This week, attacks reached systems that tell other systems what to do—from routers, RMM and firewall managers to browsers, artifact repositories and an oil pipeline—turning concentrated authority into concentrated operational risk.