{{first_name | Reader}},

In partnership with:

Opal Security — The programmable access platform bridging policy intent and enforcement, combining AI with CISO context and an engineer's precision.

Smallstep — SCEP is a password. Passwords get stolen. Real Zero Trust starts with the device — begin with Wi-Fi, extend across apps and infrastructure.

LockThreat — AI-powered GRC that replaces legacy tools and unifies compliance, risk, audit and vendor management in one platform.

Cite the record - The record behind this brief is public, inspectable, and citable.

The weekly brief is where things get worked out. The daily CISO briefing on Spotify is the fast version: two minutes each weekday on what actually moved. Follow it here.

CYBERSECURITYHQ

Issue No. 35 · 25 August 2026

CHQ maintains ratings on a standing set of structural security conditions. Each rating reflects the current maturity and confirmation of a condition, not a forecast. Conditions carry their permanent identifiers from the public CHQ Structural Conditions Registry, where dated definitions and falsification criteria are maintained. The report leads with what changed; the full board follows.

Three layers of the AI infrastructure stack are now under confirmed exploitation, and all three layers received new CISA Known Exploited Vulnerabilities catalog entries within one month. Langflow is the orchestration layer, with five catalog additions since March and three since July. Ray is the compute layer. MLflow, added this week, is where models are tracked, registered, and served. These are not theoretical AI components. They sit directly in the tooling enterprises use to orchestrate, compute, track, and serve AI workloads.

The mechanisms differ. The architectural location does not. Ray was reached through a developer's browser; MLflow through an unauthenticated server-side request forgery in a webhook endpoint. Each sits in the development and control plane around AI workloads rather than in a production prompt interface. None involved a model endpoint. None involved a prompt.

One more artifact belongs beside those three, from the other side of the same adoption. In May, a US bank filed the first SEC disclosure naming unauthorized AI use as a material incident: an employee ran customer data through an unapproved tool, no external attacker described, and the bank determined materiality in two days. The exploited catalog now records active exploitation across multiple AI infrastructure layers, and the disclosure stream shows ungoverned AI carrying a disclosure and regulatory consequence. The security conversation about AI has been about models and prompts. The evidence, on both records, is about infrastructure and governance.

On the board, stated plainly: this does not change the agent-runtime rating, which tracks compromise of a deployed agent's runtime in production. Ray and MLflow are the fifth and sixth platform-level cases this registry has tested against that boundary; neither meets the published runtime criterion. If a case crosses the line, the reclassification trigger is already published.

SC-2026-007 · Enterprise Application Plane Exploitation: rating affirmed CONFIRMED; Outlook moves to Accumulating.

The business-application plane was quiet for a month. It is not anymore. Metabase, the analytics platform with privileged query access to business data, entered the catalog two weeks ago as a zero-day whose pre-patch window produced disclosed downstream victims. SharePoint followed this week with its seventh catalog entry of 2026. Two class instances in two review cycles is evidence moving, and the Outlook field now says so. The rating itself does not move, because the condition is already at its ceiling.

The vendor risk-signal condition faces its scheduled test this Thursday, August 27, and the outcome is determined by a rule this publication wrote before the evidence existed. Here is the whole mechanism in three sentences. If the review cycle ending Thursday contains at least one documented vindication and no new reversal, the condition moves down to Emerging, the first de-escalation in this board's history. If a new reversal has occurred, the downward sequence resets. If the cycle contains neither, the sequence pauses and waits.

Readers do not need to trust this desk's judgment about which of the three happens. The criterion is public, the ledger is public, and next Tuesday's issue will report what the rule required.

SC-2026-002 · Edge and Management-Plane Compromise: affirmed CONFIRMED. The heaviest evidence continues to arrive here. VMware vCenter, the console that administers the virtualization estate, entered with a path traversal allowing code execution and is the purest example yet of the concentrated-reach class this condition describes. TrueConf Server, a self-hosted conferencing platform, entered with an unauthenticated pair; one of the two carried a three-day deadline that has already lapsed. Zimbra, the self-hosted mail and collaboration suite, followed within days: unauthenticated OS command injection through crafted SMTP requests, its deadline already passed at this writing. Several accelerated deadlines have already lapsed, including Ray, vCenter, SharePoint, Zimbra, and one of the two TrueConf entries; MLflow and the second TrueConf entry remain inside their remediation windows. For the lapsed set, late movers should treat patch tickets as compromise assessments.

SC-2026-008 · Autonomous AI Attack Operations: affirmed CONFIRMED. The counted set is unchanged: two adversarial operations, one containment escape. The reported Taiwan operation remains under verification, and the most important development is a cautionary one: Taiwan's Ministry of Digital Affairs has acknowledged the attack while characterizing it as a hybrid of manual work and AI agents, which cuts against the fully autonomous reading. The candidate moves nothing until it clears the counting standard, and the official characterization is now part of its file.

SC-2026-006 · Exploitation Precedes Defender Awareness: affirmed STRENGTHENING; Watch (up) removed. One candidate arose and was disqualified this window. Ray's 2025-series identifier raised the question of a qualifying lag instance; the public record answers it. The identifier was reserved October 16, 2025, roughly ten months before listing, short of the twelve-month criterion. Closed without reclassification. With no qualifying candidate under adjudication, the proximity condition for a Watch marker is no longer met: the criterion's structure keeps the trigger permanently one instance away, and structural possibility is not proximity. The marker comes off, and it reattaches when a live candidate exists.

SC-2026-009 · Security Tooling as Exploited Surface: affirmed CONFIRMED. Fourth consecutive quiet cycle on the tooling classes. The quarterly de-escalation clock runs.

Format. Beginning this issue, each section opens in plain language and carries its mechanics in a marked block beneath. The rules and the evidence are unchanged; the order of presentation is not. Reader feedback prompted the change, and the registry records the standard.

Correction. The year-to-date catalog census previously carried in this program was derived from a secondary tracker and was low. Re-derived from CISA's version-stamped data, the correct figure is 181 additions through August 11. The census rule now binds all such figures to the official versioned source. Separately, one Sunday intake gap is declared in the registry with a quiet gap-window sweep behind it. Axis Intelligence, working from CISA's version-stamped catalog data with its own vendor classification, this week reported perimeter and network-appliance vendors at 21.9 percent of catalog additions since 2024, against 15.4 percent in the 2021 to 2022 baseline, with the authors noting the baseline's backfill skew. That is a second, independently constructed methodology arriving at this board's oldest thesis.

For exploitation conditions, the confirmation threshold is confirmed production exploitation; each non-exploitation condition declares its own threshold in the registry.

Outlook describes the direction of evidence accumulation in the trailing window: Accumulating, Stable, Receding. It is not a prediction. Watch indicates a defined reclassification trigger is mechanically near, and is directional; when proximity exists in both directions, both are shown.

Two records moved this month and most organizations read only one of them. The exploited catalog named three AI infrastructure layers. The disclosure stream produced the first filing where ungoverned AI use alone was material. The question for the reader: does your AI risk register have a line for the infrastructure your teams build on, and a line for the tools they use without asking, or does it only have a line for the models? The evidence this month arrived on the two lines most registers are missing.

Three questions for your own program this week. Who patches your AI infrastructure, by name? If an employee ran customer data through an unauthorized AI tool today, would anything detect it? And which risk signals in your own program carry an explicit, written condition under which you would lower their severity?

CybersecurityHQ publishes independent structural intelligence for security leadership. Conditions, positions, and falsification criteria are maintained at record.cybersecurityhq.com. Ratings reflect observable structural conditions at a point in time. They are not forecasts and do not assess applicability to any specific organization's environment.