20,700 CVEs, A Fake Build Step And One Matching SHA-1: The Provenance Gate Nobody Built

Beazley Security's second-quarter threat report counts more than 20,700 newly disclosed vulnerabilities, a 36 percent rise, against a 10 percent rise in confirmed exploitation in the wild ^[1][2]. In the same quarter the machinery that turns raw disclosure into a usable record started dropping work: NIST stopped enriching every CVE it receives, HackerOne paused new submissions to its Internet Bug Bounty program, Pwn2Own rejected contestant applications for the first time, and Cisco rebuilt its disclosure model to bundle several flaws under a single CVE, which the report notes is a departure from how CVE IDs are supposed to work ^[3][4][5][6].

Beazley attributes the volume to agentic AI: the section carrying the finding is titled "Agentic AI Leads to Tidal Wave of Reported Vulnerabilities" and points at the sudden arrival of Anthropic's Mythos model ^[7]. The number to hold onto is not 20,700. It is the filter ratio. Roughly 5,600 of those CVEs were high risk, and Beazley Security Labs issued 21 advisories against them, up 40 percent from the previous quarter ^[8]. That is about one advisory per 267 high-risk CVEs ^[9]. Selection is the product now, and every selection step in that path is staffed by people who read.

That matters beyond vulnerability triage, because the same asymmetry runs through every place where code and its description come to rest: package registries, CI pipelines, type-approval certificates, firmware images. Those are durable state. What sits between a write to them and the world is usually a human, a build step that reports its own status, or nothing.

The gate that reports success without doing the work

The clearest specimen this month is StubMaker, the RubyGems campaign that OpenSourceMalware found on 15 August 2026: typosquatted gems that install a multi-stage Windows infostealer ^[15]. The install hook downloads exactly one file, a 22 MB Rust loader from a GitHub release, and that loader carries an 11 MB Go stealer inside its own data section rather than fetching it ^[16].

The interesting part is not the payload, it is the gate. RubyGems expects `extconf.rb` to configure and build a native C extension. StubMaker builds nothing: it writes a Makefile with empty `all`, `install` and `clean` targets plus Unix and Windows stub scripts that do nothing but return success, so the extension phase reports a clean build while the real work happens in the installer hook ^[17]. A check existed, it ran, and it returned green, because the thing being checked was allowed to supply its own definition of success. According to the researchers, there is also no second-stage download and no C2 for the payload itself, so a defender waiting for a second network fetch before treating this as a compromise never gets one ^[18].

Then the identity layer. The campaign's second publisher account was able to push a new version of a package name that had already been taken down, which matches a maintainer-acknowledged RubyGems.org behaviour: once all versions of a gem are yanked, the namespace opens for any account to claim, the original owner has no special reclaim right, and there is no documented reservation period ^[19]. The name is durable state with a first-come write path and no review at all.

Scale is the other half. Beazley records TeamPCP hijacking TanStack's CI/CD pipeline in May and pushing malicious packages to NPM; the compromise lasted only a few hours and still produced more than 500 million infected downloads ^[10]. The same actor breached GitHub's own internal systems, exposing 3,800 repositories belonging to organisations that had nothing to do with the original compromise ^[11]. A gate whose reaction time is measured in hours is not a gate when distribution is measured in hundreds of millions.

The check a machine can run, six years late

Set against that, look at what actually caught the Slovak speed cameras, because it is the opposite kind of control. Zive.sk reports that the Slovak Metrology Institute issued a type certificate for the NERO R-ONE road speed meter on 30 June 2026, listing measuring software version "5" in point 13 and, in point 14, the SHA-1 checksum eda7d49e2749f84194cf8448081e870277f02033 ^[20]. In the Russian state register of measuring instruments, a document dated 31 December 2020 for the KORDON-V system lists software SimFWCordon_V 5.0 with the same 40-character string ^[21].

Zive.sk sets out why that is dispositive: SHA-1 always yields forty characters, any change to the file changes the whole output, and the probability that two independently written programs produce the same SHA-1 is practically nil ^[22]. The outlet is careful about scope. It says the match does not by itself mean the Petersburg company Simicon, which it names as the maker of KORDON-V and of that software, built the entire NERO R-ONE, only that with practically total certainty the same measuring software runs inside both ^[23].

Two things follow. First, the answer was printed on the certificate. It sat in a public record for years and required no access, no reverse engineering and no cooperation to find, only a comparison, and the comparison was done by an anonymous tipster rather than by any of the bodies that signed the paperwork. Second, the human gates in this procurement failed in the ordinary way: Risky Business reports the cameras were bought under a no-bid direct contract from a Cyprus shell company with fake certifications, as part of a 30 million euro EU-funded project, with 279 cameras installed on Slovak roads ^[27]. Slovakia's NBU has now issued a security alert saying the devices contain a backdoor that executes malicious code delivered by SMS from a list of hardcoded Russian phone numbers ^[24]. Its technical report adds that SecureBoot is switched off, so firmware origin is never enforced, that the web management portal has multiple vulnerabilities, and that the cameras expose live streams to anyone who knows the broadcasting IP, without a password ^[26]. SecureBoot off is precisely the missing deterministic check: with it on, the provenance question is answered at every boot instead of by journalists reading appendices.

There is a genuine discrepancy in the record worth flagging. The NBU, per Risky Business, describes the cameras as a rebranded version of a Russian model named CORDON PRO.M produced by a St Petersburg firm it renders as Semicon ^[25], while zive.sk's hash match is against KORDON-V and names the St Petersburg firm Simicon ^[23]. Same city, different model designation and spelling. The Interior Ministry initially denied that the cameras were Russian and said there was no data theft risk because they would sit on a closed-loop ministry network; it has since paused deployment and ordered an independent auditor to confirm the NBU findings ^[28].

Copied code keeps its fingerprint whether you want it to or not

The provenance argument cuts both ways, and the sharpest illustration is on the state side. Computer Weekly reports that the French implant used against EncroChat phones relied on the Bad Binder bug and that its code had been copied from GitHub ^[29] - the public proof of concept, `poc.c`, is 379 lines credited to Jann Horn and Maddie Stone of Google Project Zero and dated 3 October 2019 ^[33]. The bug sat unpatched for two years inside 2.5 billion phones ^[30]. Felix Freiling of FAU, quoted in that report, said the recovered code "looks like a student project", poorly written, prone to repeated failure and lacking elementary countermeasures against detection ^[31].

The consequence is legal, not technical. Because the artefact was assembled from public code, a Czech rehack recovered digital fingerprints matching French evidence distributed across Europe, proving how messages had been copied, and lawyers quoted by Computer Weekly say the exposure is likely to restart the Investigatory Powers Tribunal case that has been adjourned for more than two years ^[32]. Copied code carries its origin into durable state and outlives the secrecy claim wrapped around it. That is the same physics as the radar hash, pointed at a different party.

Generation is cheap; verification is the whole product

None of this says machine-written code is worthless. PortSwigger's James Kettle has built what he calls the HTTP Terminator, an autonomous system that generates and tests tens of thousands of candidate HTTP desync techniques and has already produced methods he had not thought of ^[34]. Note the verb: tests. The stated upshot of that discussion is that AI can conduct genuinely novel security research, that the hard part is evaluating machine-generated ideas without drowning in false positives, and that nobody should expect to one-shot an army of robot hackers ^[35].

Beazley's report shows both ends of that distribution in the same quarter. Sysdig documented JADEPUFFER, which it assessed as the first ransomware campaign run end to end by a large language model ^[13]. At the other extreme, researchers analysing Iranian-linked ICS malware found code riddled with logic errors, likely hallucinated by the model that wrote it ^[14]. Same class of tool, opposite outcomes, and the variable between them is whether anything checked the output before it shipped.

What it constrains

The identifier layer is degrading at exactly the moment automation needs it to be reliable. Cisco bundling multiple flaws under one CVE ^[6] means a CVE ID no longer resolves to one defect, which is the assumption behind every mechanical "is this fixed" query downstream. Hunt.io's CameraSwarm work shows the failure already in the wild: the CVE label attached to the operator's persistent-backdoor technique, CVE-2024-39943, belongs to an unrelated command-injection flaw in Rejetto HTTP File Server, and the technique is real while the identifier is wrong ^[36]; the relay component inherits CVE-2025-31702, whose Dahua advisory describes a narrower post-authentication privilege escalation at CVSS 6.8 that is not in CISA's KEV catalogue and is not the unauthenticated abuse documented ^[37]. Hunt.io also notes the toolkit is assembled rather than authored, credited to at least six upstream developers, so running it establishes use and not authorship ^[38]. Mislabelled identifiers plus copied components is the provenance problem in its purest form.

Meanwhile the front door has not moved: 67 percent of ransomware intrusions in the quarter started with compromised credentials against exposed VPN and RDP, and another 14 percent with malware via SEO-poisoned installers ^[12]. The volume wave is not changing how attackers get in. It is changing what your own record of your own software is worth.

The one control in this material that does not depend on anyone reading anything is Microsoft removing WMIC outright: from the August 2026 update, Windows 11 versions 24H2 and 25H2 no longer include it and it is no longer available as a Feature on Demand, so it cannot be brought back ^[39]. That took five years of staged deprecation, from Windows 10 21H1 in 2021, through conversion to a Feature on Demand in 22H2 and disabling by default in Windows 11 25H2 ^[40]. Capability removal is slow and unpopular and it is the only kind of gate in this story that cannot report a false green.

What to watch: whether NIST enrichment, the Internet Bug Bounty and Pwn2Own restrictions are temporary or become the steady state ^[3][4][5]; whether other vendors follow Cisco in decoupling CVE IDs from individual flaws ^[6]; whether the Slovak independent audit confirms the NBU findings and what happens to the 279 installed cameras ^[28][27]; and whether registries close the yanked-namespace reclaim path that let a second account push code under a name that had already been taken down ^[19].