Your Zero-Trust Platform Has a CVSS 10

Two recent stories share an uncomfortable quality: the products organizations deploy to enforce security controls have become the most attractive targets on the network.

Cisco Secure Workload: Maximum Severity in a Security Product

CVE-2026-20223 earned a perfect CVSS 10.0 in Cisco Secure Workload's REST API. An unauthenticated remote attacker can reach the endpoint and read sensitive data — no credentials required. Secure Workload is positioned as a zero-trust microsegmentation platform; the irony of a trust-enforcement tool carrying an unauthenticated data exposure is hard to overstate. Cisco has patched it. Customers with internet-exposed Secure Workload management planes should treat this as urgent, not scheduled.

AI Builder Infrastructure Under Active Exploitation

CISA added vulnerabilities in Langflow and Trend Micro Apex One to its Known Exploited Vulnerabilities catalog, citing confirmed active exploitation. Langflow is an open-source visual builder for AI agents and LLM pipelines — the kind of infrastructure that has proliferated rapidly as teams prototype automation workflows. Its presence in the KEV catalog signals that threat actors are now actively scanning for AI development tooling, not just traditional enterprise software. Federal agencies have the standard 21-day remediation window; the broader takeaway is that any internet-exposed Langflow instance should be treated as a target of active campaigns.

The .de Meltdown: DNSSEC as a Single Point of Failure

On May 5, DENIC published broken DNSSEC signatures for the .de top-level domain, making millions of .de domains unreachable to validating resolvers. Cloudflare's post-mortem documents what 1.1.1.1 observed and how serving stale records cushioned the impact. The episode surfaces an underappreciated failure mode: DNSSEC, while defending against cache poisoning, introduces hard-fail behavior when signatures are malformed or expired. A misconfigured signing operation at the TLD level cascades instantly and broadly, whereas no DNSSEC at all would have left resolution intact. Serving stale buys time — but it papers over a correctness failure the signing authority introduced.

Kimwolf Botmaster Arrested After IoT DDoS Campaign

Canadian and U.S. authorities arrested a 23-year-old Ottawa man suspected of running Kimwolf, an IoT botnet that enslaved millions of devices and launched large-scale DDoS attacks. The enforcement action is a reasonable win, but botnet infrastructure rarely disappears with an arrest. Compromised device pools and operational playbooks tend to persist — absorbed by other operators or reconstituted under different branding. The underlying problem is the same one it has been for fifteen years: consumer IoT devices ship with weak credentials and no meaningful patch lifecycle.

AI Cybersecurity Benchmarks: The Hype Flattens

Researchers testing Mythos — a model that attracted significant attention for claimed cybersecurity capabilities — found that GPT-5.5 performs comparably on the same evaluations. The finding doesn't mean neither model is capable; it means the "breakthrough specific to one model" framing doesn't hold. Offensive capability in this domain appears to be converging across frontier models. What matters operationally is whether attackers are running AI-assisted tooling against defenders who aren't — and that gap is organizational, not model-specific.

The common thread across these stories is proximity to the control plane. The security product, the AI builder, the DNS root — attackers have learned to aim above everything else, because compromise there propagates silently and widely before anyone thinks to look.