Session CRT-20260603 — 3 June 2026 · Afternoon Edition

Based on my research, here's my assessment of the OpenC3 COSMOS vulnerabilities:

Deployment Footprint

OpenC3 COSMOS is an open-source command-and-control platform used for telemetry processing and commanding embedded systems. It's particularly popular in aerospace, satellite ground stations, and some industrial telemetry applications. However, I want to be clear: this is primarily a Level 3/3.5 system — it's the command-and-control layer that sits above the actual PLCs and field devices. It's not directly wired to turbines or safety PLCs. That matters for blast radius.

Patch Status

According to OpenC3's own vulnerability documentation, both CVE-2026-42087 and CVE-2026-42088 affect versions 6.10.6 and 7.0.0 Core & Enterprise. The SQL injection in the QuestDB time-series database (CVE-2026-42087) and the administrative access flaw (CVE-2026-42088) are patched in version 7.0.0-rc3. I found no evidence of backports to the 6.x branch — so if you're running 6.10.6, you're looking at a major version upgrade to remediate.

Active Exploitation Evidence

I found no data on active exploitation in the threat intelligence database. The CVEs were disclosed in early May 2026, so we're in that dangerous window where the vulnerabilities are known but mass exploitation may not have ramped up yet. The unauthenticated nature of these flaws makes them trivial to weaponize once proof-of-concept code circulates.

Detection Guidance for SOC Teams

This lives at Purdue Level 3 — the enterprise zone where COSMOS typically interfaces with IT networks. That means your standard IT detection tools have a fighting chance here, unlike Level 1/2 where latency budgets kill most inline inspection.

• Monitor for anomalous SQL queries to the QuestDB instance — the time-series database is the attack vector for CVE-2026-42087
• Look for unauthorized API calls to the JSON-RPC endpoints, which are the unauthenticated entry point
• Watch for unexpected script execution in the Script Runner widget (CVE-2026-42088)
• Since COSMOS is typically Linux-based, EDR coverage is more feasible here than on legacy RTU controllers

Blast Radius Assessment

Here's the thing — this is not a direct process control compromise. COSMOS is the command generation and telemetry aggregation layer. If an attacker owns COSMOS, they can:

• Issue commands to downstream systems (the blast radius depends on what COSMOS is authorized to command)
• Manipulate telemetry data going to operators (potentially hiding process anomalies)
• Pivot to connected engineering workstations or HMI systems

But the actual safety PLCs and field devices at Level 1? They're not directly exposed. The attacker would need to traverse from COSMOS (Level 3) down through the DMZ to Level 2, then to Level 1. That's not trivial in a well-segmented architecture.

That said, I've seen poorly segmented environments where the "command and control" server has direct Modbus TCP paths to PLCs. If that's your setup, this is a much bigger problem — you're essentially one SQL injection away from turbine commands.

Immediate Actions

1. Inventory all COSMOS deployments — version 6.10.5 through 7.0.0-rc2 are vulnerable
2. If you cannot patch immediately (and in OT, you probably can't without a maintenance window), restrict network access to COSMOS APIs at the firewall — unauthenticated SQL injection requires network reachability
3. Validate that COSMOS cannot directly reach Level 1 devices — if it can, you've got architecture problems beyond these CVEs

Based on my research, here's my deep analysis of this vulnerability:

The Technical Root Cause

Three things happening here: the shared Microsoft SDK used across all six apps had a debug flag left in production code, this flag disabled the authorization check that restricts token access to Microsoft-signed apps only, and the result was any third-party app on the device could silently request and receive valid Microsoft account tokens without user interaction or consent.

This is not a logic bug in the authentication flow — it's a build pipeline failure. The debug flag was likely used during development to bypass the normal signature verification that ensures only Microsoft apps can request tokens from the shared authentication service. When the flag was left enabled in production builds, the SDK essentially treated every app on the device as "trusted" for token issuance purposes.

Affected vs. Patched Versions

The vulnerability, referred to as "FlagLeft," was assigned CVE-2026-41101, CVE-2026-41102, and CVE-2026-41103 according to available reports. All six affected apps — Word, Excel, PowerPoint, Microsoft 365 Copilot, Microsoft Loop, and OneNote for Android — were patched in the May 2026 security update. I don't have granular version numbers for each app in the database, but the critical point is this: billions of combined downloads means the exposure window is massive. Users who haven't auto-updated or are on devices with disabled Play Store access remain vulnerable.

Attack Chain Analysis

This is a local privilege escalation requiring malicious app installation — not a remote exploit. The attacker needs:

1. A malicious app installed on the victim's device (via sideloading, third-party app store, or compromised legitimate app)
2. The malicious app then silently requests tokens from the Microsoft SDK
3. Receives valid, refreshable OAuth tokens without triggering any user-facing consent dialog
4. Uses those tokens to access emails, OneDrive storage, messages, and calendar data under the victim's identity

The key insight: these tokens are long-lived and refreshable, and they generate no suspicious logs. This means an attacker could maintain persistent access to corporate data even after the malicious app is removed, until the tokens are explicitly revoked.

MDM Conditional Access Policies — Immediate Actions

James, here's what I'd push through your MDM right now:

1. Force app updates immediately — Use managed Google Play to require minimum app versions from the May 2026 patch across all six apps
2. Conditional Access: Require compliant apps — Block access to Microsoft 365 services from devices running unpatched versions of these apps
3. Token revocation sweep — Force re-authentication for all Microsoft 365 accounts on Android devices in your fleet to invalidate potentially stolen tokens
4. Block sideloading — Enforce "Install from unknown sources" restrictions to reduce the attack surface for malicious apps that could exploit this
5. App inventory audit — Scan for any non-Play-Store apps on managed devices; this vulnerability requires a malicious app to be present

What This Says About Microsoft's SDLC

This is a catastrophic build pipeline failure. A debug flag surviving to production across six separate app build pipelines suggests:

• No automated "debug flag detection" in CI/CD — A simple static analysis check would have caught this
• No production build hardening gates — The flag should have been stripped or overridden at build time for release configurations
• Insufficient cross-app SDK governance — All six apps share the same SDK; a vulnerability in the shared component propagated across the entire Microsoft 365 mobile suite

This is not a sophisticated vulnerability. It's a basic hygiene failure that should have been caught by automated tooling. The fact that it shipped to billions of users tells us Microsoft's mobile build pipeline lacks the security gates that are standard practice at most mature software vendors.

Look, I've spent the last hour digging into what Anthropic actually published versus what's being breathlessly reported. Let me break this down into what we can verify, what remains unverified, and what this actually means for defense.

On credibility — the evidence is genuinely mixed.

The 27-year-old OpenBSD SACK handling bug is real and confirmed by the OpenBSD project itself — that part checks out. The FreeBSD NFS root RCE (17 years old) and FFmpeg H.264 flaw (16 years old) have specific CVE assignments (CVE-2026-4747, etc.) and the CSA research note confirms coordinated disclosure is underway. So the "ancient bugs in heavily audited code" claim has substance.

But here's the critical gap: Anthropic has not published false positive rates, and XBOW's independent validation found "significant limitations including overstatement of findings and poor edge-case judgment." The Vidoc Security Lab reproduction study is particularly telling — they got Claude Opus 4.6 to reproduce the FreeBSD and OpenBSD findings exactly, but GPT-5.4 failed on the OpenBSD bug entirely. This suggests the capability is model-specific and not some generalizable "AI magic."

The binary-only black-box claims are where marketing outruns evidence. Penligent's analysis puts this well: Anthropic published "unusually strong evidence for source-visible AI bug finding" but "much thinner public evidence" for binary reverse engineering. That's a crucial distinction — source-assisted analysis is a different game than dropping the model on a stripped binary and watching it find bugs.

On exploit timelines — yes, the patch window is collapsing, but this isn't the sole cause.

The CSA whitepaper I found documents the mean time-to-exploit falling from roughly 32 days in 2022 to approximately 5 days as measured for 2023 exploitation activity, with 2025 data showing that 32.1% of newly tracked exploits appeared on or before the CVE's public disclosure date. Mythos-style capabilities accelerate this, but the trend predates them. What changes is the volume — thousands of vulnerabilities discovered in weeks rather than dozens in months.

Here's the thing: AI-speed discovery without AI-speed patching is the structural problem. We already saw this with Google's Big Sleep finding a 20-year-old OpenSSL bug in September 2024, and Code Intelligence's Spark finding wolfSSL bugs autonomously. Mythos appears to be a quantitative leap, not a qualitative one.

On proliferation risk — this is where I get genuinely concerned.

The Vidoc study demonstrates that public models can partially reproduce these findings. We're not talking about a secret sauce that stays locked in Anthropic's vault. The Japanese government and European institutions are already negotiating access, which means the model is proliferating through "trusted" channels — historically a porous boundary.

More concerning: Google's Threat Intelligence Group has already identified threat actors using AI-developed zero-days. The capability is escaping the lab. The question isn't whether this proliferates, but how fast and to whom first.

For financial sector CISOs — four immediate actions:

1. Assume zero-day exposure. If Mythos-class tools are finding thousands of bugs in weeks, your attack surface has unknown vulnerabilities right now. Shift from "patch known CVEs" to "assume compromise and segment accordingly."

2. Inventory your C/C++ dependencies. The Mythos findings cluster in memory-unsafe codebases — OpenBSD, FreeBSD, FFmpeg, wolfSSL. If you're running legacy C code that predates modern fuzzing, it's in the blast radius.

3. Deploy runtime exploitation detection. Static patching won't keep pace. You need behavioral detection for the exploitation phase, not just the initial access.

4. Demand SBOMs with AI-generated risk flags. Your vendors should be disclosing whether their code has been through AI-assisted analysis. If they don't know, assume it hasn't been.

On the offense-defense balance — it's a shift, not a revolution, but the direction is bad.

This is not "AI alignment failure" or some sci-fi scenario. This is automated vulnerability research at scale, and it's incrementally improving on fuzzing and static analysis in ways that compound. The 27-year-old bug survived every security audit since 1999. That tells you something about human-driven review hitting its limits.

The fundamental shift is asymmetry: AI-speed offense versus human-speed defense. Until we have AI-speed patching and verification — and we don't — the gap widens.

I checked with James Okafor on detection implications for this panel, and he confirms we don't have reliable behavioral signatures for AI-generated exploits versus human-crafted ones. The payload looks the same in execution.

Based on my research, here's my assessment:

VSCode Webview GitHub OAuth Token Theft

Exploit mechanics: The vulnerability exploits VSCode's postMessage() keyboard event forwarding between webviews and the main editor. Malicious JavaScript in an untrusted webview simulates keystrokes via hostMessaging.postMessage('did-keydown', {...}), tricking VSCode into treating them as legitimate user input. This bypasses the security boundary between isolated origins and allows installation of a malicious extension without user consent. The extension then extracts the GitHub OAuth token passed when navigating from github.com to github.dev. The token is unscoped — granting access to all repositories the user can access, not just the current one.

Exposure: VSCode is ubiquitous across development organizations. Any developer using the "Open in github.dev" feature (the . key shortcut on any repo) with GitHub OAuth integration enabled is vulnerable. This represents a substantial portion of the developer population.

Patch status: Disclosed June 2, 2026 by researcher Ammar Askar. Microsoft has not provided a patch timeline. PoC is publicly available on GitHub.

Token rotation: Organizations should proactively revoke and rotate all GitHub OAuth tokens NOW. The exploitation window is active, the attack requires only a single click, and the PoC is public. The blast radius is full repository access.

Interim mitigations:

• Block github.dev at the proxy/firewall level until patched
• Disable VSCode's webview functionality if operationally feasible
• User education on link-clicking hygiene while VSCode is running
• Monitor for anomalous GitHub API activity

Lynx Ransomware

Crypto scheme: According to the threat intelligence repository, Lynx uses Curve25519 ECDH for key exchange and AES-128-CTR for file encryption. The malware implements intermittent encryption (1/6 of file content) as a speed optimization. Shadow copy deletion is performed via DeviceIoControl IOCTL calls.

Detection artifacts: The @akaclandestine repository provides YARA, Sigma, and Suricata rules. However, Lynx operates as an offline encryptor with no network C2, which limits the effectiveness of network-based detection. The rules are a solid foundation but will require environment-specific tuning — particularly the Sigma rules, which can generate false positives from legitimate backup operations.

SOC readiness: The published artifacts are a starting point, not a turnkey solution. SOC teams should prioritize behavioral detection for the IOCTL shadow copy operations and file extension monitoring for .lynx appended files.

Bottom line: The VSCode bug is operationally critical — zero-day, public PoC, 1-click exploitation, full repo access. That's an immediate token rotation event. Lynx is competent ransomware with decent detection artifacts available, but nothing revolutionary in the cryptographic implementation.