cannot be the primary evidence of their own compromise.
On September 2, CISA added seven vulnerabilities to the Known Exploited Vulnerabilities catalog on evidence of active exploitation. Two affect SonicWall SMA1000 remote access appliances, including a server-side request forgery flaw rated CVSS 10.0. One affects JFrog Artifactory, an authentication weakness associated with the affected default configuration. The remainder cover Sangoma Switchvox, Starlette, Kestra and LiteLLM.
The pairing is the point. A remote access gateway and a build artifact repository are both trusted by everything downstream of them. Under BOD 26-04 federal civilian agencies must prioritize remediation of KEV entries on exposed assets that grant total control post-exploitation. Private sector firms are not bound by it, but KEV has become the practical benchmark that contract terms, insurers and CMMC assessors reach for.
Five stories, and each one turns on authority that exceeded function. Hard-coded tokens in a repository that opened a secrets manager. A marketing attribution key that could export and delete a customer database. A load balancer trusted to terminate TLS and therefore trusted absolutely. A default configuration that granted administrative access to unauthenticated callers. And a regulator concluding that the party holding the enabling authority must carry the obligation that goes with it.
None of these are patching failures. In four of the five cases the software worked exactly as configured, and nothing in the toolchain flagged the mismatch between what a credential was for and what it could reach. Secret scanning inspects repositories, not built and deployed bundles. Penetration tests scope login and booking flows, not the seventeenth of ninety JavaScript chunks. Vulnerability management counts CVEs, not the blast radius of a service account. The mismatch is not a finding any of these controls is designed to produce.
The capability the week points at is a continuously maintained inventory of non-human identities, scoped by what each one can actually reach rather than by what it was issued for. Every API key, service account, model endpoint, CI/CD credential and integration token, with its permission ceiling recorded and reviewed. Unit 42's guidance says the same thing from the attacker's side: inventory every model endpoint and API key, apply least privilege, and hunt for behavioral loops rather than signatures.
The second capability is containment that moves at the same speed as the attack. Ten hours is shorter than most escalation paths. Revoking credentials, terminating sessions, freezing pipelines and isolating cloud accounts has to happen as one automated action across every plane at once, not as a sequence of tickets. Both capabilities are continuous rather than periodic, and neither survives being run quarterly by a team that also has a day job. That is the case for a managed operation rather than a project.
Watch September 11. The EU Cyber Resilience Act's mandatory vulnerability and incident reporting obligation under Article 14 takes effect, and it reaches any manufacturer placing connected products on the EU market, including US firms. It arrives four days after a week in which the most expensive exposures were the ones nobody was required to report on, and nobody looked for.
