Daily security briefing: ZBT router implants, GraphQL exhaustion, and AI defense

Today's five stories look unrelated at first: factory firmware implants, a GraphQL denial-of-service flaw, a seven-year-old SQL Server vulnerability entering CISA's exploited catalog, a government study of recurring weakness classes, and an industry call to put stronger AI in defenders' hands. The common thread is trust. A logo does not prove a router's firmware is clean, a complexity score does not prove a query is cheap, a completed patch job does not prove a host was never compromised, and a capable security agent is not safe without identity, scope, and auditability.

The urgent work is concrete: identify ZBT-derived hardware, move affected AshGraphQL deployments to 1.11.0 or later, and treat any previously unpatched SQL Server affected by CVE-2019-1068 as an incident-response lead. The longer-term lesson is equally practical: prioritize reachable and exploitable attack paths, then verify that the fix changed the real system behavior.

What to do first

1. ZBT routers shipped with two root-capable implants

VulnCheck bought a Deep Orange cellular router sold in the United States and traced it to a white-labelled ZBT-WE826-T2. The firmware did not contain the earlier ENDLESSDOORS implant the researchers were looking for. It contained two different, previously undocumented implants instead: SPEAKINGSTONE, assigned CVE-2026-74232, and DARKLANTERN, assigned CVE-2026-74233.

Both CVE records score 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0. Both run from the same connectivity watchdog and ultimately reach a root command dispatcher, but their network models differ. DARKLANTERN waits for inbound traffic. SPEAKINGSTONE calls outward and waits for instructions. That distinction determines which controls can see or stop them.

DARKLANTERN: an internet-facing listener on UDP/9992

DARKLANTERN runs as infosrvd. The router's default firewall permits inbound UDP/9992, and a 19-byte probe returns device details. Command packets are protected by a hard-coded checksum scheme and a MAC-address check, but the protocol accepts an all-zero MAC value. A crafted payload reaches a shell command as root. In practical terms, those checks are not an authentication boundary.

VulnCheck observed 203 internet-facing instances across 22 countries between 18 and 21 August. The devices self-reported 16 models, so this is not confined to the one router the researchers purchased. The United States accounted for 103 observations. These are scan results, not a complete installed-base estimate, and an unresponsive device is not proof of clean firmware.

SPEAKINGSTONE: a phone-home channel that works behind NAT

SPEAKINGSTONE runs as yunmgrd and beacons outward over UDP/10000. Its protocol supports arbitrary command execution, PPPoE credential collection, DNS changes, reverse SSH tunnels, and C2 updates. An outbound implant does not need the router to be directly reachable, so simply placing the device behind another firewall does not remove the risk.

VulnCheck registered an abandoned backup domain embedded in the firmware and sinkholed 392 unique devices by 21 August; 390 were in China. The primary C2 remained live, so that number covers only devices that reached the backup domain. It is evidence of active deployments, not a ceiling on the population.

What defenders should do

• Inventory the underlying board and firmware, not just the consumer brand. ZBT hardware is sold under multiple labels. VulnCheck's appendix lists observed models and firmware; it also makes clear that not every rebranded ZBT platform examined contained an implant.
• Look for infosrvd, yunmgrd, and the launching inetdetect path; review inbound UDP/9992 and outbound UDP/10000. Treat ac-link[.]com and findmyipaddr[.]com as investigation pivots, not as standalone proof of compromise.
• Isolate an affected device, preserve its firmware and logs, rotate PPPoE and other secrets that crossed it, verify DNS settings, and inspect internal systems for traffic or trust relationships that the router could have influenced.
• Prefer replacement when a trustworthy, independently verifiable clean firmware image is unavailable. A factory implant is a supply-chain trust failure, not an ordinary package update waiting to be installed.

2. AshGraphQL complexity accounting can underprice an expensive query

CVE-2026-81636 affects ash_graphql versions 0.16.23 through 1.10.x and is fixed in 1.11.0. The GitHub advisory rates it High at 8.7 under CVSS 4.0. An unauthenticated client can use Relay or keyset pagination arguments such as first and last to pass a configured Absinthe query-complexity limit while still forcing unexpectedly large resolver and database work.

The vulnerable calculation multiplied child complexity when it saw an offset-paginationlimit, but not for first or last. The advisory's reproduction shows equivalent nested queries taking very different paths: the limit version was blocked, while the Relay form passed the same cap and materialized 10,100 rows. A small syntactic query can therefore hide a large execution fan-out.

• Upgrade to ash_graphql 1.11.0 or later. Confirm the resolved production dependency, rebuilt artifact, and running release rather than relying only on a lockfile change.
• Exercise limit, first, and last across nested relationships and compare the score with actual rows, resolver calls, query time, memory, and database load.
• Keep rate limits, request deadlines, database statement timeouts, maximum page sizes, and concurrency controls. Complexity analysis is one layer, not a complete resource budget.

3. CVE-2019-1068 is now confirmed exploited

CISA added CVE-2019-1068 to the Known Exploited Vulnerabilities catalog on 26 August. The entry describes a Microsoft SQL Server remote-code-execution vulnerability that can run code in the security context of the SQL Server Database Engine service account. Its federal due date was 29 August, two days before this briefing.

Public detail on the current exploitation remains limited. That is a reason to avoid overclaiming a specific campaign or exploit chain, not a reason to defer action. KEV tells us the threshold that matters for prioritization: CISA has evidence of exploitation in the wild. An affected server that was exposed or reachable from a hostile path should be patched and investigated.

• Use Microsoft's CVE page to map every SQL Server version and servicing branch to the applicable security update. Verify the Database Engine build on each instance; a generally healthy Windows Update status is not enough.
• Reduce network reachability while validating the fix. Preserve SQL, Windows, EDR, proxy, firewall, and identity telemetry before disruptive remediation where practical.
• Hunt for unusual child processes from sqlservr.exe, unexpected SQL Agent jobs, anomalous service-account logons, new persistence, outbound connections, and changes to high-risk server configuration. Compare with the host's established administrative baseline before declaring an event malicious.
• If execution is plausible, rotate credentials and tokens available to the Database Engine service account and investigate downstream systems it could access.

4. CISA's data argues against CVSS-only prioritization

CISA's FY2024-FY2025 Vulnerability Review compares the broad CVE population with the KEV catalog and hands-on risk assessments. It finds that KEVs concentrate in a smaller set of repeatable weakness categories. Memory-safety and improper-input-validation weaknesses are disproportionately represented in KEV compared with the full CVE population, while injection continues to appear at high volume.

Figure 1.1 groups 7,701 FY2024 and 21,019 FY2025 entries under injection-related CWEs. Those are category-association counts in the report's flow diagram; they should not be treated as a deduplicated count of unique vulnerabilities. CISA's accompanying text says injection-related weaknesses represented 10.1% of all CVEs in FY2024 and 9.2% in FY2025.

The operational takeaway is not to replace one single score with another. Use evidence in a deliberate order: confirmed exploitation, internet or hostile-path exposure, exploit prerequisites, the reachable attack path, the security boundary crossed, asset value, and the strength of compensating controls. CVSS still describes intrinsic technical severity; it simply cannot describe all of that deployment-specific risk by itself.

5. More than 100 organizations call for stronger AI cyber defense

OpenAI's collective cyber-defense letter is signed by more than 100 technology, cybersecurity, infrastructure, and financial organizations, including Anthropic, Google, Microsoft, AWS, CrowdStrike, Cloudflare, GitHub, and OpenAI. Its central claim is that the defender's window is limited: AI-enabled attacks are expected to become more capable, while the same models can help defenders remove accumulated weaknesses faster.

The proposal is more specific than a call to “use AI.” It asks governments to expand trusted access programs for defenders, cybersecurity providers to test continuously and share threat intelligence and playbooks, and frontier labs to provide responsible model access, funding, training, observability, and monitoring. It also says agentic identities should be traceable and accountable.

For pentesting agents, that points toward capability with governance, not capability without limits. A serious control plane needs a verified operator, an authorized target and scope, short-lived credentials, explicit tool and egress policy, immutable action logs, kill and pause controls, and independent verification of findings and fixes. Model safety behavior is useful, but it is not a substitute for infrastructure-enforced authorization.

Today's defensive checklist

• Find hidden ZBT lineage. Check model, board, MAC OUI, firmware, and process artifacts across cellular routers and rebranded edge appliances; isolate confirmed affected devices and plan replacement where trust cannot be re-established.
• Close the GraphQL bypass. Upgradeash_graphql to 1.11.0+, then test that nested Relay pagination is rejected or bounded according to real backend cost.
• Treat the SQL KEV as incident work. Verify the installed SQL build, reduce exposure, preserve evidence, hunt service-account activity, and rotate reachable secrets when execution cannot be ruled out.
• Re-rank the backlog. Put exploitation evidence and reachable attack paths ahead of severity-score sorting, while retaining CVSS as one technical input.
• Make security agents accountable. Bind identity, authorization, scope, tools, egress, logs, stop controls, and human review before granting frontier capability.

Primary sources

• VulnCheck — Chinese Implants in the Supply Chain; CVE Program — CVE-2026-74232 and CVE-2026-74233.
• ash-project — GHSA-mwc4-r9fc-h6mg / CVE-2026-81636.
• CISA — Known Exploited Vulnerabilities catalog; Microsoft — CVE-2019-1068 Security Update Guide.
• CISA — CISA Vulnerability Review and the accessible FY2024-FY2025 report.
• OpenAI and signatories — A call for collective action on cyber defense.