https://soc2prep.ca/brief A free weekly email for teams getting ready for SOC 2: the week's incidents that trace back to a control an auditor tests, with a take on each. en-CA https://soc2prep.ca/brief/8-patch-netscaler-then-read-the-labcorp-terms https://soc2prep.ca/brief/8-patch-netscaler-then-read-the-labcorp-terms Tue, 29 Sep 2026 13:00:00 +0000 A stolen OAuth token from a former employee's laptop. CrowdSec confirmed that attackers took the contents of 170 private repositories from its GitHub organisation. Your AI agents are logging in as humans and SOC 2 cannot tell. A vendor-authored piece argues that AI agents often operate through human credentials, so actions taken by an agent look identical to actions taken by the person whose credentials it borrowed. https://soc2prep.ca/brief/7-fake-government-requests-real-ai-attacks https://soc2prep.ca/brief/7-fake-government-requests-real-ai-attacks Tue, 22 Sep 2026 13:00:00 +0000 A departed employee's GitHub account was still live, and 170 private repos walked. CrowdSec disclosed that an attacker copied roughly 170 of its private GitHub repositories in May using the account of an employee who had recently left the company. A regulator has now logged an AI agent as the attacker. The Spanish data protection agency received a breach report describing an attack carried out by an AI agent running on a known large language model. Exposed Vite dev servers are being scanned for cloud keys. F5 Labs described an automated mass-scanning campaign hunting internet-exposed Vite development servers. https://soc2prep.ca/brief/6-revolut-handed-data-to-a-fake-government-request https://soc2prep.ca/brief/6-revolut-handed-data-to-a-fake-government-request Tue, 15 Sep 2026 13:00:00 +0000 Passkey enrolment is the new phishing target. Microsoft detailed two campaigns abusing third-party email delivery infrastructure. https://soc2prep.ca/brief/4-what-cisas-two-red-teams-say-about-your-soc-2 https://soc2prep.ca/brief/4-what-cisas-two-red-teams-say-about-your-soc-2 Tue, 01 Sep 2026 13:00:00 +0000 JFrog Artifactory flaw lands in the KEV catalogue. CISA added three actively exploited vulnerabilities to the Known Exploited Vulnerabilities catalogue: an ownCloud authentication flaw, an unspecified Linux kernel issue, and a path traversal issue in JFrog Artifactory. https://soc2prep.ca/brief/3-a-cvss-10-in-entra-id-and-a-breach-that-grew-tenfold https://soc2prep.ca/brief/3-a-cvss-10-in-entra-id-and-a-breach-that-grew-tenfold Tue, 25 Aug 2026 13:00:00 +0000 Rust crates that ran malware at compile time. The Rust Project removed malicious versions of three widely used crates from crates.io after a compromised maintainer account published releases adding a typosquatted dependency. Microsoft patches a 10.0 in Entra ID. Microsoft patched CVE-2026-69836, a remote code execution flaw in Entra ID carrying a CVSS score of 10.0, which was initially reported as exploited in the wild. https://soc2prep.ca/brief/2-secrets-in-build-artifacts-and-who-gets-blamed https://soc2prep.ca/brief/2-secrets-in-build-artifacts-and-who-gets-blamed Tue, 18 Aug 2026 13:00:00 +0000 The LiteLLM fallout is a CI credential problem, not an AI problem. A 153GB archive stolen in the LiteLLM supply chain attack has surfaced, containing 433,909 files. An AWS key in a public JavaScript bundle took down 1,000 charity CRMs. CRM provider Beacon disclosed a breach affecting more than 1,000 UK charities.