Uncloaked: Three Security Companies, Three Ways In, One Uncomfortable Fortnight

Uncloaked: Three Security Companies, Three Ways In, One Uncomfortable Fortnight

It's tempting to assume security companies are the hardest targets on the internet. The last two weeks suggest otherwise. A blockchain intelligence firm, a certificate authority and a server security vendor all disclosed incidents, and none of them came down to a dazzling new technique.

One was an intrusion the company says used AI agents. One was a sign-up page left reachable after a migration. One was stolen credentials used to push a malicious update. We're a security company too, so we read these with some humility. Here's what happened.

1. Chainalysis: an intrusion the company calls "agentic"

What happened

Chainalysis, whose tools are used to trace cryptocurrency for investigators and compliance teams, disclosed that an external actor used "offensive agentic techniques" to get into its systems and internal tools. In plain terms, it says the attacker used AI agents to carry out parts of the intrusion.

The first disclosure said only non-sensitive customer data was involved: user IDs, names, email addresses and organisational role labels. A later update was more serious. It described an "on-path attack" that exposed customer passwords, and reporting since then says names, usernames, password hashes and live tokens for all users were exposed. The company took several products offline, locked affected accounts and said every user will eventually need to reset passwords and rotate API keys.

Chainalysis says it has seen no evidence that investigations data was accessed. It also said it has seen a rise in AI-driven attacks across the industry, with other tech platforms hit in recent weeks.

What we can and can't say

The disclosures don't say which tools were used or how autonomous the attack really was, so treat "agentic" as the company's description rather than a confirmed technical finding. What is clear is the follow-on risk. Names, emails and roles are exactly what a convincing phishing email needs, and live tokens are worth more than passwords because they skip MFA entirely.

If you're a Chainalysis customer, follow the company's guidance on resets and key rotation, and treat any unexpected "reset your password" email with suspicion until you've checked it independently.

2. DigiCert: a sign-up page nobody meant to publish

What happened

DigiCert, one of the largest certificate authorities, confirmed unauthorised access to an internal business system holding archived customer records. According to its incident report, the root cause was a migration in February 2025 that moved the system from a VPN-only network segment to one reachable from the internet.

That move exposed a self-service registration page inherited from the account platform underneath. Anyone could create an account. The new accounts had no MFA and default read-only access, which was still enough to read archived customer records. Unauthorised access happened between 27 June and 2 July 2026, and DigiCert confirmed it as a reportable breach on 19 October.

Exposed data included names, business emails, phone numbers and business addresses, and for a small minority of customers, identity documents such as passports or driving licences submitted for validation. DigiCert says certificate systems, customer logins and issued certificates were not affected, and logs showed no certificate issuance or revocation activity.

Why it matters

DigiCert's own list of contributing factors is refreshingly candid: inadequate security review during the migration, not enough monitoring of account activity, and an authorisation model that never expected self-registration.

This is the most ordinary story of the three, and the most useful. Nobody wrote a vulnerability. Something internal became external during a routine change, and the part of it nobody thought about was the part that mattered. It sat there for well over a year before anyone used it.

Where a scan helps

This is the category outside scanning exists for. A system that only you are meant to reach shouldn't answer the internet at all, and the only way to know it doesn't is to look from outside regularly. Decloak's subdomain discovery finds hosts you may have forgotten, Active Testing's forced browsing requests paths nothing links to, and scheduled scans tell you when something new appears.

The honest limit: we'd find a reachable host or an exposed sign-up page. We wouldn't know that this particular page shouldn't be public unless it was obviously sensitive. That judgement still needs a person who knows what the system is for.

3. OpsShield: a security product that shipped a backdoor

What happened

OpsShield makes cPGuard, security software for Linux web hosting servers. Attackers broke into its billing and licensing server, studied how cPGuard talked to it by signing up for a free trial, then used a stolen access key to push a malicious update through the product's own update channel.

The malicious versions, 5.88.12 to 5.88.19, were live for about 70 minutes, and the company found the attack within 12 hours. The update ran as root on any server that checked in during that window. OpsShield estimates about 2,950 servers installed it. The script collected data, installed a hidden root shell and dropped files in temporary folders. About 7,900 billing account records were also copied, including hashed passwords.

OpsShield has rebuilt its infrastructure, rotated keys, released version 5.88.25 to remove the backdoor and published indicators of compromise. Its advice to affected customers is blunt: treat root SSH keys, MySQL root passwords, password hashes and shell history on infected servers as compromised, and rotate them.

Why it matters

Security software is a perfect supply chain target. It runs with the highest privileges by design, it updates itself automatically, and customers are told to trust it. Seventy minutes was enough to reach thousands of servers.

There isn't much an outside scan can do about a backdoor installed on the server itself. What you can control is the blast radius: fewer secrets stored on web servers, separate credentials per server, and a known process for rotating everything quickly when a vendor tells you it's been compromised.

What the three have in common

None of these companies lacked security expertise. What they lacked, briefly, was visibility of one thing: a page that became public, a key that leaked, an intrusion moving faster than expected. That's the uncomfortable lesson for everyone else. Expertise doesn't stop drift. Regular, boring checks of what is actually exposed are what catch it.

We'll be watching how the Chainalysis investigation develops, particularly whether more detail emerges on the AI-assisted side of the attack.

Related reading:

• The Staging Subdomain You Forgot About Is Still Online (And Still Logged In)
• Active Testing Explained: What Decloak's DAST Layer Probes, and What It Leaves Alone
• Uncloaked: When the Company Selling Identity Protection Gets Phished Itself Sources: SecurityWeek on Chainalysis, The Hacker News on Chainalysis, GBHackers on DigiCert, SecurityWeek on OpsShield

Find out what your own infrastructure shows the internet before someone else does. Run a free scan →