Switched On, Not Enforcing: The Security Gap Four Reports Priced This Month

A security control can be switched on and still do nothing. That gap sat under several unrelated pieces of research this month, and reading them together is worth more than reading any one, because each measured the same mistake in a different currency: kernel memory, cloud credentials, card payments, and threshold signatures.

The cleanest demonstration is a kernel exploit writeup by Youssef Charfeddine. Working against a deliberately vulnerable Windows driver on a Windows 11 build, he expected Supervisor Mode Access Prevention, or SMAP, to crash his exploit the instant the kernel read one of his ROP gadgets out of a user-mode page ^[1]. SMAP was enabled; the relevant CR4 bit was set ^[2]. It did nothing. The reason is a second flag: SMAP is suppressed whenever the AC bit in RFLAGS is set, the syscall hardware mask does not clear that bit, and Charfeddine's tests showed the Windows kernel entry path sets it to 1 no matter what user mode did beforehand ^[3]. He forced the bit to 0 in his own user-mode client, and the driver still read it as 1 ^[4]. His conclusion was that SMAP was already neutered by the time his code ran, and that this was by design rather than accident ^[5].

Hold onto that shape: the control is present and an inventory would list it as on, while a separate decision elsewhere in the same system quietly turns it off. The failure is not the absence of the control but the assumption that its presence means enforcement.

The credential that was flagged and left live

Truffle Security put a count on the same shape in cloud credentials. On August 10, 2026 the firm re-verified 10,616 leaked AWS keys that had surfaced in public places between August 2022 and August 2026, and 88 percent of them still authenticated ^[6]. 768 carried full control of a company's AWS account: 526 root keys plus 242 IAM users holding AdministratorAccess ^[7]. That is 7.2 percent of the re-verified set handing over an entire company account ^[1]. The median live leaked key was five years old and had never been rotated ^[8].

The detection was not missing. AWS runs a policy called AWSCompromisedKeyQuarantine that it attaches to keys it has already spotted as exposed, restricting what they can do, and 929 of the 7,590 active IAM user keys Truffle enumerated carried it ^[9]. Of those, 112 carried the original version of the policy, which AWS stopped applying in 2023, meaning AWS had flagged them at least three years earlier and notified their owners, and they still authenticate ^[10]. Truffle's own summary is blunt: AWS detected the exposure, and nobody acted on it ^[11]. The control fired. The account owner treated the alert as optional.

The check nobody was actually doing

The same delegation failure runs through card payments. A team at the University of Massachusetts Amherst built a rig that intercepts a contactless transaction, rewrites the expiration date, and relays it to a point-of-sale terminal, reviving expired cards for fresh transactions ^[12]. It works because the NFC payment data is not fully encrypted, and the expiration field can be changed without breaking the card's signature ^[13]. The reason nobody had looked, the researchers say, is that everyone assumed banks enforce the expiration check, whereas in practice banks typically leave that check to the POS terminal and trust its decision ^[14]. On terminals for three of the four major providers, Mastercard, American Express, and Discover, the edit broke the signature and the transaction failed ^[15]. On Visa terminals it worked, and none of the five banks in the study caught it on their backends ^[16]. The equipment is ordinary NFC emulators and POS terminals sold online; the only awkward step is getting hold of an expired card ^[17].

Here the control genuinely exists in some places and is simply absent in others, and no one holding the assumption could tell the difference until someone tested it. That is the AWS defect moved down a layer: the party supposed to be enforcing had delegated the job and stopped checking that it was done.

Why the auth upgrade lands on the same list

The point generalizes to the layer most defenders are currently upgrading. In a sponsored Risky Business interview on August 24, 2026, Push Security's VP of Research Luke Jennings argued that stronger authentication is pushing attackers toward the authorization layer, and that device code phishing can survive passkeys and phishing-resistant MFA ^[18]. His practical recommendation was that defenders check whether their controls against these attacks actually work, rather than assume a deployed control covers the attack ^[19]. Deploying passkeys is the enabling step. Whether they stop the attack in front of you is the enforcement question, and the two are not the same.

What the reports are really specifying

The DeFi world wrote the test plan out loud. CertiK estimated that Maya Protocol lost about 1.7 million dollars this month to a single exploit that chained six separate bugs across accounting, liquidity, and outbound transactions ^[20]. Maya's parent project THORChain had lived through a 10.7 million dollar hack in May whose post-mortem blamed not one dramatic flaw but three older bugs that only became dangerous when combined, and which noted the same latent bug existed on Maya and had not yet been triggered ^[21]. THORChain's solvency checks only noticed the problem after the hack was over ^[22]. The lesson its writeup draws is the one all of these reports point at: protocols need to test the interactions between security controls, not just individual vulnerabilities ^[23].

That is the specification hiding inside a month of otherwise unrelated incident reports. An inventory that records which controls are present answers the wrong question. SMAP was present and disarmed on every syscall. The AWS quarantine policy was present and ignored. The card expiration rule was present at the bank and delegated away at the terminal. Passkeys are present and bypassable at the next layer. In each case the enforcement lived somewhere other than where the presence was recorded, and nobody had tested the join.

The consequence worth sitting with is what changes after the measurement. Once a defect is quantified and its owner has been told, leaving the control unenforced stops being a tradeoff between security and effort and becomes a documented decision. Truffle says it is notifying every owner it could identify ^[24]. The UMass team named Visa and the banks whose backends missed the edit ^[16]. Charfeddine published the exact mechanism by which the kernel disarms SMAP ^[5]. After that, not knowing is no longer available, and the state of the control belongs to a named party who has been shown where it fails.