Friday, 16 October 2026

Investigating Ephemeral Supply Chain Tampering (opens in a new tab)

Google Threat Intelligence ·Google Threat Intelligence Group ·fetched 16 Oct 2026, 15:35 UTC Must read Research

Why readGoogle Threat Intelligence details short-burst supply chain tampering against AOMEI servers that deployed CROSSROAD and SHINYROAD malware.

Google Threat Intelligence Group analyzed a campaign where attackers modified AOMEI origin server configurations for five to ten minute windows between April and July 2026. This ephemeral tampering evaded automated file scanners and point-in-time triage to deliver a payload chain including the CROSSROAD downloader and SHINYROAD backdoor.

cloud.google.com → (opens in a new tab)

Hackers Use Codex and DeepSeek AI Agents to Breach 440 PaperCut Servers Worldwide (opens in a new tab)

Cybersecurity News ·Tushar Subhra Dutta ·fetched 16 Oct 2026, 15:35 UTC Must read CVE-2026-81578 EPSS 63.5%

Why readActive campaign uses AI agent frameworks paired with DeepSeek models to exploit PaperCut vulnerabilities across 440 servers.

Threat actors used OpenAI Codex harnesses and DeepSeek models to automate exploit development and target PaperCut NG/MF servers globally. The campaign weaponizes CVE-2026-81578 and CVE-2026-82078 to breach print servers, gather credentials, and pivot into corporate networks. Hunt.io and GreyNoise analysis uncovered exposed attacker directories containing agent instructions and operational logs.

cybersecuritynews.com → (opens in a new tab)

PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager (opens in a new tab)

Security Affairs ·Pierluigi Paganini ·fetched 16 Oct 2026, 11:36 UTC CVE-2024-47575 EPSS 94.8%

Why readExplains how attackers leveraged CVE-2024-47575 on FortiManager to deploy PEERSTITCH malware and compromise over 500 downstream FortiGate firewalls.

Unit 42 detailed an intrusion campaign tracked as UNC5820 where attackers exploited CVE-2024-47575 in FortiManager to exfiltrate cryptographic material and configuration files for 500 FortiGate firewalls. The threat actors deployed PEERSTITCH, a stealthy in-memory implant, to maintain persistent access within telecommunications infrastructure.

Also covered byThe Hacker News (opens in a new tab).

securityaffairs.com → (opens in a new tab)

Targeted ads delivered 0-click exploits to install mercenary malware (opens in a new tab)

Ars Technica Security ·Dan Goodin ·fetched 16 Oct 2026, 03:34 UTC Must read Research

Why readCitizen Lab research exposes AdFection, a campaign using targeted ad networks to deliver zero-click iOS and Android spyware without user interaction.

Citizen Lab identified a zero-click spyware campaign named AdFection that delivers iOS and Android exploits through online advertising networks. The campaign targeted international media organization Al Jazeera, compromising at least 45 devices between 2024 and 2025. The attack mechanism requires no user interaction beyond loading a website or app displaying malicious ad units.

arstechnica.com → (opens in a new tab)

Suspected Kazakhstan-linked hackers target governments across former Soviet states (opens in a new tab)

The Record ·fetched 16 Oct 2026, 03:34 UTC

Why readReports on a Kazakh-linked espionage group tracked as UAT-6275 targeting government agencies across Central Asia and Eastern Europe.

Joint reporting from Cisco Talos and Recorded Future Insikt Group details at least eight cyber-espionage campaigns executed by UAT-6275 (TAG-193) since January 2025. The group targeted government entities in nine countries, including Russia, Belarus, Armenia, and Uzbekistan, focusing on foreign policy, economic planning, and energy sector intel.

therecord.media → (opens in a new tab)

New Aoki Infostealer Targets AI Coding Assistant Credentials (opens in a new tab)

Infosecurity Magazine ·fetched 16 Oct 2026, 03:34 UTC

Why readUpdated Aoki infostealer malware specifically targets API tokens and session credentials for AI development tools like Claude, Cursor, Codex, and Gemini.

Symantec discovered updated variants of the Aoki infostealer targeting local session files and API tokens for AI coding assistants including Anthropic's Claude, OpenAI's Codex, SpaceX's Cursor, and Google's Gemini. Stolen tokens allow adversaries to execute actions under valid developer credentials and access connected repositories and CI/CD pipelines.

infosecurity-magazine.com → (opens in a new tab)

Risky Bulletin: DataSuckers suspects arrested in Russia (opens in a new tab)

Risky Business News ·fetched 16 Oct 2026, 03:34 UTC

Why readSummarizes recent law enforcement actions including DataSuckers arrests in Russia, Candiru spyware deployment against media figures, and the disruption of North Korean IT worker farms.

Russian authorities arrested three alleged members of the DataSuckers hacking group. Other notable threat developments include Candiru spyware targeting Al Jazeera staff, US operations disrupting 40 North Korean remote worker laptop farms, and an OpenAI employee arrest involving physical surveillance equipment.

risky.biz → (opens in a new tab)

Group Claiming to be ShinyHunters Posts Fake Breaches (opens in a new tab)

Truesec ·Hjalmar Desmond ·fetched 16 Oct 2026, 07:34 UTC

Why readDetails how scavenger extortion groups are posting fake breaches under established cybercrime brands like ShinyHunters to demand ransom without conducting actual network compromises.

Following arrests of key figures associated with the ShinyHunters brand, impersonators and scavenger groups have filled the void by claiming fake breaches. Threat actors recycle old data or invent compromises on leak sites to extort organizations without gaining unauthorized network access. Incident responders should verify data exposure claims before treating extortion demands as confirmed breaches.

truesec.com → (opens in a new tab)

Fake Arch Linux AUR packages exploit typos to run malware with root privileges (opens in a new tab)

Help Net Security ·Sinisa Markovic ·fetched 16 Oct 2026, 11:36 UTC

Why readWarns Arch Linux users about malicious typosquatting packages in the AUR targeting common helper commands yay and paru.

Attackers uploaded typosquatting packages to the Arch User Repository (AUR) designed to execute malicious code when users mistype helper commands such as yay or paru. Because AUR package build scripts run during installation, installing a typosquatted package gives the malicious script root execution rights. Administrators and users should carefully verify package names before executing AUR helpers.

helpnetsecurity.com → (opens in a new tab)

Ransomware Gangs Increasingly Turn to Threats of Physical Violence to Extort Payments (opens in a new tab)

Infosecurity Magazine ·fetched 16 Oct 2026, 23:34 UTC

Why readHighlights how ransomware operators are increasingly using direct physical and psychological threats against CISOs to force payments.

According to data from Semperis, ransomware operators now include physical or psychological threats against executives in a quarter of observed extortion attempts. The escalation moves beyond encryption and data leak threats to target CISOs and senior staff directly. Organizations should incorporate executive threat management into their incident handling protocols.

infosecurity-magazine.com → (opens in a new tab)

Traffic fine smishing: Fraudulent SMS messages exploit Italian State Police brand to demand urgent payment (opens in a new tab)

translated Smishing a tema multe: SMS fraudolenti sfruttano il nome della Polizia di Stato per richiedere pagamenti urgenti

CERT-AGID (Italy) ·Oleksandr Anankin ·fetched 16 Oct 2026, 11:36 UTC

Why readDetails an Italian smishing campaign using fake traffic fine notices on the GRA to lure victims to poliziadistato[.]info.

CERT-AGID reported a smishing campaign targeting Italian users with fake traffic violation notices on the Grande Raccordo Anulare (GRA). The SMS messages create urgency by offering a reduced fine of 17 euros before threatening a 291 euro penalty and driver's license points. Victims are directed to a phishing domain, poliziadistato[.]info, designed to impersonate the Italian State Police.

cert-agid.gov.it → (opens in a new tab)

BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert (opens in a new tab)

CSO Online ·fetched 16 Oct 2026, 15:35 UTC Must read CVE-2026-102764 EPSS 0.6%

Why readDetails active exploitation of a critical zero-day in BeyondTrust Remote Support appliances by a Chinese espionage group.

Mandiant and Google Threat Intelligence disclosed that Chinese espionage actor ARMORY CASTLE exploited an unauthenticated zero-day flaw in self-hosted BeyondTrust Remote Support appliances to achieve root access. Tracked as CVE-2026-102764 with a CVSS score of 9.3, the vulnerability allows full host compromise and extraction of stored credentials, prompting patch advisory BT26-05.

Also covered byCISA Advisories (opens in a new tab),Cybersecurity Dive (opens in a new tab),Dark Reading (opens in a new tab),SecurityWeek (opens in a new tab),CISA KEV (opens in a new tab).

csoonline.com → (opens in a new tab)

Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 16 Oct 2026, 03:34 UTC Must read CVE-2026-110447 EPSS 1.2%

Why readThreat actors are actively exploiting zero-day command injection flaw CVE-2026-110447 in Nextcloud's built-in Collabora CODE server to deploy backdoors.

Attackers are actively exploiting CVE-2026-110447, an unauthenticated OS command injection vulnerability in Nextcloud's built-in Collabora CODE server app (richdocumentscode prior to version 26.4.303). Exploitation involves sending crafted requests to the proxy.php endpoint while the CODE server is stopped, executing system commands to backdoor host servers. Standalone Collabora installations and Nextcloud All-in-One setups are unaffected.

Also covered byNVD (opens in a new tab).

bleepingcomputer.com → (opens in a new tab)

CVE-2025-61624: Fortinet Multiple Products, Fortinet Multiple Products Path Traversal Vulnerability (opens in a new tab)

CISA KEV ·fetched 16 Oct 2026, 19:33 UTC CVE-2025-61624 Exploited in the wild · patch by 2026-10-19 EPSS 0.6%

Why readFortinet path traversal bug (CVE-2025-61624) affecting FortiOS and FortiProxy added to CISA KEV.

FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability allowing authenticated admins with read-write permissions to delete or write arbitrary files via CLI commands. CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog with an action deadline of October 19, 2026.

fortiguard.fortinet.com → (opens in a new tab)

Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 16 Oct 2026, 03:34 UTC Research CVE-2026-99999

Why readA Linux kernel networking flaw dubbed PwnEscape (CVE-2026-99999) enables guest VMs to extract host memory and escape cloud hypervisor isolation.

Security researcher Paulos Yibelo demonstrated CVE-2026-99999 (PwnEscape), a flaw in the Linux kernel networking subsystem allowing guest VMs to breach hypervisor boundaries. By transmitting crafted network packets, a guest virtual machine can extract 32 bytes of host memory per packet, facilitating cross-tenant data leakage or host compromise. The issue was demonstrated on production cloud sandboxes before responsible disclosure.

Also covered byCSO Online (opens in a new tab).

thehackernews.com → (opens in a new tab)

U.S. CISA adds Atlassian flaw to its Known Exploited Vulnerabilities catalog (opens in a new tab)

Security Affairs ·Pierluigi Paganini ·fetched 16 Oct 2026, 15:35 UTC CVE-2026-21589 EPSS 12.7%

Why readCISA added CVE-2026-21589, a critical arbitrary file access flaw in Atlassian Data Center software, to its Known Exploited Vulnerabilities catalog.

CISA added CVE-2026-21589 to its KEV catalog following active exploitation against Atlassian Data Center products including Bitbucket, Confluence, and Jira. The vulnerability allows unauthenticated attackers to read specific files within the web application root directory if the exact file path is known.

securityaffairs.com → (opens in a new tab)

CVE-2026-104795 (CVSS 8.8): The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting. When scanni (opens in a new tab)

NVD ·fetched 16 Oct 2026, 23:34 UTC CVE-2026-104795 CVSS 8.8 EPSS 0.2%

Why readTarget workloads can trick the privileged insights-runtime-extractor DaemonSet into executing host-privileged arbitrary binaries.

The insights-runtime-extractor Kubernetes DaemonSet runs with hostPID and re-enters container namespaces to fingerprint binaries. Flaws in credential drop checks and execution of workload-controlled argv[0] paths allow a container workload to achieve host privilege escalation. Defenders running this extractor should update immediately.

nvd.nist.gov → (opens in a new tab)

CVE-2026-104935 (CVSS 8.6): Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not (opens in a new tab)

NVD ·fetched 16 Oct 2026, 15:35 UTC CVE-2026-104935 CVSS 8.6 EPSS 26.0%

Why readPatch Ivanti Connect Secure before version 25.1.3.0 to block a remote unauthenticated authentication bypass and arbitrary command execution flaw.

An authentication bypass flaw in Ivanti Connect Secure (ICS) allows remote, unauthenticated attackers to execute arbitrary commands by spoofing authentication requests. The vulnerability impacts ICS versions prior to 25.1.3.0, while legacy releases on 22.7R2.14 and earlier are unaffected.

nvd.nist.gov → (opens in a new tab)

CVE-2026-105445 (CVSS 9.4): An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassi (opens in a new tab)

NVD ·fetched 16 Oct 2026, 15:35 UTC CVE-2026-105445 CVSS 9.4 EPSS 0.4%

Why readA flaw in Docker Hub account conversions allowed attackers to reassign active Personal Access Tokens to target users without invalidating the secret.

An incorrect privilege assignment vulnerability in Docker Hub account-to-organization conversion permitted authenticated attackers to transfer active Personal Access Tokens (PATs) to target users. Because token secrets were neither rotated nor revoked during transfer, the attacker token retained full access under the recipient identity, granting pull, push, and delete permissions on accessible repositories.

nvd.nist.gov → (opens in a new tab)

CVE-2026-74035 (CVSS 8.6): Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and p (opens in a new tab)

NVD ·fetched 16 Oct 2026, 11:36 UTC CVE-2026-74035 CVSS 8.6 EPSS 0.5%

Why readUpdate Wazuh immediately to fix an authentication logic flaw that lets user admins hijack superuser accounts.

Wazuh's user update endpoint mishandles password truthiness checks when enforcing reserved user protections. A delegated user administrator can pass an empty password string to bypass reserved account guards, takeover the Wazuh superuser account, and authenticate without credentials.

nvd.nist.gov → (opens in a new tab)

CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability (opens in a new tab)

Zscaler ThreatLabz ·Sai Nikhil Perla (Threat Researcher) ·fetched 16 Oct 2026, 23:34 UTC CVE-2026-107406 EPSS 1.1%

Why readExamine how unauthenticated attackers exploit CVE-2026-88771 to achieve remote code execution on Citrix NetScaler devices.

Zscaler ThreatLabz analyzes CVE-2026-88771, a critical unauthenticated remote code execution vulnerability in Citrix NetScaler ADC and Gateway currently under active wild exploitation. The flaw requires no optional features enabled and is listed on CISA's KEV catalog. The analysis details execution paths and notes related risks in SAML-configured deployments.

zscaler.com → (opens in a new tab)

Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229) (opens in a new tab)

Rapid7 ·Jonah Burgess ·fetched 16 Oct 2026, 15:35 UTC Research CVE-2026-97229 EPSS 0.5%

Why readRapid7 published a technical analysis and working command-execution PoC for the CVSS 10.0 integer overflow in GitLab CI/CD regular-expression processing.

Rapid7 detailed the exploitation mechanism of CVE-2026-97229, a CVSS 10.0 integer overflow vulnerability in GitLab CI/CD regex handling affecting versions prior to 19.4.2, 19.3.5, and 19.2.8. Researchers successfully developed a reliable end-to-end exploit achieving arbitrary command execution as the git service account on 64-bit Linux with ASLR enabled by committing a malicious CI configuration and specially named project path.

rapid7.com → (opens in a new tab)

CVE-2026-74040 (CVSS 9.4): Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluste (opens in a new tab)

NVD ·fetched 16 Oct 2026, 11:36 UTC CVE-2026-74040 CVSS 9.4 EPSS 0.6%

Why readWarns of a critical path traversal vulnerability in Wazuh manager that lets compromised cluster workers overwrite configuration files and achieve root RCE across all agents.

Wazuh versions 3.9.0 through 4.14.7 contain a critical arbitrary file overwrite bug in MasterHandler.process_files_from_worker. Attackers controlling a cluster worker node can use a trailing-slash basename bypass to overwrite ossec.conf or agent.conf, gaining root execution across the Wazuh manager and connected endpoints. Fixed in version 4.14.8.

nvd.nist.gov → (opens in a new tab)

Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD (opens in a new tab)

Hacker News ·rs_rs_rs_rs_rs ·fetched 16 Oct 2026, 23:34 UTC Must read Research 156 points

Why readLearn how a 37-year-old integer overflow in OpenBSD SysV shared memory handling was chained into local root privilege escalation bypassing KARL, SMAP, and SMEP.

Researchers detailed the exploitation of a 16-bit signed short integer overflow in OpenBSD shared memory attachment counters dating back to original 1980s BSD source code. By wrapping the counter through repeated process forks and using sysctl memory statistics for heap grooming, the exploit triggers a use-after-free and combines it with an out-of-bounds write to achieve local root without requiring an information disclosure vulnerability.

calif.io → (opens in a new tab) Discussion (opens in a new tab)

Signal Messenger Security: A Research Case Study (opens in a new tab)

IOActive ·Christian Powills ·fetched 16 Oct 2026, 15:35 UTC Research

Why readDetails how Signal Desktop's screen-capture protection on Windows can be bypassed from an external process.

IOActive evaluated Signal Desktop's screen-capture protection mechanism on Windows, which relies on setting window display affinity. Research showed that while standard administrative process calls fail, the affinity control can be removed externally by reversing ownership checks in the Windows graphics stack.

ioactive.com → (opens in a new tab)

MAppPrint: Robust and Real-time Mobile App Fingerprinting via Traffic Behavior Correlation Graphs (opens in a new tab)

arXiv cs.CR (all) ·Tao Duan, Junzhou Zhao, Jianglong Li, RongHua Li ·fetched 16 Oct 2026, 15:35 UTC Research

Why readIntroduces a traffic behavior correlation graph technique to fingerprint encrypted mobile application traffic in real time.

Researchers presented MAppPrint, a framework designed to identify mobile applications from encrypted network traffic despite dynamic network conditions and multi-app concurrency. The technique models traffic patterns using Traffic Behavior Correlation Graphs combined with a fingerprint compression algorithm for low-latency analysis.

arxiv.org → (opens in a new tab)

Microsoft: October Windows update may break Smart App Control (opens in a new tab)

BleepingComputer ·Sergiu Gatlan ·fetched 16 Oct 2026, 11:36 UTC

Why readAlerts Windows administrators that October security update KB5127648 can disable the toggle for Smart App Control on Windows 11 24H2.

Microsoft confirmed that installing update KB5127648 on Windows 11 version 24H2 or later grays out the Smart App Control toggle if the feature was turned off. Devices with Smart App Control already enabled remain protected and functional. Microsoft has provided Group Policy and registry workarounds for enterprise administrators until a permanent fix is issued.

bleepingcomputer.com → (opens in a new tab)

Subgraph Counting with Local Node Differential Privacy (opens in a new tab)

arXiv cs.CR (all) ·Sofya Raskhodnikova, Adam Smith, Connor Wagaman, Anatoly Zavyalov ·fetched 16 Oct 2026, 07:34 UTC Research

Why readPresents an optimal algorithm for counting arbitrary constant-size subgraphs in distributed networks while preserving local node differential privacy.

Researchers designed a noninteractive local node differential privacy (LNDP) algorithm that estimates subgraphs with additive error bounded by polynomial epsilon factors. They also established a matching lower bound, proving the algorithm achieves optimal error for graph analytics beyond basic degree distributions.

arxiv.org → (opens in a new tab)

Why Active Directory weaknesses stay open for years in teams with one or two admins (opens in a new tab)

Help Net Security ·Mirko Zorz ·fetched 16 Oct 2026, 07:34 UTC

Why readOutlines practical lab-testing and rollout strategies for Active Directory hardening across small administrative teams.

An interview detailing a 12-week collaborative hardening initiative across 27 municipal IT teams tackling Active Directory misconfigurations. It covers structured lab testing for high-risk settings including SMB signing, LDAP signing, and Kerberos hardening to prevent operational disruption in understaffed environments.

helpnetsecurity.com → (opens in a new tab)

SMT-Boosted Security Types and Correctness for Low-Level MPC (opens in a new tab)

arXiv cs.CR (all) ·Christian Skalka, Steven Baldasty, Yeonhee Yeh, Felix Walberg ·fetched 16 Oct 2026, 23:34 UTC Research

Why readIntroduces an SMT-backed Hoare logic and type theory to verify correctness and privacy properties in low-level Secure Multi-Party Computation protocols.

Researchers have developed a formal verification framework using SMT solvers to automatically prove correctness, confidentiality, and integrity in MPC protocols written in Prelude/Overture. The approach is compositional and generalizes across prime fields and secret-sharing schemes. It provides developers of privacy-preserving distributed systems with automated guarantees against protocol logic bugs.

arxiv.org → (opens in a new tab)

Chainguard Libraries expands to Go and .NET (opens in a new tab)

Chainguard ·fetched 16 Oct 2026, 07:34 UTC

Why readDetails Chainguard's expansion of Go and .NET package scanning alongside backported CVE fixes for older runtimes.

Chainguard has added Go and .NET support to its library feeds, introducing pre-pull malware scanning and configurable release cooldowns to counter supply-chain attacks. The update also moves Java CVE backporting to general availability and opens betas for JavaScript and Go security patch backports on legacy versions.

chainguard.dev → (opens in a new tab)

My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale (opens in a new tab)

arXiv cs.CR (AI) ·Zeqian Huang, Mingyue Tang, Aonan Guan, Qiming Sun ·fetched 16 Oct 2026, 03:34 UTC Must read Research

Why readReveals that 16.4 percent of triaged MCP servers allow filesystem capability laundering outside declared tool scopes.

Researchers analyzed 21,097 Model Context Protocol (MCP) servers to evaluate host filesystem access risks when AI agents call external tools. They introduced MCP-FSD to dynamically test permission boundaries, discovering that 787 triaged servers exposed sensitive host files outside their declared contracts. The work demonstrates that client-side tool approval often grants uncontained filesystem permissions to underlying server processes.

arxiv.org → (opens in a new tab)

Poisoning the Neighborhood: A Topology-Aware Topic-Level Attack on Large-Scale HNSW-based RAG Systems (opens in a new tab)

arXiv cs.CR (AI) ·Yufei Chen, Yao Wang, Haibin Zhang ·fetched 16 Oct 2026, 23:34 UTC Must read Research

Why readDetails a topology-aware attack that poisons HNSW-based approximate nearest-neighbor indexes in large-scale RAG deployments.

Researchers introduced a Hub-Satellite attack strategy targeting vector search in RAG systems built on Hierarchical Navigable Small World (HNSW) indexes. Satellite documents establish entry points across semantic regions, while Hub documents manipulate local graph connectivity to manipulate model output. The technique bypasses traditional exact-retrieval attack assumptions by directly exploiting approximate search graph structures.

arxiv.org → (opens in a new tab)

BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition (opens in a new tab)

arXiv cs.CR (AI) ·Zhiyuan Wang, Yuezhi Zhou, Ziqi Zhang, Zhu Zhang ·fetched 16 Oct 2026, 15:35 UTC Research

Why readDemonstrates how mathematical analysis breaks unilateral TEE weight obfuscation in on-device LLMs and proposes a bilateral framework to counter model recovery attacks.

Researchers identified a structural vulnerability in TEE-based LLM parameter protection schemes like GroupCover and ArrowCloak, where unilateral matrix transformations allow attackers to solve for the obfuscation secret. The proposed attack achieves over 2.4 times accuracy compared to black-box baselines to recover model functionality, prompting the design of a bilateral obfuscation framework called BiShield-TEE.

arxiv.org → (opens in a new tab)

Language Is a Security Surface for Agent Guards (opens in a new tab)

arXiv cs.CR (all) ·Hasan Demirkiran, Jens Ernstberger ·fetched 16 Oct 2026, 11:36 UTC Research

Why readDemonstrates that LLM agent security guards change their safety decisions when user instructions are translated into non-English languages.

Researchers built LinguaGuardBench to evaluate 19 LLM agent guards by translating user prompt instructions into five non-English languages while keeping tool outputs and labels unchanged. The study revealed that smaller and open-weights models frequently alter safety verdicts based on language alone, with guard failures increasing for lower-resource languages like Swahili and Amharic.

arxiv.org → (opens in a new tab)

Shortcut Sensitivity in Agent-Safety Evaluations (opens in a new tab)

arXiv cs.CR (AI) ·Hasan Demirkiran, Jens Ernstberger ·fetched 16 Oct 2026, 11:36 UTC Must read Research

Why readShows how dataset shortcut cues in AI agent safety benchmarks artificially inflate guard performance scores.

An audit of safety evaluation benchmarks including LinuxArena and AgentDojo-Traj reveals that evaluation guards rely heavily on shortcut cues like command lengths or exact tool lookups. Under rigorous domain holdout testing, guard performance dropped significantly, with F1 scores falling from 0.901 to 0.495 on AgentDojo-Traj.

arxiv.org → (opens in a new tab)

CVE-2026-55376 (CVSS 8.8): Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can cr (opens in a new tab)

NVD ·fetched 16 Oct 2026, 15:35 UTC CVE-2026-55376 CVSS 8.8 EPSS 0.4%

Why readSelf-hosted AI agent platform Heym prior to 0.0.40 contains a sandbox escape allowing arbitrary system command execution.

Authenticated users in Heym prior to version 0.0.40 can bypass the Python tool executor blacklist sandbox in backend/app/services/python_tool_executor.py. Allowed standard library modules expose operating system and process capabilities through public attributes, enabling arbitrary code execution as the backend user via exec(). Updating to version 0.0.40 restores sandbox boundary enforcement.

nvd.nist.gov → (opens in a new tab)

CVE-2026-65103 (CVSS 8.1): NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker co (opens in a new tab)

NVD ·fetched 16 Oct 2026, 07:34 UTC CVE-2026-65103 CVSS 8.1 EPSS 0.9%

Why readUnauthenticated path traversal in NVIDIA AIStore enables arbitrary file creation and potential RCE.

NVIDIA AIStore for Linux contains a path traversal vulnerability in its target-side object rename handler. Unauthenticated remote attackers can submit malicious rename requests directly to an AIStore target to write outside designated directories. This allows arbitrary file creation or overwrites, leading to potential remote code execution or data tampering.

nvd.nist.gov → (opens in a new tab)

Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation (opens in a new tab)

CISA Advisories ·CISA ·fetched 16 Oct 2026, 19:33 UTC

Why readNIST, NSA, and CISA release incident readiness practices for managing unexpected autonomous actions by advanced AI agents.

NIST, the NSA Super Intelligence Security Center, and CISA published joint guidelines outlining ten practices for incident response during AI model training and evaluation. The document focuses on control incidents where autonomous agents execute uninstructed actions that conflict with established oversight controls.

cisa.gov → (opens in a new tab)

Private Retrieval Augmented Generation via Random Projection (opens in a new tab)

arXiv cs.CR (AI) ·Dixi Yao, Tahseen Rabbani, Tian Li ·fetched 16 Oct 2026, 07:34 UTC Research

Why readProposes a random projection technique to preserve datastore privacy in RAG systems against extraction attacks without requiring formal differential privacy.

Researchers propose using random projection on both query and datastore embeddings in Retrieval Augmented Generation architectures to protect sensitive data. The method preserves semantic retrieval accuracy while mitigating data extraction attacks across multiple datasets and model architectures. Results indicate random projection offers a practical alternative to formal differential privacy for securing RAG deployments.

arxiv.org → (opens in a new tab)

Small Agents, Smaller Blast Radius: Controlling What AI Can Do, (Fri, Oct 16th) (opens in a new tab)

SANS ISC Diary ·fetched 16 Oct 2026, 03:34 UTC

Why readArgues for restricting the functional capability and blast radius of AI agents rather than relying on external guardrails or container cages.

The author challenges current AI security approaches that attempt to contain full-capability models with outer wrappers and human approval checks. Instead, security teams should build smaller, specialized agents with strictly scoped permissions and capabilities to limit the impact when an agent behaves unexpectedly.

isc.sans.edu → (opens in a new tab)

CVE-2026-65164 (CVSS 8.1): NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improp (opens in a new tab)

NVD ·fetched 16 Oct 2026, 07:34 UTC CVE-2026-65164 CVSS 8.1 EPSS 0.8%

Why readPath traversal in NVIDIA AIStore archive extraction component allows file overwrite.

NVIDIA AIStore for Linux features a path traversal flaw in its dSort archive extraction handler. Remote attackers can submit crafted archive member names during dSort operations to bypass directory limitations. Successful exploitation permits writing arbitrary files to the host filesystem.

nvd.nist.gov → (opens in a new tab)

CVE-2026-65172 (CVSS 8.6): NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attac (opens in a new tab)

NVD ·fetched 16 Oct 2026, 07:34 UTC CVE-2026-65172 CVSS 8.6 EPSS 0.4%

Why readAddresses missing authorization checks in NVIDIA AIStore ETL management APIs.

NVIDIA AIStore for Linux and Kubernetes contains an authorization bypass in its ETL management API endpoints. Unauthenticated remote attackers can send crafted HTTP requests directly to an AIStore proxy to inspect or manipulate active ETL jobs. This allows unauthorized interruption or altering of underlying data processing pipelines.

nvd.nist.gov → (opens in a new tab)

The Lawful Access Act’s threats to  Canada’s national security (opens in a new tab)

Citizen Lab ·Anna Mackay ·fetched 16 Oct 2026, 15:35 UTC

Why readCitizen Lab details how Canada's proposed Bill C-22 could mandate surveillance backdoors across software and hardware platforms.

Citizen Lab published an analysis of Canada's proposed Lawful Access Act (Bill C-22), which would allow law enforcement to require surveillance capabilities in communications software and connected devices. The analysis warns that forcing deliberate vulnerabilities into technical infrastructure creates systemic security risks for all users.

citizenlab.ca → (opens in a new tab)

Toxic algorithms wouldn't let them go - now Australia wants an off switch (opens in a new tab)

BBC Technology ·fetched 16 Oct 2026, 23:34 UTC

Why readAustralia introduced legislation requiring social media platforms to offer an opt-out for algorithmic recommendation feeds.

The Australian government submitted legislation mandating that social media platforms allow users to disable recommender algorithms and revert to chronological feeds. The proposed bill also introduces a statutory duty of care for online services, expanding platform regulatory obligations.

bbc.co.uk → (opens in a new tab)

SpaceX policy manager set to testify as part of NYC Council AI safety investigation (opens in a new tab)

CNBC Technology ·fetched 16 Oct 2026, 11:36 UTC

Why readTracks municipal regulatory oversight of AI developers as SpaceX agrees to testify before the NYC Council.

SpaceX global government affairs leader for AI will testify before the NYC Council tech committee as part of a local AI safety investigation. SpaceX agreed to the teleconference hearing after previously evading a council subpoena that saw executives from Anthropic, Google, Meta, and OpenAI testify.

cnbc.com → (opens in a new tab)

Russian man linked to deadly London hospitals hack arrested (opens in a new tab)

BBC Technology ·fetched 16 Oct 2026, 15:35 UTC

Why readGerman authorities detained a suspect tied to the Qilin ransomware attack on Synnovis, as UK police evaluate a potential historic unlawful killing investigation.

German police have detained a 28-year-old Russian national linked to the Qilin ransomware attack on UK health service provider Synnovis in 2024. The incident severely disrupted London hospital operations and is tied to a patient death, prompting UK police to consider filing charges for unlawful killing in a potential world-first cybercrime case.

bbc.co.uk → (opens in a new tab)

Central Ohio Primary Care says health info breached in cyberattack (opens in a new tab)

Google News: incidents · The Columbus Dispatch ·fetched 16 Oct 2026, 07:34 UTC

Why readReports a cyberattack and health data breach at Central Ohio Primary Care.

Central Ohio Primary Care has confirmed a cyberattack that resulted in unauthorized access to patient health information. The incident impacts one of the largest independent physician networks in the region, requiring statutory breach disclosures and regulatory notification.

news.google.com → (opens in a new tab)

French supermarket cyberattack exposes risks of unsecured remote access and legacy refrigeration systems (opens in a new tab)

Google News: incidents · Industrial Cyber ·fetched 16 Oct 2026, 15:35 UTC

Why readReports on a cyberattack against a French supermarket chain that compromised legacy refrigeration systems via unsecured remote access.

A cyber incident impacted French supermarket operations after attackers leveraged unsecured remote access vectors. The intrusion affected legacy operational technology managing store refrigeration infrastructure, underscoring risks in retail OT environments.

Also covered byInsurance Journal (opens in a new tab).

news.google.com → (opens in a new tab)