The Brief 62
The access was a courtesy. The authority had already expired.
CrowdSec kept a departing engineer’s GitHub access open so he could finish his work. On May 22, a token stolen from his laptop used that access to copy roughly 170 private repositories in nine minutes. Nobody noticed for 117 days.
Every control did exactly what it was built to do. The token was valid, GitHub authenticated it correctly, and the extension was a reasonable business decision. What no control asked was whether anyone still had a reason to act.
- CrowdSec’s September 18 account traces the theft of about 170 private repositories to a GitHub OAuth token from a former employee’s account, harvested in May’s TanStack npm supply-chain attack (CVE-2026-45321).
- The account stayed in CrowdSec’s GitHub organization after departure so the employee could finish work. It was removed May 25, three days after the copy.
- The token left no trace in logs CrowdSec could check. GitHub support had to reconstruct its history. The theft surfaced only when the archive appeared on a forum on September 16.
- SolarWinds Access Rights Manager shipped with a hard-coded static key enabling unauthenticated RCE (CVE-2026-28326, CVSS 8.8). The product that governs access rights carried a credential nobody can revoke.
- Both September Patch Tuesday zero-days are privilege escalations Microsoft describes as available to an “authorized attacker.” Both are on CISA’s KEV catalog.
The courtesy extension
CrowdSec is a French security company whose open-source engine detects attacks on servers and feeds a shared community blocklist. On September 18 it published its final account of how its private source code ended up on a cybercrime forum. The sequence is worth reading slowly.
- MAY 1184 malicious versions of 42 TanStack npm packages are published. Installing one runs code that harvests GitHub tokens, SSH keys, and cloud credentials from the developer’s machine.
- MAY (DATE UNDISCLOSED)A CrowdSec engineer who has just left the company still holds GitHub organization access, kept open so he can finish outstanding work. His laptop is compromised through TanStack.
- MAY 22, 05:52–06:01 UTCA GitHub OAuth token from his account copies about 170 private repositories. Git fetch only, with no commits and no changes.
- MAY 25CrowdSec removes the account from its GitHub organization, three days after the copy and months before it learns of it.
- AUGUST 17Someone attempts to use an AWS notification-service credential found in the leaked code. It goes no further than its narrow permission.
- SEPTEMBER 16The archive appears on an online forum, 117 days after the copy.
- SEPTEMBER 18CrowdSec publishes its final incident account.
The stolen material included CrowdSec’s web console, data-science code and models, automation tooling, and the consensus system that decides which IP addresses enter its community blocklists. It also contained 83 user email addresses and names, emails, and investment context for 51 potential investors from 2020. CrowdSec says production infrastructure and databases were not accessed and no code or pipeline was changed. The departed engineer’s other access had already been revoked, which is why nothing moved in AWS.
CrowdSec was not alone. Mistral AI and OpenAI each reported developer devices reached by the same TanStack attack.
Our assessment. The consensus logic is the part CrowdSec customers should think hardest about. The rules that decide what gets blocklisted are now readable by the people the blocklist exists to stop. Expect evasion to be tuned against it.
What actually failed
It is tempting to file this under supply chain and move on. That is where the credential was stolen. It is not where the damage was authorized.
Walk it from the control plane’s side. The token was genuine. It belonged to an account that was a legitimate member of the organization. GitHub authenticated it without error. The clone operations were within that account’s permissions. Every check that exists at GitHub passed, correctly.
What changed was not the credential. It was the reason behind it. The engineer’s authority to touch CrowdSec’s code ended when his employment did, and the extension that followed was scoped to “finish some work,” a purpose that lived in someone’s head and nowhere in the system. Cloning 170 repositories in nine minutes at six in the morning is not finishing some work. Nothing was positioned to notice the difference.
Then consider the forensics. The token had expired by the time CrowdSec went looking, and it left nothing in the logs CrowdSec could query. The company reconstructed its own incident only because GitHub support could trace the token’s lifecycle on its side. If your evidence of who acted on your code lives with your vendor, your investigation runs at your vendor’s pace.
A key that belongs to nobody
On September 17, SolarWinds disclosed CVE-2026-28326 in Access Rights Manager, rated 8.8. The root cause, in SolarWinds’ own words, is a hard-coded static key. Every version through 2026.2 is affected, and 2026.2.1 fixes it. Kai Huang of Armadin found and reported it. SolarWinds reports no exploitation in the wild.
The CVSS vector requires adjacent-network reach rather than internet exposure, which narrows who can attempt it. It does not narrow what they get. ARM manages access-rights information across Active Directory and other enterprise systems, which is why it usually sits on a management segment with a domain-privileged service account behind it.
A hard-coded key is the CrowdSec problem in its purest form. It is a credential with no owner, no scope, and no end date, identical in every deployment. You cannot rotate it or revoke it. The only remedy is the vendor’s patch.
“An authorized attacker”
Microsoft’s September release fixed two zero-days exploited in the wild, and both are on CISA’s KEV catalog.
CVE-2026-85880, Windows ALPC. A heap-based buffer overflow, CVSS 7.8. An attacker running code inside a low-privilege AppContainer can escape the sandbox to SYSTEM with no user interaction. Tenable’s Satnam Narang notes it is only the second ALPC zero-day in nearly four years.
CVE-2026-81963, Windows Update Stack. A link-following flaw, CVSS 7.8, that lets a local attacker elevate privileges through the component that installs Windows updates.
Read Microsoft’s own description of the ALPC bug. It allows an “authorized attacker” to elevate privileges. That phrase is the whole brief in two words. Both flaws are post-access. They exist to turn a foothold someone was granted, or stole, into authority nobody granted.
CISA’s BOD 26-04 now sets an expectation that federal agencies check whether a system was compromised before the patch was applied. It binds only federal civilian agencies, but the principle travels. A patch closes the door. It says nothing about who walked through while it was open, which is precisely the gap CrowdSec’s May 25 revocation left.
Signals
Agents are the next departed employee. In an Exabeam survey fielded by Sapio Research, 48% of security leaders ranked AI agents with excessive, compromised, or unintended access as their top threat. That outranks external threat actors at 28% and compromised human insiders at 12%.
APIs are where the traffic went. Akamai’s State of the Internet report, published today, records a 113% rise in daily API attacks between 2024 and 2025 and a 300% increase in bot traffic, driven largely by AI.
No federal rules this year. The House left last week and does not return until after the November 3 midterms. In the Senate, Rand Paul blocked John Kennedy’s attempt to pass an AI emergency shutdown requirement by unanimous consent. Whatever governs agent authority in your environment through year-end is what you build.
Offboarding is an authority event
Most offboarding programs are built as identity events. The person leaves, the account is disabled, and the checklist is closed. CrowdSec did most of that correctly. It revoked the AWS access, which is why the blast radius stopped at source code.
The exception is the one every organization makes: a single access left open, for a good reason, with no written scope and no end date. That exception is not an identity decision. It is a grant of authority that outlives the reason for it. Your identity stack can tell you the account exists. It cannot tell you whether the thing the account is doing right now is the thing it was kept open for.
Now count your agents. Each was provisioned for a purpose, most by someone who has since moved on to other work, and almost none carries an expiry. Nearly half your peers already name them as their top insider threat. Every one of them is a courtesy extension.
For every credential still active after the reason it was issued has ended, whether a departed employee’s, a vendor’s, or an agent’s, who wrote down what it is allowed to do, and what checks that at the moment it acts?
What to do this week
- Patch both Windows zero-days, then hunt. Deploy fixes for CVE-2026-85880 and CVE-2026-81963, then check high-value hosts for signs of exploitation before the patch landed. Patched is not the same as clean.
- List every post-departure access extension. Each one gets a named owner, a written scope, and an expiry date, or it ends today.
- Revoke tokens, not memberships. Offboarding should kill OAuth grants, personal access tokens, SSH and deploy keys, not only org membership. Confirm your source-control audit logs capture token-level activity and are retained outside the platform, so reconstruction doesn’t depend on your vendor’s support queue.
- Close out TanStack properly. Any machine that installed a malicious TanStack version from May 11 onward should be treated as having lost every credential on it, including machines belonging to people who have since left.
- Upgrade SolarWinds ARM to 2026.2.1. Restrict what can reach the ARM service on the management segment, and rotate credentials ARM holds as a precaution.
- Run the same test on your agents. Owner, scope, expiry. Any agent that fails all three is a departed employee who never left.
- CrowdSec — final incident account, 18 September 2026, as reported by The Hacker News, ID Tech, and Cyberpress, 18–21 September 2026.
- TanStack / GitHub — advisory for CVE-2026-45321, malicious @tanstack package releases, 11 May 2026.
- SolarWinds — security advisory CVE-2026-28326, Access Rights Manager, 17 September 2026; ARM 2026.2.1 release notes.
- Microsoft — September 2026 security update guide, CVE-2026-85880 and CVE-2026-81963; analysis via Tenable and SecurityWeek, 8 September 2026.
- CISA — Binding Operational Directive 26-04, “Prioritizing Security Updates Based on Risk.”
- Exabeam / Sapio Research — insider threat survey, via Security Today, 21 September 2026.
- Akamai — State of the Internet report, via Infosecurity Magazine, 22 September 2026.
- Washington Examiner, NBC News — Senate and House action on AI legislation, 16–17 September 2026.
Where authenticated access becomes authorized execution
Software Armor runs a fixed-scope Escalation Baseline: a structured assessment of where authenticated access becomes authorized execution in your environment, evaluated against four conditions — complete mediation, no credential possession, fail closed, and in-path enforcement — with recovery scope treated as a named deliverable rather than an afterthought.
Reply to this brief or reach me directly.