Daily Reading for 2026-10-21

eMudhra Intermediate CA Compromise

A certificate-authority failure has become a global patching fire drill. eMudhra’s intermediate CA private keys were compromised, and because those intermediates chain to roots trusted by Mozilla, Microsoft, Apple, Chrome and countless downstream trust stores, every software bundle carrying a trust list is now a target. Willison tracks the scramble across Linux ca-certificates packages and Python tooling; Huntley shows the other half of the problem — transitive dependencies — and argues Nix’s single source of truth lets one overlay patch an entire fleet, with an AGENTS.MD reminder to back the workaround out once upstream settles. It is a lesson in trust concentration and supply-chain blast radius.

Watch for:

• Which Linux distros, language runtimes, and appliances ship updated trust stores.
• Whether eMudhra roots are fully distrusted or only the compromised intermediates.
• Cleanup of temporary fleet-wide distrust overlays once upstream packages settle.

Wardley signals:

• Components: eMudhra intermediate CA certificates; public root trust stores (Mozilla/Apple/Chrome/Microsoft); ca-certificates packages; Python certifi/uv/pip; Nix overlays; nixpkgs pins; transitive dependency graph; AGENTS.MD automation.

• Evolution stage: public CA trust stores are Commodity (utility, universally accepted); ca-certificates updates are Product (standard packaged maintenance); Nix overlay fleet-patching is Custom (emerging practice); agentic auto-remediation via AGENTS.MD is Genesis (novel).

• Doctrine hits/misses: hits — “Use standards” (CA/Browser Forum trust), “Bias towards data” (verifying the nixpkgs commit), “Manage inertia” (removing the workaround once upstream lands). Misses — “No single method fits all” is illustrated by non-Nix ecosystems still patching transitive dependencies by hand.

• Climatic patterns: “Commoditisation <> Centralisation” (one compromised CA centralises risk); “Higher order systems create new sources of value”; “Evolution of communication mechanisms can increase the speed of evolution” (the compromise propagates worldwide near-instantly); “Increased stability of lower order systems increases agility & speed of re-combination” (a stable Nix base enabled rapid overlay work).

• Diffusion markers: coordinated cross-ecosystem updates (uv, pip, certifi, distros) within days; a community tracking repository; the Nix overlay pattern spreading as a reusable security technique.

• eMudhra Intermediate CA Compromise

• patch the planet

wardley-beta
%% 1. Users: platform/systems engineers and security teams running fleets
%% 2. Needs: keep TLS trust valid and patched across every device and runtime
%% 3. Capabilities: trust-store management, dependency patching, fleet remediation, verification
%% 4. Components: public root trust stores, distro ca-certificates, Python certifi, Nix overlay, transitive dependency graph, agentic auto-remediation
%% 5. Maturity: trust stores (Commodity), ca-certificates (Product), certifi (Product), Nix overlay (Custom), transitive deps (Custom), AGENTS.MD auto-remediation (Genesis)
%% 6. Managed by: browser/OS root programs, Linux distros, language runtimes, platform teams, Nix ecosystem
anchor fleetTrustNeed [0.92, 0.92]
component publicTrustStore [0.88, 0.85]
component caCertificates [0.68, 0.72]
component pythonCertifi [0.72, 0.60]
component nixOverlay [0.30, 0.55]
component transitiveDeps [0.50, 0.45]
component agentAutoRemediation [0.15, 0.35]
publicTrustStore -> fleetTrustNeed
caCertificates -> publicTrustStore
pythonCertifi -> publicTrustStore
nixOverlay -> transitiveDeps
transitiveDeps -> caCertificates
agentAutoRemediation -> nixOverlay
evolve nixOverlay 0.45
evolve transitiveDeps 0.60
evolve agentAutoRemediation 0.30

ClickFix Malware Delivery Campaigns

ClickFix has matured from a crude social-engineering trick into an industrialised malware-delivery channel. Forescout’s analysis of the ROMULUS platform shows a malware-delivery-service model: bogus landing pages and fake ChatGPT Custom GPTs lure users into pasting PowerShell that fetches Legion Loader, with payloads padded to roughly 1 GB to dodge upload limits and sandbox budgets. In parallel, Siemens warns that a DLL-sideloading flaw (CVE-2026-110936) in Software Center is being actively exploited through ClickFix lures to plant remote-access trojans. Together they show the same entry point being productised and bolted onto trusted software supply chains.

Watch for:

• New ClickFix lures abusing trusted brands, custom GPTs, or signed installers.
• PowerShell and DLL-sideloading hunting rules plus vendor advisories.
• Whether ROMULUS attribution or infrastructure overlaps other campaigns.

Wardley signals:

• Components: ClickFix technique; ROMULUS delivery panel; fake landing pages; PowerShell staging scripts; Legion Loader/Satacom downloader; MSI installers; Siemens Software Center; CVE-2026-110936; DLL sideloading.

• Evolution stage: ClickFix as a technique is Product (repeated, packaged, advertised) trending Commodity; the ROMULUS panel is Custom (an emerging criminal service); Legion Loader is Product; Siemens Software Center is Commodity (widely deployed enterprise software).

• Doctrine hits/misses: hits — “Know your users” (attackers exploit user trust), “Manage inertia” (slow vendor and enterprise patching). Misses — “A bias towards open” is inverted, since attackers rely on opacity and confusion; defenders’ “Understand what is being considered” (treating the user as an attack surface in threat models) is often missing.

• Climatic patterns: “Success breeds inertia” (trusted installers keep being exploited); “Everything evolves through supply and demand competition” (ClickFix commoditising as a service); “Competitors actions will change the game” (affiliates copy one another).

• Diffusion markers: copy-cat ClickFix campaigns; malware-as-a-service and affiliate-framework language; reuse of the same IP addresses across campaigns; a documented “commercial cybercriminal delivery service”.

• ROMULUS ClickFix Platform Delivers LegionLoader Through Obfuscated PowerShell and Malicious Installers

• 🚩 Siemens Software Center DLL sideloading vulnerability is being actively exploited in ClickFix campaigns to deploy remote access trojans.

wardley-beta
%% 1. Users: SOC analysts and defenders protecting end users and endpoints
%% 2. Needs: detect and block malware delivery and social-engineering lures
%% 3. Capabilities: lure detection, delivery-channel tracking, endpoint hunting, patch/vendor response
%% 4. Components: ClickFix lure, ROMULUS panel, Legion Loader, MSI installer, DLL sideloading, Siemens Software Center, PowerShell stager
%% 5. Maturity: ClickFix (Product), ROMULUS panel (Custom), Legion Loader (Product), MSI installer (Commodity), DLL sideloading (Custom), Siemens Software Center (Commodity), PowerShell stager (Product)
%% 6. Managed by: criminal affiliates/operators, malware-delivery services, software vendors, enterprise IT
anchor endpointProtection [0.95, 0.90]
component clickFixLure [0.55, 0.70]
component romulusPanel [0.30, 0.50]
component legionLoader [0.60, 0.45]
component msiInstaller [0.80, 0.40]
component dllSideloading [0.45, 0.40]
component siemensSoftwareCenter [0.85, 0.55]
component powershellStager [0.70, 0.35]
clickFixLure -> endpointProtection
romulusPanel -> clickFixLure
legionLoader -> clickFixLure
msiInstaller -> legionLoader
dllSideloading -> siemensSoftwareCenter
siemensSoftwareCenter -> clickFixLure
powershellStager -> romulusPanel
evolve romulusPanel 0.45
evolve clickFixLure 0.70
evolve dllSideloading 0.55

KGB RAT Malware-as-a-Service

Group-IB’s deep dive into KGB RAT shows commodity malware is no longer only about stealth — it is about monetisation and cruelty. Sold as a malware-as-a-service product with free and paid tiers and daily updates, it bundles credential theft, keylogging, hidden-desktop (HVNC) takeover, and ransomware in one builder, plus “fun settings” such as screamers, jump scares, and forced blue screens. It abuses legitimate infrastructure (the Telegram Bot API for C2 notifications, ip-api.com for geolocation) and ships a FUD crypter to evade Defender. The same builder is shared by multiple operators, one running a CryptoClipper module — which is why defenders should track the tool family, not just individual campaigns.

Watch for:

• KGB RAT IOCs and infrastructure, especially Telegram-based C2 and geolocation lookups.
• New builder versions, crypter updates, and ransomware/CryptoClipper modules.
• Underground-forum advertising and operator clustering around one builder.

Wardley signals:

• Components: KGB RAT builder; FUD crypter; HVNC; credential harvester/keylogger; ransomware module; Telegram Bot API; ip-api.com geolocation; malware-as-a-service tiers; CryptoClipper.

• Evolution stage: RAT capability is Product (feature-complete, sold, versioned); MaaS distribution is Product trending Commodity; the harassment “fun settings” are Genesis-to-Custom differentiators; the FUD crypter is Custom (a constant arms race).

• Doctrine hits/misses: hits — “Bias towards data” (IOC-driven detection), “Manage failure” (assume compromise, plan response). Misses — “Use standards” and “A bias towards open”: attackers freely abuse commodity APIs while defenders lack shared, standardised telemetry for that abuse.

• Climatic patterns: “Everything evolves through supply and demand competition” (the MaaS market); “Components can co-evolve” (crypter and builder advance together); “Higher order systems create new sources of value” (harassment features as differentiators); “No choice over evolution”.

• Diffusion markers: a daily-updated commodity product; multiple operators sharing one builder; free/paid tiering; forum marketing and publicly identifiable developers.

• 🚩 KGB RAT Combines Credential Theft, Remote Access, and Ransomware Capabilities

wardley-beta
%% 1. Users: SOC, threat-intel and malware analysts defending Windows estates
%% 2. Needs: detect and mitigate commodity RAT and ransomware capabilities
%% 3. Capabilities: IOC tracking, infrastructure monitoring, endpoint detection, operator attribution
%% 4. Components: KGB RAT builder, FUD crypter, HVNC module, ransomware module, Telegram C2, MaaS tiers, CryptoClipper
%% 5. Maturity: builder (Custom), FUD crypter (Custom), HVNC (Product), ransomware module (Product), Telegram C2 (Commodity), MaaS tiers (Custom/Product), CryptoClipper (Genesis)
%% 6. Managed by: underground malware developers and affiliates abusing legitimate APIs
anchor threatDetection [0.95, 0.90]
component kgbBuilder [0.35, 0.60]
component fudCrypter [0.40, 0.50]
component hvncModule [0.55, 0.45]
component ransomwareModule [0.65, 0.40]
component telegramC2 [0.85, 0.55]
component maasTiers [0.45, 0.35]
component cryptoClipper [0.30, 0.30]
kgbBuilder -> threatDetection
fudCrypter -> kgbBuilder
hvncModule -> kgbBuilder
ransomwareModule -> kgbBuilder
telegramC2 -> kgbBuilder
maasTiers -> kgbBuilder
cryptoClipper -> maasTiers
evolve fudCrypter 0.55
evolve maasTiers 0.60
evolve telegramC2 0.95

OT-Aware SOC and AI

This SRA piece argues the real gap in operational-technology security is design, not tooling. Most SOCs are built IT-first, so analysts drown in noisy OT telemetry, misread Modbus/DNP3/S7 traffic, and apply IT playbooks — isolate the host, kill the process — that can shut a production line or trip a safety system. An OT-aware SOC instead builds analyst fluency in OT protocols, maps every alert to physical consequence, prioritises by impact on equipment and safety, and runs pre-agreed OT escalation paths. AI can help triage and correlate at scale, but only on top of an accurate asset inventory and visibility below Purdue Level 3.

Watch for:

• Whether SOC vendors ship genuine OT protocol context versus relabelled IT detections.
• AI-assisted OT alert triage and its failure modes.
• Asset-inventory and visibility progress below Purdue Level 3.

Wardley signals:

• Components: SOC; OT protocols (Modbus, DNP3, S7); the Purdue Model; asset inventory; OT-specific playbooks; AI triage/correlation; PLCs and process equipment; IR escalation paths.

• Evolution stage: IT SOC practice is Product/Commodity (standardised); OT-aware SOC capability is Custom (emerging and bespoke); AI-assisted OT triage is Genesis (novel, unproven); OT protocols are Commodity (stable and well defined).

• Doctrine hits/misses: hits — “Know your users” and “Focus on user needs” (physical consequence and safety), “Use appropriate methods” (OT playbooks, not IT playbooks), “Know the details” (protocol literacy). Misses — “No single method fits all” is violated by IT-first SOCs, and “Manage inertia” is needed to re-tool them.

• Climatic patterns: “No single method fits all”; “Characteristics change as components evolve”; “Efficiency enables innovation” (better visibility enables AI use); “The less evolved something is the more uncertain it becomes” (AI in OT).

• Diffusion markers: growing industry writing and vendor positioning on OT-aware SOCs; AI being applied to OT triage; Purdue-model vocabulary becoming standard in SOC discourse.

• Building an OT-Aware SOC: How AI Will Help

wardley-beta
%% 1. Users: OT security analysts and plant/OT engineers
%% 2. Needs: detect and respond to OT incidents without disrupting physical processes
%% 3. Capabilities: OT protocol literacy, asset inventory, physical-impact triage, OT-specific playbooks, AI-assisted triage
%% 4. Components: IT SOC platform, OT protocols (Modbus/DNP3/S7), asset inventory, OT playbooks, physical-impact triage, AI triage, Purdue Model
%% 5. Maturity: IT SOC platform (Product), OT protocols (Commodity), asset inventory (Product), OT playbooks (Custom), physical-impact triage (Custom), AI triage (Genesis), Purdue Model (Commodity)
%% 6. Managed by: security teams, OT engineers, SOC tooling vendors, standards bodies
anchor plantSafety [0.95, 0.92]
component itSocPlatform [0.70, 0.60]
component otProtocols [0.80, 0.45]
component assetInventory [0.55, 0.50]
component otPlaybooks [0.35, 0.55]
component physicalImpactTriage [0.30, 0.60]
component aiTriage [0.15, 0.40]
component purdueModel [0.75, 0.30]
itSocPlatform -> plantSafety
otProtocols -> itSocPlatform
assetInventory -> itSocPlatform
otPlaybooks -> itSocPlatform
physicalImpactTriage -> otPlaybooks
aiTriage -> physicalImpactTriage
purdueModel -> assetInventory
evolve aiTriage 0.30
evolve otPlaybooks 0.55
evolve physicalImpactTriage 0.50

OWASP and ThreatModCon 2026 Plans

A logistics-and-community post rather than a technical one: Shostack + Associates lay out their week at OWASP Global AppSec USA and ThreatModCon in San Francisco, November 2–7. Highlights include a three-day Threat Modeling Intensive Using AI, a book signing, a career-growth panel on the “Age of AI”, and Adam Shostack’s main-stage talk arguing the EU Cyber Resilience Act will be cloud-scale engineering change, not a legal-department problem. There is a booth (G8) and the usual conference hallway track. For threat-modeling practitioners it is a useful marker of where training, tooling, and regulation are converging.

Watch for:

• The AI-augmented threat-modeling curriculum and how practitioners receive it.
• How CRA compliance expectations reach engineering teams versus legal.
• ThreatModCon sessions and the community follow-up material they produce.

Wardley signals:

• Components: OWASP Global AppSec; ThreatModCon; threat-modeling training; AI-assisted threat modeling; the EU Cyber Resilience Act; Shostack + Associates; the conference community and booth.

• Evolution stage: threat modeling as a discipline is Custom-to-Product (established but still craft-heavy); AI-augmented threat modeling is Genesis (new); the CRA is Genesis-to-Custom (newly binding and still being interpreted); conferences are Product (an established format).

• Doctrine hits/misses: hits — “A bias towards open” (community conferences), “Provide purpose, mastery & autonomy” (training and skills), “Listen to your ecosystem” (regulation signals). Misses — none clearly apply.

• Climatic patterns: “Components can co-evolve (practice with activity)” (AI changes threat-modeling practice); “A ‘war’ (point of industrialisation) causes organisations to evolve” (the CRA as industrialisation pressure); “Change is not always linear”.

• Diffusion markers: training courses, book signings, and panels; regulation (the CRA) pushing practice standardisation across the EU market.

• Our OWASP and ThreatModCon plans, now with dates, times, and one fewer fireside

wardley-beta
%% 1. Users: threat-modeling practitioners and security engineers
%% 2. Needs: build skills, connect with the community, understand regulation
%% 3. Capabilities: training, conference community, AI-augmented threat modeling, regulation readiness
%% 4. Components: OWASP Global AppSec, ThreatModCon, threat-modeling training, AI threat modeling, EU Cyber Resilience Act, Shostack + Associates
%% 5. Maturity: OWASP AppSec (Product/Commodity), ThreatModCon (Product), training (Product), AI threat modeling (Genesis), CRA (Custom), Shostack + Associates (Product)
%% 6. Managed by: OWASP community, conference organisers, training providers, EU regulators
anchor practitionerSkill [0.95, 0.92]
component owaspAppSec [0.80, 0.70]
component threatModCon [0.60, 0.65]
component threatModelingTraining [0.55, 0.60]
component aiThreatModeling [0.25, 0.55]
component cyberResilienceAct [0.35, 0.75]
component shostackAssociates [0.70, 0.40]
owaspAppSec -> practitionerSkill
threatModCon -> practitionerSkill
threatModelingTraining -> owaspAppSec
aiThreatModeling -> threatModelingTraining
cyberResilienceAct -> owaspAppSec
shostackAssociates -> threatModelingTraining
evolve aiThreatModeling 0.35
evolve cyberResilienceAct 0.55

AI Progress in Charts

Ethan Mollick’s “30 Months on the Exponential” measures the gap between his two AI books with charts — and, tellingly, by delegating the chart-making itself to an agentic model. He notes no single model holds the lead for long: roughly twenty models have topped the field since GPT-4, and 180 models now beat GPT-4 at its release, nineteen of them phone-runnable. On METR’s long-horizon benchmark the amount of human work an AI can do doubled eight times, then the benchmark itself ran out; other estimates reach 17 weeks. Meanwhile the cost of a correct answer has collapsed, even as the frontier stays jagged.

Watch for:

• Successor benchmarks now that METR’s long-horizon measure has saturated.
• Price-per-capability trends and open-weights parity with frontier models.
• Which domains remain stubbornly weak despite headline gains.

Wardley signals:

• Components: frontier LLMs (GPT-4, Claude/Opus, Gemini); agentic orchestration; the METR long-horizon benchmark; open-weights models; phone-class inference; per-answer inference cost; charts-as-artifact.

• Evolution stage: LLM inference is Product trending Commodity (falling prices, many providers, phone deployment); frontier capability is Product (competitive and feature-differentiated); agentic orchestration is Custom (emerging); benchmarking is Custom (methods are breaking down).

• Doctrine hits/misses: hits — “Bias towards data” (benchmark-driven claims), “Challenge Assumptions” (Mollick questions his own “28 months” framing), “Use appropriate tools” (delegating chart work to an agent). Misses — “You cannot measure evolution over time or adoption, you need to embrace uncertainty” is echoed by the benchmark saturating.

• Climatic patterns: “Change is not always linear (discontinuous & exponential change exists)”; “Efficiency enables innovation (Componentisation effect)”; “Evolution of communication mechanisms can increase the speed of evolution overall”; “Shifts from product to utility tend to demonstrate a punctuated equilibrium”.

• Diffusion markers: 180 models surpassing GPT-4; nineteen runnable on smartphones; open-weights availability; collapsing price per correct answer; agentic delegation becoming normal workflow.

• 30 Months on the Exponential (in Charts)

wardley-beta
%% 1. Users: AI practitioners and decision makers tracking capability and cost
%% 2. Needs: understand the AI capability trajectory and the cost of using it
%% 3. Capabilities: frontier capability, agentic orchestration, open-weights access, benchmark measurement, cost tracking
%% 4. Components: frontier LLMs, agentic orchestration, open-weights models, phone inference, METR benchmark, inference cost, chart artifacts
%% 5. Maturity: frontier LLMs (Product), agentic orchestration (Custom), open-weights (Product), phone inference (Product/Commodity), METR benchmark (Custom), inference cost (Commodity), chart artifacts (Product)
%% 6. Managed by: frontier labs (OpenAI/Anthropic/Google), open-weights community, benchmark researchers, users
anchor aiDecision [0.95, 0.90]
component frontierLLMs [0.55, 0.75]
component agenticOrchestration [0.30, 0.65]
component openWeightsModels [0.70, 0.55]
component phoneInference [0.80, 0.45]
component metrBenchmark [0.25, 0.45]
component inferenceCost [0.90, 0.60]
component chartArtifacts [0.65, 0.35]
frontierLLMs -> aiDecision
agenticOrchestration -> frontierLLMs
openWeightsModels -> aiDecision
phoneInference -> openWeightsModels
metrBenchmark -> frontierLLMs
inferenceCost -> aiDecision
chartArtifacts -> aiDecision
evolve agenticOrchestration 0.45
evolve inferenceCost 0.95
evolve openWeightsModels 0.75

Battle Drones Vibe-Coded RTS

Simon Willison’s Battle Drones is a browser RTS in the spirit of Command & Conquer, built almost entirely by coding agents — around 321 commits, mostly Claude Code — across a dozen major iterations. It runs on mobile and desktop, ships 3D units, fog of war, several maps plus a random generator, skirmish and Last Stand modes, distinct AI personalities, and even agent-vs-agent play. Its standout trick is multiplayer between nearby phones synchronised by audio messages, an extension of his earlier Chirp Pong experiment. Willison reviewed almost none of the TypeScript — a candid data point on how far vibe-coding can stretch a single-person project.

Watch for:

• Whether audio-based multiplayer holds up beyond two nearby devices.
• Quality and maintainability costs of agent-generated code at this scale.
• Follow-on experiments in agent-vs-agent play and vibe-coded games.

Wardley signals:

• Components: Battle Drones; coding agents (Claude Code); the TypeScript/browser stack; 3D models; audio-based multiplayer; random map generator; game AI personalities; agent-vs-agent mode.

• Evolution stage: browser game engines and WebGL are Commodity; RTS game mechanics are Product (a well-understood genre); coding-agent-driven development is Custom-to-Product (rapidly maturing tooling); audio-sync multiplayer is Genesis (novel).

• Doctrine hits/misses: hits — “Think fast, inexpensive, restrained and elegant” (rapid iteration), “Bias towards action” (ship and playtest), “Use appropriate tools”. Misses — “Know the details” (the author admits reviewing almost none of the code) and “Manage failure” (little visible maintainability or testing discipline).

• Climatic patterns: “Efficiency enables innovation” (cheap code generation enables many iterations); “Higher order systems create new sources of value”; “Change is not always linear”.

• Diffusion markers: a public write-up and playable demo; agentic coding workflows spreading; a prior experiment (Chirp Pong) reused as a base pattern.

• Battle Drones - a vibe coded RTS with audio-based multiplayer

wardley-beta
%% 1. Users: mobile/desktop gamers and the developer experimenting with agentic coding
%% 2. Needs: a fun, playable RTS with working multiplayer
%% 3. Capabilities: game engine, RTS mechanics, coding-agent toolchain, multiplayer sync, game AI
%% 4. Components: Battle Drones, coding agents, browser WebGL, audio multiplayer, RTS mechanics, game AI personalities, agent-vs-agent mode
%% 5. Maturity: Battle Drones (Product), coding agents (Custom/Product), WebGL (Commodity), audio multiplayer (Genesis), RTS mechanics (Product), AI personalities (Custom), agent-vs-agent (Genesis)
%% 6. Managed by: solo developer plus coding agents (Claude Code), browser platform
anchor playerExperience [0.95, 0.90]
component battleDrones [0.60, 0.80]
component codingAgents [0.40, 0.60]
component browserWebGL [0.85, 0.50]
component audioMultiplayer [0.15, 0.55]
component rtsMechanics [0.65, 0.60]
component gameAIPersonalities [0.45, 0.45]
component agentVsAgent [0.20, 0.35]
battleDrones -> playerExperience
codingAgents -> battleDrones
browserWebGL -> battleDrones
audioMultiplayer -> battleDrones
rtsMechanics -> battleDrones
gameAIPersonalities -> battleDrones
agentVsAgent -> gameAIPersonalities
evolve audioMultiplayer 0.30
evolve agentVsAgent 0.30
evolve codingAgents 0.55