decrypted · 18 august 2026 · ransomware and cybercrime · vulnerabilities and patching · ai and llm security

The SAP Commerce Cloud key that came fitted to every door

A maximum-severity flaw in SAP Commerce Cloud, the e-commerce platform underneath a good number of UK retail sites, is already being probed by attackers days after SAP patched it. The cause is not exotic: the software shipped with a default authentication client baked into every installation. Elsewhere this week, researchers found three separate ways to turn a single GitHub issue into a credential-theft channel against the AI coding agents now sitting in developer pipelines, and a two-person UK dry cleaner turned up on a ransomware leak site after infostealer malware had already lifted its staff logins.

A key that fits every lock

CVE-2026-58231 sits in the Data Hub Adapter extension of SAP Commerce Cloud (the platform formerly known as Hybris) and scores a perfect 10.0 on CVSS. The flaw lets an unauthenticated attacker abuse a default authentication client, one that ships identically with every deployment, to submit crafted input to functions that do not validate it properly. The result is arbitrary code execution.

SAP patched it on 12 August. Defused, a threat intelligence firm, saw exploitation attempts hitting its honeypots just three days later, before any public proof of concept existed. Shadowserver now counts over 4,200 internet-facing Commerce Cloud instances, most of them in Europe.

Think of it as a lock manufacturer fitting every front door in the country with the same spare key, then only mentioning it once burglars started trying handles. Knowing the key exists is most of the work; the rest is just trying doors.

What UK retailers should take from it

Commerce Cloud is not a niche product here. New Look completed a migration onto the platform in December, citing over £4 million in savings from the more resilient setup, a useful reminder of how embedded this software is in UK retail's plumbing. The Secure by Design lesson is not "patch faster", though that matters too. It is that a credential shared identically across every customer's install is a single point of failure disguised as a feature: convenient to ship, catastrophic once anyone works out it is there. The fix is defaults that are unique per install and authentication that is on by default on internal APIs, not something a customer has to remember to switch on. Anyone running Commerce Cloud should already have applied the August patch or restricted the vulnerable endpoint with an IP filter; the exposure count alone is reason not to wait for confirmation of harm first.

Also this week

AI coding agents leaked CI secrets through a single GitHub issue. Researchers presenting at Black Hat found that Claude Code (CVE-2026-54316) and Gemini CLI (CVE-2026-12537, CVSS 10.0) could both be steered by crafted GitHub issue content or configuration files into leaking credentials or running code on the CI runner behind them, no privileged access required. Anthropic and Google have shipped fixes, and researchers say neither bug has been exploited in the wild so far. The underlying issue is architectural rather than a one-off bug: these agents run with broad tool access in the same environment as the secrets they are meant to protect from untrusted input. Any UK team running AI coding agents in its pipelines should treat issue and comment content as untrusted by default, not just for these two products.

A ransomware listing that needed no exploit at all. A small UK dry-cleaning firm, All Parts Dry Cleaning, appeared on the Medusalocker group's leak site this week. Researchers tracking the group note that infostealer malware had already harvested login details from two of the firm's staff before the ransomware itself arrived, the leak site claim is Medusalocker's own and unverified beyond that listing, but it fits a familiar pattern. No zero-day, no clever chain, just credentials stolen months earlier and never rotated. It is a useful corrective for anyone assuming ransomware coverage is only about household names: basic hygiene, credential rotation and multi-factor authentication remain the best defence most small organisations have, and often the only one they need.

Sources

Working through what any of this means for your own systems? Get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.