Salesforce Portals Bled for 17 Months While Nobody Watched

Think of enterprise security like the CCTV in a small-town petrol station. The cameras are pointed at the till, the door, and the fuel pumps. Meanwhile, someone has been walking out the back door with the stock room contents for a year and a half, and nobody has bothered checking the tape from that angle. That is roughly what happened with the campaign researchers at Reco are calling City-Forum, which spent 17 months quietly pulling records out of Salesforce and ServiceNow portals around the world.

Seventeen months. Not seventeen days. That is the number that should ruin the weekend for anyone running a SaaS-heavy stack.

The Numbers

The City-Forum story is the headliner, but the week's security news reads like a stress test of every assumption modern engineering teams have been making. As Help Net Security reported, the campaign is named after a domain registered back in 2002, abandoned, and now resolving to a generic rented server at a German hosting provider. Cheap infrastructure, forgotten branding, patient exfiltration. The attacker's opsec budget was probably lower than the average team's monthly Datadog bill.

Then there is Framework, the San Francisco outfit that builds repairable laptops. They got hit through a zero-day in Metabase, the business intelligence tool. Names, email addresses, phone numbers, physical addresses, and login IP addresses walked out the door. Payment data and order records did not, which is the only silver lining in an otherwise grim disclosure. Anyone who has stood up a Metabase instance in a hurry to give the growth team a dashboard knows exactly how that BI box ends up with access it never should have had.

Microsoft's August Patch Tuesday shipped fixes for more than 400 vulnerabilities, one already exploited as a zero-day (CVE-2026-68820) and three publicly disclosed before the patches landed. Cisco confirmed CVE-2026-20349, a high-severity flaw being used to knock its firewalls offline, now sitting on CISA's KEV catalog with a US federal remediation deadline of August 14. N-able pushed a second hotfix for N-central to slow down active exploitation of CVE-2026-18577, the RMM tool that a large chunk of MSPs use to reach into their customers' networks.

And a group of researchers at Nanyang Technological University pointed AI agents at 4G and 5G network software, walking away with 84 previously unreported flaws. Developers confirmed 83. Eighty-one now carry CVE numbers. Twenty-three still have no fix.

What's Actually New

Two things this week are genuinely different from the usual patch-and-pray cycle, and both point in the same direction: the boring bit of your architecture is where it all falls over.

The first is City-Forum. This is not a supply chain compromise, not a novel CVE, not a wormable RCE. It is somebody using portals the way they were designed to be used, at scale, against poorly configured tenants, for a year and a half. The petrol station analogy holds. Nothing broke. The cameras were pointing at the wrong door. Guest access, community portals, unauthenticated API endpoints in Salesforce and ServiceNow have been a known-quantity risk for years. What is new is the sheer duration. Seventeen months of egress that neither the SaaS vendors nor the customers flagged as anomalous.

The second is GitHub extending Dependabot's malware alerts from npm alone to eight ecosystems: npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. Since March, if you were pulling a poisoned package from anywhere except npm, GitHub was silent. Dependabot runs across more than 30 million repositories and covers 34-plus ecosystems for regular dependency updates, which means the malware pipeline was watching a fraction of the attack surface it had visibility into. That gap is now closed. It should have been closed eighteen months ago.

The NTU research is the third quietly significant story. AI agents finding 84 real flaws in telecom software is not a party trick anymore. It is a preview of what a well-resourced adversary can do to any codebase with enough surface area. Twenty-three of those flaws have no fix. Telecom vendors are not exactly known for shipping patches at internet speed, and that gap between disclosure and mitigation is where the next Salt Typhoon-style campaign lives.

What's Priced In for Security Teams

Most of this week is priced in. A 400-vulnerability Patch Tuesday is a Tuesday. Cisco firewalls getting DoS'd is Tuesday. RMM tools like N-central being actively exploited is, sadly, also Tuesday. MSPs have been the softest supply chain in the industry since Kaseya, and CVE-2026-18577 is another instalment in that long-running series. Anyone who has run an MSP tenant knows the pain: patch cadences that slip because a customer's production window is at 3am on the second Sunday of the month, and by the time the maintenance window arrives the exploit is already public.

The Framework breach is priced in too, though it deserves a bit more attention. Metabase, Retool, Superset, Redash, and the rest of the internal-tools cohort are almost always given database credentials that would make a security auditor weep. It is the classic pattern: read-only, they say, until someone needs to write a quick ops query, and now the BI tool has DML rights on the customer table. When that BI tool gets a zero-day, the blast radius is the entire warehouse.

What is not priced in: City-Forum's dwell time. Seventeen months of undetected exfiltration from two of the most instrumented SaaS platforms on the planet suggests our collective detection story for SaaS is worse than the industry likes to admit. Vendor-side anomaly detection is optimised for account takeover and mass scraping. Slow, patient, portal-scoped enumeration slips right through.

Contrarian View

The easy read on this week is that AI is now both the attacker's best friend and the defender's, and everything is getting worse faster. I'd push back on half of that.

The NTU work does not prove attackers have magic. It proves that codebases sitting in low-attention corners of the industry (telecom, industrial control, medical devices) are riddled with flaws that would have been found years ago if anyone had bothered fuzzing them properly. AI agents are a productivity multiplier on top of techniques that have existed for a decade. The story is not "AI found 84 bugs". The story is "84 bugs were sitting there, and it took AI to make anyone care".

Brian Honan of BH Consulting made a related point this week, reaching for Stanislav Petrov, the Soviet officer who in 1983 refused to trust a false alarm about a US nuclear launch and probably prevented a war. Honan's argument is that recent incidents at OpenAI, Hugging Face, Anthropic, Meta, and the UK's AI Security Institute deserve board-level attention because human judgement still matters. He is right, but the corollary is uncomfortable: most organisations do not have a Petrov, and most SOCs are being asked to become one.

Key Takeaways

• SaaS portal exposure is the new perimeter. If Salesforce and ServiceNow tenants can bleed data for 17 months undetected, your SSPM strategy needs the same rigour you give EDR. Audit guest access, community portals, and unauthenticated API endpoints this week, not next quarter.
• Internal BI tools deserve production-grade threat modelling. Framework's breach came through Metabase. Any BI, dashboarding, or admin tool with warehouse credentials is now firmly in the crown-jewel category. Treat it like one.
• Patch the RMM tier first. CVE-2026-18577 in N-central is being actively exploited. If you are an MSP or you rely on one, the second hotfix needs to be applied before the next customer maintenance window, not after.
• Dependabot's expansion closes a real gap. Turn malware alerts on across all eight ecosystems now that PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer are covered. This is free signal you were not getting since March.
• Detection engineering has not caught up with dwell time. The petrol station has too many cameras pointed at the till and not enough on the back door. Budget accordingly for 2027.

Coming back to the CCTV in the petrol station: the cameras were never the problem. The problem was assuming that pointing them at the till meant the whole shop was covered. City-Forum ran for 17 months because everyone was watching the front door. The next campaign is already running somewhere in your SaaS estate. The question is how many months in you are when someone finally checks the tape from the right angle.