# Exhibits

Canonical machine-readable index for exhibits.

- **Public registry:** https://record.cybersecurityhq.com/exhibits
- **Record count:** 24

- [CHQ-EX-2026-001: Identity as Configuration, Not Evidence](./CHQ-EX-2026-001.md)
- [CHQ-EX-2026-002: Embedded Vendor Authority in Enterprise Systems](./CHQ-EX-2026-002.md)
- [CHQ-EX-2026-003: Centralized Update Infrastructure as Execution Surface](./CHQ-EX-2026-003.md)
- [CHQ-EX-2026-004: Historical Cost Structure of Trust Signal Production](./CHQ-EX-2026-004.md)
- [CHQ-EX-2026-006: CrackArmor: Confused Deputy Vulnerabilities in Linux AppArmor](./CHQ-EX-2026-006.md)
- [CHQ-EX-2026-007: BlackSanta: BYOVD-Based EDR Neutralization Campaign](./CHQ-EX-2026-007.md)
- [CHQ-EX-2026-008: Marquis Servicer Breach: Cascade Across 700+ Financial Institutions](./CHQ-EX-2026-008.md)
- [CHQ-EX-2026-009: GlassWorm Wave 1–3: Multi-Registry Supply Chain Campaign](./CHQ-EX-2026-009.md)
- [CHQ-EX-2026-010: Rust Crates CI/CD Supply Chain Attack: hackerbot-claw & Trivy Extension Compromise](./CHQ-EX-2026-010.md)
- [CHQ-EX-2026-011: Hive0163/Slopoly: First Confirmed AI-Generated Ransomware Tooling](./CHQ-EX-2026-011.md)
- [CHQ-EX-2026-012: ZOMBI RAT: Solana Blockchain C2 and Self-Propagating Credential Theft](./CHQ-EX-2026-012.md)
- [CHQ-EX-2026-013: Interlock Ransomware: Cisco FMC Zero-Day Exploitation Campaign](./CHQ-EX-2026-013.md)
- [CHQ-EX-2026-014: TeamPCP: Institutional Infrastructure Compromise via CI/CD Supply Chain](./CHQ-EX-2026-014.md)
- [CHQ-EX-2026-015: UNC1069/Axios: North Korean Supply Chain Compromise via Maintainer Account](./CHQ-EX-2026-015.md)
- [CHQ-EX-2026-016: LiteLLM CVE-2026-42208: AI Gateway Pre-Authentication Credential Extraction](./CHQ-EX-2026-016.md)
- [CHQ-EX-2026-017: Mini Shai-Hulud (TeamPCP): SAP CAP and PyTorch Lightning Cross-Registry Compromise](./CHQ-EX-2026-017.md)
- [CHQ-EX-2026-018: GitHub CVE-2026-3854: Remote Code Execution via Single Git Push Command](./CHQ-EX-2026-018.md)
- [CHQ-EX-2026-019: Microsoft Entra Agent ID Administrator Scope Overreach](./CHQ-EX-2026-019.md)
- [CHQ-EX-2026-020: Security Vendor Source Code Exposure Class: Checkmarx and Trellix](./CHQ-EX-2026-020.md)
- [CHQ-EX-2026-021: Miasma (TeamPCP): Microsoft and Red Hat Supply Chain Recompromise via AI Coding Agent Vector](./CHQ-EX-2026-021.md)
- [CHQ-EX-2026-022: JadePuffer: First Documented Agent-Operated Ransomware Operation](./CHQ-EX-2026-022.md)
- [CHQ-EX-2026-023: AsyncAPI: Parallel Publishing-Identity Compromise with Import-Time Execution](./CHQ-EX-2026-023.md)
- [CHQ-EX-2026-024: Hugging Face Intrusion: Evaluated Agents Escape a Frontier-Lab Sandbox and Reach a Third Party](./CHQ-EX-2026-024.md)
- [CHQ-EX-2026-025: Operator-Environment Escalation: Agents Exploit a Host Kernel Flaw, Exit Their Container, and Reach Cloud Secrets](./CHQ-EX-2026-025.md)