Exposed Cairn logs recorded human-directed agent intrusions across Asia

CLM-VULONE-CAIRN-1 reports: The recovered platform recorded access in 48 of 66 active projects: six root/SYSTEM, 39 non-root command execution and three webshell outcomes. These are operator records, partly corroborated with surviving collection logs, not 48 independently verified victims. Source SRC-2026-CP17-VULONE-CAIRN is located at '6.1 Access obtained; paragraph immediately preceding 6.1'. The distinctive mechanism begins: VULONE reported recovering an exposed AI-assisted intrusion control panel and reviewing 66 active projects, with evidence of access in 48: six root/SYSTEM, 39 non-root command execution and three webshell-only. Classification: setting=production, exploit_status=observed_live, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=unknown; scoped control or limit: Investigate the exposed management interface and verify the target-side authentication, command and exfiltration logs independently. Never translate recovered operator claims directly into confirmed losses without victim or transaction evidence. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.

Assessed Oct 23, 2026 using diggingbeagle.assessment/1.

Evidence basis: CLM-VULONE-CAIRN-1 · CLM-VULONE-CAIRN-2 · VULONE: An exposed Cairn operator infrastructure