Thursday, 22 October 2026

AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (opens in a new tab)

Microsoft Security ·Microsoft Security Research and Microsoft Threat Intelligence ·fetched 22 Oct 2026, 03:39 UTC Must read Research agreed3/3

Why readMicrosoft attributes the ConnectWise multi-tenant supply chain compromise to Storm-0940 and documents its use of the agentic pentest framework ARTEX, with initial targeting to privileged cloud access in under three hours.

From as early as September 2026, the China-aligned actor Storm-0940 used ARTEX, an agentic AI penetration testing framework, to automate attacks against hundreds of organisations across industries, repeatedly reaching privileged cloud infrastructure access in less than three hours. Microsoft assesses the same actor was behind the recently disclosed ConnectWise supply chain compromise of a multi-tenant application. The operational point for defenders is tempo: agent-driven intrusion runs multiple breach paths concurrently and around the clock, which compresses the window between first contact and cloud admin to less than a working day.

Also covered byWiz (opens in a new tab).

microsoft.com → (opens in a new tab)

LiteLLM attacked again: Malicious 1.107.0 wheels on PyPI and Docker Hub (October 2026) (opens in a new tab)

Chainguard ·fetched 22 Oct 2026, 03:39 UTC Must read agreed3/3

Why readNamed malicious artifacts to hunt for right now: litellm 1.107.0 on PyPI plus the matching ghcr.io and docker.io images, all carrying a credential stealer.

An attacker published LiteLLM 1.107.0 on October 21, 2026 with a credential stealer and remote code loader in all seven PyPI wheels, and the official Docker images for that version under the v1.107.0, latest, main-latest, and main-stable tags carry the same payload. The payload runs at Python interpreter startup rather than on import, so merely having it installed is enough, and it targets SSH keys, cloud and CI/CD credentials, browser passwords, and LLM provider keys including those in a LiteLLM proxy database. With more than 2,000 dependent packages, many teams pulled it transitively and will not find it by grepping for a direct reference. The closing vendor pitch is Chainguard's own, but the artifact list and payload behaviour are specific enough to act on immediately.

chainguard.dev → (opens in a new tab)

How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia (opens in a new tab)

Securelist ·Georgy Kucherin, Vladimir Nestor, Vasily Berdnikov ·fetched 22 Oct 2026, 07:40 UTC Must read Research CVE-2022-21894 EPSS 6.6% agreed3/3

Why readKaspersky found APT41 running a derivative of the BlackLotus UEFI bootkit against diplomatic targets in Central Asia, years after the original went quiet post-patching of Baton Drop.

GReAT identified a sample closely related to BlackLotus, the $5,000 Secure Boot bypass bootkit first advertised on a forum in 2022 and confirmed by ESET in 2023, used in intrusions against diplomatic organisations in Central Asia in early 2026. The original relied on CVE-2022-21894 (Baton Drop) to defeat Secure Boot, a bug Microsoft needed several updates to contain. A state-aligned group picking up and reviving criminal bootkit code raises the question of whether your Secure Boot revocation and UEFI measurement posture is actually current.

securelist.com → (opens in a new tab)

China-nexus actor linked to attack on ConnectWise Cloud Backup (opens in a new tab)

Cybersecurity Dive ·David Jones ·fetched 22 Oct 2026, 19:41 UTC agreed3/3

Why readMicrosoft names Storm-0940 behind the ConnectWise Cloud Backup compromise and documents it driving an open-source agentic pentest tool against hundreds of Microsoft 365 tenants.

The China-nexus group abused the backup and recovery service, formerly SkyKick, as a trusted path into MSP-managed Microsoft 365 and Google Workspace tenants, with ConnectWise suspending Cloud Backup access after detecting the activity. The reported use of an agentic tool called Artex to automate reconnaissance and attack attempts at scale is the part worth tracking, since it shifts the tempo assumption for supply-chain probing. MSP customers should treat any Cloud Backup integration as a review item and audit tenant-level app consents and sign-in activity.

cybersecuritydive.com → (opens in a new tab)

Inside SiriusQT: A Seriously Skilled RAT (opens in a new tab)

Group-IB ·fetched 22 Oct 2026, 07:40 UTC Research agreed3/3

Why readReverse-engineering walkthrough of SiriusQT, a commodity Windows RAT sold since April 2026 that bundles HVNC, browser automation, wallet theft, keylogging, process injection and custom encrypted C2 in one implant.

Group-IB takes apart both server- and client-side components of SiriusQT, sold on dark web forums since April 2026 by a seller using the handle GhostKernel for an author named Amonus, with monthly, three-month and lifetime licensing tiers that operators can customise. The implant combines remote access with credential and cryptocurrency wallet collection, clipboard monitoring, persistence and anti-analysis checks, and uses bespoke encrypted command-and-control. The piece also maps the affiliate cluster running campaigns off the platform, which matters more than the feature list for attribution and tracking.

group-ib.com → (opens in a new tab)

SEO Poisoning Campaign Delivers New Armorsteal Malware (opens in a new tab)

Zscaler ThreatLabz ·ThreatLabz (Zscaler) ·fetched 22 Oct 2026, 19:41 UTC Research agreed3/3

Why readBreaks down Armorsteal, a Pyarmor-protected Python stealer delivered through fake Chocolatey and Microsoft Activation Scripts pages that tell users to paste a malicious PowerShell command.

Zscaler tracked an SEO poisoning campaign from September 2026 using sites impersonating the Chocolatey package manager and the MAS activation tool, each serving a PowerShell one-liner that fetches the Armorsteal installer. The installer drops a Python 3.11 runtime and three Pyarmor-obfuscated components: a C2 client that pulls additional modules and runs remote tasks, a surveillance module for keylogging, clipboard monitoring, screenshots and fake crypto wallet prompts, and a stealer targeting browser data, Discord tokens, wallets, seed phrases and saved credentials. The install-command lure is the detection hook: watch for PowerShell download-and-execute from user searches for packaging tooling.

zscaler.com → (opens in a new tab)

Russian Hybrid Campaign Shifts Towards Ukraine’s Military Enablers (opens in a new tab)

Truesec ·Hjalmar Desmond ·fetched 22 Oct 2026, 15:40 UTC agreed3/3

Why readDocuments three dated physical sabotage attempts against Starlink ground infrastructure in Poland, Bulgaria and Lithuania, and why satellite links are now the Russian target set.

Power equipment at a Starlink ground station near Warsaw was set on fire on 23 September; antennas at the Plana Teleport facility south of Sofia were damaged on 9 October, with a Bulgarian court approving European arrest warrants for two German suspects; an arson attempt hit Starlink equipment at a Vilnius data centre supporting nine satellite antennas overnight on 17-18 October. Authorities in each country attribute the activity to Russian intelligence. Truesec's read is that the hybrid campaign has shifted from broad disruption toward the enablers of Ukrainian command and control, drone operations and near-real-time targeting video.

truesec.com → (opens in a new tab)

New PhaaS Platform Uses AI to Craft Phishing Lures and Mask Malicious Activity (opens in a new tab)

Infosecurity Magazine ·fetched 22 Oct 2026, 03:39 UTC agreed3/3

Why readAbnormal AI's count for the Athena StealthRoute PhaaS platform: roughly 89,700 messages with a distinctive link pattern across about 2,280 US and European organisations in six months.

Athena StealthRoute is a phishing-as-a-service platform whose infrastructure Abnormal AI first spotted during an August 2026 campaign, and which uses AI both to generate lures and to conceal delivery. Its AI Studio exposes six workflows for producing customised lures, supporting materials and benign decoy content, alongside a marketplace. The link-pattern volume figure through October 9 is the main usable detail; this is Infosecurity's write-up rather than the vendor report, so the indicators themselves are elsewhere.

infosecurity-magazine.com → (opens in a new tab)

Russia-linked hackers used decentralised network in Ukraine cyberattack, ESET says (opens in a new tab)

Google News: incidents · Reuters ·fetched 22 Oct 2026, 11:42 UTC agreed3/3

Why readESET attributes a Ukraine cyberattack to Russia-linked operators using a decentralised network for command infrastructure.

ESET reports that Russia-aligned attackers leaned on a decentralised network rather than conventional hosted C2 in an operation against Ukraine, a hosting choice that complicates takedown and blocklist-based defence. The Reuters item is a summary; ESET's own writeup will carry the indicators and the technique detail. Worth tracking if you maintain infrastructure blocking for this actor set.

news.google.com → (opens in a new tab)

Cybercrime crackdown across Africa leads to 1,462 arrests, $105 million seized (opens in a new tab)

The Record ·fetched 22 Oct 2026, 15:40 UTC agreed3/3

Why readScale figures from Interpol's Operation Serengeti III, the annual measure of how much of the African fraud and BEC economy law enforcement can actually reach.

Interpol reports 1,462 arrests across 20 African countries plus the United States, more than $105 million in illicit funds recovered, and over 10,000 malicious networks disrupted during the summer operation. Investigators identified just under 66,000 victims with cumulative losses above $385 million, against gangs running online fraud, ransomware, and business email compromise. The recovery total against the loss total is the number worth noting: roughly a quarter of identified losses were clawed back.

therecord.media → (opens in a new tab)

September 2026 Threat Trend Report on APT Groups (opens in a new tab)

AhnLab ASEC ·ATCP ·fetched 22 Oct 2026, 11:42 UTC agreed3/3

Why readMonthly APT synthesis arguing the current pattern is abuse of trust layers: installers, GitHub repos, Microsoft 365 and OneDrive, Telegram and Nostr, routers and auth servers.

AhnLab's September 2026 roundup of publicly disclosed APT activity finds attack chains routed through the developer ecosystem, cloud services and network management infrastructure rather than through traditional delivery. Named components include legitimate software installers, GitHub, Microsoft 365, OneDrive, Telegram, Nostr, routers and authentication servers. It synthesises other people's disclosures, so use it for coverage gaps rather than for new indicators.

asec.ahnlab.com → (opens in a new tab)

Ransom & Dark Web Issues Week 4, October 2026 (opens in a new tab)

AhnLab ASEC ·ATCP ·fetched 22 Oct 2026, 23:39 UTC agreed2/3

Why readNames this week's leak site claims, including regional targets that English language ransomware reporting usually misses.

AhnLab's weekly ransomware and dark web roundup records the Seven Deadly Sins group claiming leaks from seven organisations worldwide, a HYFLOCK attack on a Saudi ERP software vendor, and a Qilin attack on a Japanese investment management firm. The ERP vendor case is the one to watch, since compromise of an ERP supplier carries downstream exposure for every customer estate it touches. Treat these as leak site claims rather than confirmed intrusions; the post is victim tracking, and it carries no indicators, tooling detail, or intrusion analysis you could pivot on.

asec.ahnlab.com → (opens in a new tab)

PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Detecting unauthenticated remote code execution in PHP core (opens in a new tab)

Sysdig ·fetched 22 Oct 2026, 23:39 UTC Must read CVE-2026-109618 EPSS 5.8% agreed3/3

Why readPHP2Shell gives unauthenticated RCE in PHP core via HTTP requests alone, CVSS 9.2, with public PoCs and in-the-wild exploitation seen four days before disclosure.

CVE-2026-109618 and CVE-2026-109619 bundle four memory-safety bugs in PHP core, fixed in emergency releases on 21 October 2026 after CVE ids and exploit details leaked to Hacker News on 20 October and forced the schedule forward. Amazon Threat Intelligence logged an exploitation attempt against MadPot honeypots on 17 October, before the patch existed, and Cloudflare reported early attacks; multiple working PoCs are circulating. The reporters say AI models assisted both discovery and exploit development. Patch every internet-facing PHP host now and hunt for pre-disclosure exploitation back to mid-October.

Also covered byHacker News (opens in a new tab),Sophos Threat Research (opens in a new tab),Securelist (opens in a new tab),Truesec (opens in a new tab),AWS Security (opens in a new tab),Schneier on Security (opens in a new tab),Unit 42 (opens in a new tab),oss-security (opens in a new tab),Hacker News (opens in a new tab),Hacker News (opens in a new tab),Hacker News (opens in a new tab),oss-security (opens in a new tab),Horizon3 Attack Team (opens in a new tab),CERT-AGID (Italy) (opens in a new tab),AhnLab ASEC (opens in a new tab),AhnLab ASEC (opens in a new tab),CNBC TV18 (opens in a new tab),AhnLab ASEC (opens in a new tab).

webflow.sysdig.com → (opens in a new tab)

eMudhra CA Key Compromise: Response Guide for Developers (opens in a new tab)

SafeDep (supply chain) ·fetched 22 Oct 2026, 07:40 UTC Must read agreed3/3

Why readEight eMudhra intermediate CAs were created with private keys below 256, computable in under a second from the public certificate, and non-browser TLS clients in CI runners, container images, JVMs and language CA bundles still trust them.

eMudhra generated eight intermediate CAs in April 2025 with trivially weak private keys: six issue TLS certificates and two issue code signing certificates, and anyone can derive the key and forge certificates for any domain. Browsers have blocked the intermediates and Chrome rejects emSign ECC Root CA - G3 on 27 October 2026, but any client that trusts the eMudhra or Sectigo root, does not block the intermediates and skips revocation checking is still exposed, which covers a large amount of CI and runtime tooling. The guide gives steps to identify affected systems, test trust stores, update CA bundles and decide on certificate rotation.

Also covered byEconomic Times Tech (opens in a new tab),The Record (opens in a new tab),Rediff MoneyWiz (opens in a new tab),Maktoob (opens in a new tab),PSU Watch (opens in a new tab),Internet Freedom Foundation (opens in a new tab),CyberSecurityNews (opens in a new tab),oneworldnews.com (opens in a new tab),NDTV Profit (opens in a new tab),ET Edge Insights (opens in a new tab),Punjab Kesari English (opens in a new tab),theopenpress.in (opens in a new tab),The Financial Express (opens in a new tab),The Register Security (opens in a new tab),DQ (opens in a new tab),NewsBytes (opens in a new tab),The Times of India (opens in a new tab),Business Standard (opens in a new tab),BusinessLine (opens in a new tab),The New Indian Express (opens in a new tab).

safedep.io → (opens in a new tab)

CVE-2026-111862 (CVSS 9.8): Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October (opens in a new tab)

NVD ·fetched 22 Oct 2026, 11:42 UTC CVE-2026-111862 CVSS 9.8 EPSS 0.7% agreed3/3

Why readRank Math SEO PRO packages pulled between 15 October 20:02 UTC and 16 October 07:12 UTC contained live malware, and the vendor says to treat affected sites as compromised rather than just patch.

A subset of Rank Math SEO PRO 3.0.123 packages distributed in an eleven-hour window carried malware that establishes persistence, beacons to rank1cdn[.]com, recreates hidden backdoors on page visits, and exposes WordPress, database and API credentials readable by the web server. Indicators include three malicious wp_options keys, hidden PHP backdoors, unauthorised administrator accounts, a fake WordPress core file, PHP-executable .cache files and a system cron marker. Version 3.0.124 is the clean release, but the version string alone does not establish compromise: only the download window does, so hunt the indicators rather than trusting the upgrade.

nvd.nist.gov → (opens in a new tab)

2026-019: Critical Vulnerability in GitLab Community and Enterprise Editions (opens in a new tab)

CERT-EU Advisories ·fetched 22 Oct 2026, 11:42 UTC agreed3/3

Why readCVE-2026-110264, CVSS 10, unauthenticated RCE on GitLab servers via an integer overflow in the regex compiler, patched in 19.5.1.

GitLab's 21 October advisory fixes a critical integer overflow in the regular expression compiler that lets an unauthenticated user execute arbitrary code on the server, alongside two high, five medium and four low severity issues. GitLab has published two detection rules for exploitation attempts. CERT-EU advises patching internet-facing instances first and running a compromise assessment rather than assuming a clean patch is sufficient.

Also covered byCSO Online (opens in a new tab).

cert.europa.eu → (opens in a new tab)

Siemens Software Center (opens in a new tab)

CISA Advisories ·CISA ·fetched 22 Oct 2026, 19:41 UTC CVE-2026-110936 EPSS 0.2% agreed3/3

Why readSiemens notes current known active exploitation of this DLL search path flaw in Siemens Software Center and points to detection guidance; fixed in 4.0.9.8.

CVE-2026-110936 lets an authenticated local attacker drop a crafted DLL into a directory the application searches, gaining code execution with the application's privileges. CVSS is only 6.7 and EPSS 0.002, but the advisory explicitly references active exploitation and a Siemens blog post covering how to detect it, which puts this ahead of the rest of today's Siemens batch. Affected versions are everything below 4.0.9.8.

cisa.gov → (opens in a new tab)

CVE-2026-76268 | Splunk Enterprise Patroni REST API Missing Authentication Vulnerability (opens in a new tab)

Horizon3 Attack Team ·Horizon3 ·fetched 22 Oct 2026, 23:39 UTC CVE-2026-76268 EPSS 1.6% agreed3/3

Why readUnauthenticated OS command execution on Splunk Enterprise search head cluster members via the exposed Patroni REST API, CVSS 9.8.

CVE-2026-76268 is a missing authentication flaw in the Patroni REST API used by Splunk Enterprise search head clustering: anyone with network access to that endpoint can run attacker-controlled operating system commands. Splunk's own advisory rates it 9.8 and reports no active exploitation, but EPSS already sits in the 75th percentile and Horizon3's attack team is publishing on it, which historically precedes a PoC. Patch, and in the meantime confirm the Patroni port is not reachable from anything beyond the cluster members themselves.

horizon3.ai → (opens in a new tab)

CVE-2026-101296 (CVSS 9.1): A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication (opens in a new tab)

NVD ·fetched 22 Oct 2026, 23:39 UTC CVE-2026-101296 CVSS 9.1 EPSS 0.7% agreed3/3

Why readTomcat's JNDI realm, when configured with a non-GSSAPI SASL mechanism, skips a step and authenticates users without the correct password; fixed in 11.0.27, 10.1.61 and 9.0.123.

CVE-2026-101296 (CVSS 9.1) is an authentication bypass spanning 11.0.0-M1 to 11.0.26, 10.1.0-M1 to 10.1.60 and 9.0.0.M1 to 9.0.122, with EOL 8.5 and 7.0 branches also known affected and unfixed. The trigger is specific, a JNDI realm using SASL with something other than GSSAPI, so the first job is grepping server.xml for JNDIRealm and its SASL configuration rather than mass-patching. EPSS is still low at 0.0065, but a password-free login on an app server front door is the kind of bug that moves quickly once a PoC lands.

nvd.nist.gov → (opens in a new tab)

CVE-2026-112393 (CVSS 9.2): Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving (opens in a new tab)

NVD ·fetched 22 Oct 2026, 15:40 UTC CVE-2026-112393 CVSS 9.2 EPSS 0.5% agreed3/3

Why readPillow from 2.0.0 through 12.x has a heap buffer overflow when saving compressed TIFF to BytesIO, which covers essentially every Python image pipeline that does in-memory conversion.

The _tiffWriteProc callback sizes its allocation from the prior buffer size rather than the current write position, so after libtiff seeks forward an attacker-controlled out-of-line TIFF tag or a retained ICC profile is copied past the allocation. Targets with a real file descriptor are unaffected; the bug only fires where fileno() is unusable, such as BytesIO. A second issue leaks stale heap bytes through unwritten alignment gaps in compressed TIFF output over 64 KiB, with no crafted tag needed. Fixed in 13.0.0.

nvd.nist.gov → (opens in a new tab)

Several Linux kernel vulnerabilities accidentally posted to public mailing list (opens in a new tab)

Hacker News ·mrkn1 ·fetched 22 Oct 2026, 15:40 UTC 173 points agreed3/3

Why readZDI reports for unpatched Linux kernel bugs, including a CVSS 9.0 SMB Direct RCE, went to the public LKML instead of the private security list.

Several Trend Micro ZDI vulnerability reports were posted to the public Linux kernel mailing list overnight rather than the private security list, with Greg Kroah-Hartman querying each submission. Among them is ZDI-CAN-33549, a CVSS 9.0 remote code execution in SMB Direct caused by an integer underflow; mainline is unpatched, with fixes variously in testing or queued in -next. Anyone exposing ksmbd or SMB Direct should treat details as public ahead of the patch landing.

phoronix.com → (opens in a new tab) Discussion (opens in a new tab)

Cisco Advance Notification for Publication of October 21, 2026, Security Advisories (opens in a new tab)

Cisco PSIRT ·fetched 22 Oct 2026, 11:42 UTC CVE-2026-20291 agreed3/3

Why readAdvance notice of the October 21 Cisco batch, including a Critical 9.0 Snort 3 hardening release and arbitrary command execution on the open-source Snort 3 control channel socket.

The headline items are the Snort 3 hardening release covering CVE-2026-20043, CVE-2026-20236, CVE-2026-20291 and CVE-2026-20356 at CVSS 9.0 Critical, plus CVE-2026-76524, a high-severity arbitrary command execution flaw in the open-source Snort 3 control channel socket. Several Snort 3 denial-of-service issues round out the set at medium severity. This one hits the detection stack itself, so it is defenders patching their own sensors rather than a perimeter product.

sec.cloudapps.cisco.com → (opens in a new tab)

CVE-2026-109432 (CVSS 9.3): Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to c (opens in a new tab)

NVD ·fetched 22 Oct 2026, 07:40 UTC CVE-2026-109432 CVSS 9.3 EPSS 0.6% agreed3/3

Why readCamunda 7.23/7.24 lets an unauthenticated caller smuggle a JUEL expression through orQueries to reach java.lang.Runtime.exec, giving command execution as the engine service user.

AdhocQueryValidator.validate() in Camunda does not inspect sub-query expression maps inside the orQueries field of TaskQueryDto, so the enableExpressionsInAdhocQueries restriction can be bypassed by nesting an expression such as dueAfterExpression one level down. That yields arbitrary Java reflection and OS command execution as the engine service account. Patched in 7.24.14 and 7.23.17; Camunda 7 sits inside a lot of enterprise process automation, often with engine-rest reachable from internal networks.

nvd.nist.gov → (opens in a new tab)

CVE-2026-112900 (CVSS 9.2): Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsIm (opens in a new tab)

NVD ·fetched 22 Oct 2026, 19:41 UTC CVE-2026-112900 CVSS 9.2 EPSS 0.4% agreed3/3

Why readPillow from 2.6.0 until 13.0.0 passes a caller-controlled EPS filename straight after Ghostscript's -f flag, so a name starting with a hyphen becomes a Ghostscript option and an @-prefixed name reaches command execution.

EpsImagePlugin.Ghostscript does not normalise the input filename to a safe absolute path before handing it to Ghostscript, which lets an attacker who controls the filename inject arguments. Full command execution needs a leading @ argument-file name plus control of the referenced text file, and the reported chain reproduces even with the default -dSAFER invocation. Fixed in Pillow 13.0.0; anything doing EPS processing on user-supplied filenames should upgrade rather than rely on -dSAFER.

nvd.nist.gov → (opens in a new tab)

Header Accordions: QPACK amplification attacks against HTTP/3 servers (opens in a new tab)

oss-security ·fetched 22 Oct 2026, 03:39 UTC Must read Research agreed3/3

Why readOne unauthenticated HTTP/3 connection can force a server to allocate thousands of times the memory it receives, and seven of ten QPACK implementations tested are vulnerable.

QPACK header compression in HTTP/3 lets a small HEADERS frame decode into hundreds of thousands of header objects, because decoded-header limits across implementations are missing, incomplete, or enforced after the allocation has already happened. The researchers found seven of ten tested stacks affected, with a single connection sufficient to OOM or pin a server running default settings. Anyone terminating HTTP/3 should check their stack's decoded-header limit rather than assuming frame size caps cover it.

seclists.org → (opens in a new tab)

Linear Self-Symmetries of Inverse-Based S-boxes: Generic Rigidity and Applications (opens in a new tab)

arXiv cs.CR (all) ·Zheng Zhang, Na Zhang ·fetched 22 Oct 2026, 23:39 UTC Research agreed3/3

Why readProves the full AES S-box has no nontrivial linear self-symmetry and gives a practical rigidity criterion for inverse-based S-box designs.

The authors reduce the question of surviving linear self-symmetries in inversion-based S-boxes to semilinear conjugacy and centralizer estimates, deriving matching upper and lower bounds on the probability that a nontrivial symmetry survives a random outer linear transformation in GL_n(F_2). The leading quadratic exponent is governed by the smallest prime divisor of the extension degree, so decay depends on the arithmetic of the field extension rather than its dimension alone. Applications include a usable rigidity criterion for designers and a proof that the AES S-box is clean.

arxiv.org → (opens in a new tab)

Free-XOR TFHE via Lazy Bootstrapping (opens in a new tab)

arXiv cs.CR (all) ·Ali Ajorian, Osman Biçer ·fetched 22 Oct 2026, 11:42 UTC Research agreed3/3

Why readA TFHE gate bootstrapping construction that evaluates XOR for free while covering all eight symmetric binary Boolean gates in two blind rotations.

Blind rotation dominates the cost of gate bootstrapping in FHEW-like schemes, and prior free-XOR work bought cheap XOR at the price of a bespoke AND procedure. This construction keeps free XOR via ciphertext addition and extends coverage to every symmetric binary gate using two blind rotations, with a simpler design than the earlier framework both conceptually and in implementation. Relevant if you are building on TFHE; of limited consequence elsewhere.

arxiv.org → (opens in a new tab)

VX-One: Typed, Calibrated Decision Heads for Real-Time Perimeter Triage - An empirical study of unknown-attack honesty, cascade gray zones, and calibration under drift (opens in a new tab)

arXiv cs.CR (all) ·Juan S. Santillana ·fetched 22 Oct 2026, 03:39 UTC Research agreed3/3

Why readBenchmarks a small multi-head classifier that emits calibrated gate, closed-set choice with an explicit unknown option, and ordinal score at roughly 0.7 to 1.7 ms p50 on CPU, behind Suricata in a two-phase cascade.

VX-One is a 100K to 10M parameter network trained multi-task and temperature-calibrated per head, evaluated against calibrated XGBoost, Random Forest, MLP and Kitsune on UNSW-NB15, CIC-IDS2017 and EMBER2024. It reports better AUROC and FPR at 95% TPR on UNSW-NB15 and under temporal drift on CIC-IDS2017 (0.711 versus 0.6), and measures a cascade of Suricata with 52,674 Emerging Threats rules feeding the model over five days of CIC-IDS2017. The explicit unknown-class head and per-head calibration are the parts worth borrowing for anyone building triage on top of an existing signature engine.

arxiv.org → (opens in a new tab)

Data Loss Prevention (DLP): From Theory to Practice (opens in a new tab)

Truesec ·Hjalmar Desmond ·fetched 22 Oct 2026, 07:40 UTC agreed2/3

Why readA rollout method for DLP that starts from a small set of stated risk hypotheses and tests them against real workflows, instead of switching on a vendor policy catalogue.

Truesec argues that DLP programmes fail on friction rather than on detection logic, so the rollout should be run as an iterative loop: state a risk assumption, check it with the people whose work it touches, then tune the action. It offers concrete starting hypotheses such as customer data not going to personal cloud storage, financial reports staying inside a named recipient group, and production schematics not reaching USB media. The value is the sequencing advice, not new tooling detail; teams already past the pilot stage will find little here.

truesec.com → (opens in a new tab)

2026-10-22: Seven days of scans and probes and web traffic hitting my web server (opens in a new tab)

Malware Traffic Analysis ·fetched 22 Oct 2026, 23:39 UTC Research agreed3/3

Why readA free 14.4 MB pcap of seven straight days of real internet scanning and probing against a live web server, usable as raw material for detection tuning and analyst practice.

Brad Duncan has posted a packet capture covering a full week of unsolicited traffic reaching his public web server, including scans, probes and assorted web requests. It is raw data with no accompanying write up, so the value is in what you do with it: replaying it against IDS rules, testing web log parsing, or handing it to junior analysts as a triage exercise. Note the site now uses a new zip password scheme, documented on its about page.

malware-traffic-analysis.net → (opens in a new tab)

Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents (opens in a new tab)

arXiv cs.CR (all) ·Arshan Dabirsiaghi ·fetched 22 Oct 2026, 19:41 UTC Must read Research agreed3/3

Why readShows that coding agents which flatten typed conversations into plain strings before summarising let an attacker forge a user turn that survives compaction as a genuine standing approval.

Context compaction is an exploitable trust boundary in coding agents that serialise the conversation into a single labelled string ([User]:, [Assistant]:) before the summariser runs, because message provenance is destroyed in code rather than by the model. Across five flattening harnesses (pi, opencode, Cline, Aider, OpenHands) a forged approval laundered into agent memory 87-100% of the time at context windows up to ~908,000 tokens, while four role-typed harnesses (Codex, Gemini CLI, Qwen Code, Continue) were unaffected at 0%. The authors carry it through to execution: a laundered approval drove real tool-running agents to run attacker-controlled curl | sh, and succeeded end to end in the live pi TUI about half the time.

arxiv.org → (opens in a new tab)

Prompt Injection Through Forensic Evidence: A Taxonomy and Proof of Concept of Anti-Forensic Attacks on LLM-Assisted Digital Investigations (opens in a new tab)

arXiv cs.CR (AI) ·Frank Breitinger, Jan Gruber, Christopher Hargreaves, Jan-Niclas Hilgert ·fetched 22 Oct 2026, 07:40 UTC Must read Research agreed3/3

Why readDemonstrates that attacker-controlled evidence can prompt-inject an LLM-assisted forensic pipeline and change the reported conclusion, a threat model classical anti-forensics does not cover.

The paper inverts the usual indirect prompt injection setting: in digital forensics the evidence is attacker-controlled by definition and the examiner is obliged to read it closely, making the model's reasoning layer a third anti-forensic target alongside data and tools. It builds a taxonomy across objective, technique, payload location and concealment method, and identifies a perception gap where deterministic tooling, the human examiner and the model each see the same artefact differently, letting an injection pass unseen. Three working attacks against an LLM-assisted analysis pipeline alter a reported conclusion and write attacker-chosen content into the output.

arxiv.org → (opens in a new tab)

Where AI Vulnerability Discovery Harnesses Go Quiet: Structural False Negatives and Hidden Vulnerabilities (opens in a new tab)

arXiv cs.CR (AI) ·Gadi Evron ·fetched 22 Oct 2026, 15:40 UTC Must read Research agreed3/3

Why readMaps 13 points where LLM vulnerability-discovery harnesses silently drop real bugs before or after the model runs, and shows one file that six of twelve harnesses discarded, five without reporting it.

Working from the authors' own harnesses, Knostic's OpenAnt and raptor, plus ten more open-source ones, the paper builds a taxonomy of code selection, filtering, storage and merge steps that discard reachable vulnerabilities independently of model capability, usually with no signal in the output. The demonstration is concrete: a single file from each harness's own codebase that six harnesses never showed their model, five of them silently. The adversarial corollary is the sharp part, since an attacker who knows a harness's rules can shape code to be dropped on purpose.

arxiv.org → (opens in a new tab)

Correlated Failures of AI Approval Monitors (opens in a new tab)

arXiv cs.CR (AI) ·Luca Zanolini ·fetched 22 Oct 2026, 23:39 UTC Must read Research agreed3/3

Why readMeasures when multiple LLM approval monitors fail together, and finds that fraud approvals propagate only through a shared evidence source while false blocks track a model's resistance to injected instructions.

Borrowing fail-prone set notation from distributed systems, the authors define an aggregation rule as safe if it never executes a bad action and live if it never blocks a good one, then test twelve small open-weight monitors on payment approval under two pre-registered protocols, plus Claude Opus 5.5, GPT-6 Astra, Gemini 4 Argon and DeepSeek-V3.2 without pre-registration. Every reliable attack that made a monitor approve a fraudulent payment travelled through an evidence source and affected only the monitors that read that source, so correlated failure follows shared inputs rather than shared base models. Tricking monitors into blocking a legitimate payment depended on injection resistance: the small models and DeepSeek followed instructions planted in their data, the three closed frontier models did not. The practical consequence is that counting approvals across monitors buys nothing unless the monitors read disjoint evidence.

arxiv.org → (opens in a new tab)

Characterizing and Defending Utility-Hijacking in Instruction-Tuning Data Selection (opens in a new tab)

arXiv cs.CR (all) ·Yahao Ren, Jian Lou, Huadi Zheng, Jiawei Duan ·fetched 22 Oct 2026, 15:40 UTC Research agreed3/3

Why readShows that instruction-data selectors can be turned into poison concentrators: crafted records score highly enough that top-k selection picks them rather than filters them.

The authors define utility-hijacking, an adaptive supplier-side attack in which harmful training records are shaped to survive utility-oriented instruction-data selection while keeping their payload intact. The difficulty is that optimising for selector score washes out the payload, so they use a generate-and-rerank procedure that produces many payload-bearing candidates per instruction and submits only the top scorer. Evaluated against three payload types: over-refusal, false-fact injection and insecure code generation.

arxiv.org → (opens in a new tab)

Your AI agent fixed the bug, but what else did it change? (opens in a new tab)

Trail of Bits ·fetched 22 Oct 2026, 19:41 UTC Research agreed3/3

Why readTwo released agent plugins, patching-bugs and regression-hunt, that reproduce a reported bug, develop and test a fix, and check the fix did not break supported behaviour, with maintainer-supplied security assumptions as guardrails.

Trail of Bits released patching-bugs and regression-hunt, built from the Patch the Planet work with OpenAI where they co-authored hundreds of patches for open-source projects including Scapy, drawing on analysis of merged patches and thousands of Codex sessions. Maintainers can encode their own security assumptions and patching requirements so the agents operate inside project rules, and the workflow produces evidence and independent checks rather than a bare diff. Preliminary evaluation puts regression-hunt at 25% fewer false-positive findings, which is the number to argue with if you are deciding whether to let an agent near your patch pipeline.

blog.trailofbits.com → (opens in a new tab)

CVE-2026-109437 (CVSS 9.2): Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution (opens in a new tab)

NVD ·fetched 22 Oct 2026, 11:42 UTC CVE-2026-109437 CVSS 9.2 EPSS 0.6% agreed3/3

Why readCognition before 0.13.0 defaults its agent sandbox to local execution and ships no auth on its REST/SSE API, so POST /sessions then POST /sessions/{id}/messages is unauthenticated RCE.

Cognition's agent server exposes session creation and message posting with no credentials, and because the sandbox backend defaults to local execution, an attacker-supplied message drives the Deep Agents ReAct loop into running shell commands as the server process. CVSS 9.2, fixed in 0.13.0. The pattern is worth noting beyond this product: agent frameworks that ship an unauthenticated control API plus a local-shell tool backend turn any network-reachable deployment into a remote shell.

nvd.nist.gov → (opens in a new tab)

Is Claude Code safe for the enterprise? What the official settings cover, and what they don't (opens in a new tab)

Adversa AI ·fetched 22 Oct 2026, 07:40 UTC agreed3/3

Why readDocuments the stated limits of Claude Code's enterprise settings, including that auto mode misses 17% of risky actions by Anthropic's own measure and had a published bypass within twelve days of becoming default.

Auto mode became the default for many Claude Code subscribers on 14 August 2026; a researcher published a working bypass twelve days later and Anthropic closed the report as informative. The analysis argues the official controls bind one tool, on managed devices, for developers without local admin, which describes few real deployments where multiple coding agents run and developers hold admin rights. The practical position is to treat auto mode as convenience rather than control and push assurance into the environment instead.

adversa.ai → (opens in a new tab)

CVE-2026-109440 (CVSS 8.6): LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by p (opens in a new tab)

NVD ·fetched 22 Oct 2026, 19:41 UTC CVE-2026-109440 CVSS 8.6 EPSS 0.4% agreed3/3

Why readIndirect prompt injection in LangAlpha reaches shell and Python execution and reads the agent's own vault secrets file.

LangAlpha through 2026.09.07 lets instructions planted in web content the agent fetches drive its Bash and ExecuteCode tools, neither of which has an allow-list or human-in-the-loop approval. The payoff is code execution in the workspace sandbox and exfiltration of _internal/.vault_secrets.json. A clean worked example of the gap between a tool-using agent and an agent with tool authorisation, and worth checking against your own framework's execution tools.

nvd.nist.gov → (opens in a new tab)

CertMoE: Robustness Certification for Mixture-of-Experts LLMs via Routing-Aware Smoothing (opens in a new tab)

arXiv cs.CR (AI) ·Qingyue Wang, Yudong Gao, Lixia Wang, Ruixuan Huang ·fetched 22 Oct 2026, 11:42 UTC Research agreed3/3

Why readShows why existing robustness certification breaks on Mixture-of-Experts models: input-dependent routing changes the execution path, so the certified function is not fixed.

CertMoE introduces routing-aware randomized smoothing for MoE LLMs, built on a relaxed routing-containment criterion that certifies perturbed Top-K routing stays inside a larger certified expert set. The core observation is that abstract-interpretation style certification assumes a fixed computation graph, an assumption MoE routing violates outright, making prior guarantees unreliable. Academic and not operational, but it names a concrete structural gap in a fast-spreading architecture.

arxiv.org → (opens in a new tab)

CVE-2026-112265 (CVSS 8.3): LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu e (opens in a new tab)

NVD ·fetched 22 Oct 2026, 03:39 UTC CVE-2026-112265 CVSS 8.3 EPSS 0.2% agreed3/3

Why readKnowing only a bot UUID lets an unauthenticated attacker forge Lark/Feishu events into LangBot through 4.11.0 and drive the LLM pipeline, its tools and its approvals as another user.

LangBot skips signature verification on inbound Lark/Feishu webhooks, so fabricated im.message.receive_v1 or card.action.trigger events POSTed to the endpoint are processed as genuine. The consequence is agent hijacking rather than a simple spoof: the forged events drive tool invocation and approval flows under another user's identity. A concrete instance of the general problem that chat-platform webhook verification is the only authentication boundary in front of most LLM bot deployments.

nvd.nist.gov → (opens in a new tab)

CVE-2026-77934 (CVSS 8.7): Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes (opens in a new tab)

NVD ·fetched 22 Oct 2026, 19:41 UTC CVE-2026-77934 CVSS 8.7 EPSS 0.5% agreed3/3

Why readCoze Studio before 0.5.0 lets any registered user escape the workflow code node sandbox with __import__('subprocess') and reach MySQL, MinIO, Redis and etcd.

The default configuration runs workflow code nodes in an unsandboxed python3 subprocess, and the regex-based import filter is bypassed with __import__('subprocess'). Any registered user can execute commands, steal environment variables and model API keys, and pivot to the backing MySQL, MinIO, Redis and etcd services. Fixed in 0.5.0; a regex import denylist as the only containment boundary is the root design error here.

nvd.nist.gov → (opens in a new tab)

Canadians Are Running Out Of Time To Oppose The Dangerous C-22 Surveillance Bill (opens in a new tab)

EFF Deeplinks ·Joe Mullin ·fetched 22 Oct 2026, 23:39 UTC agreed3/3

Why readCanada's Bill C-22 would let the Minister of Public Safety order services to build law-enforcement backdoors and mandate up to a year of metadata retention; it has cleared the Commons and sits with the Senate.

The Lawful Access Act compels telecom providers, messaging apps and other digital services to assist government surveillance, including ministerial orders to create access mechanisms provided they do not cause 'systemic insecurity', a standard EFF reads as unworkable for encryption. It also imposes metadata retention obligations of up to twelve months. Anyone operating a service with Canadian users should be modelling the retention and assistance obligations now, since the remaining stage is Senate consideration.

eff.org → (opens in a new tab)

Why global investigation playbooks create local legal exposure in China (opens in a new tab)

Compliance Week ·Trevor Treharne ·fetched 22 Oct 2026, 23:39 UTC agreed3/3

Why readExplains why a standard US internal-investigation playbook creates legal exposure when run in China: data ownership, cross-border transfer and employment law all diverge.

Investigators working in-country argue that running a headquarters-standard investigation in China turns the investigation itself into the liability, because PRC rules on who owns the data, what may leave the country and what an employer may collect from staff do not match US assumptions. The position is specific enough to argue with: localise the playbook rather than export it. Relevant to anyone running multinational IR or compliance investigations, though the excerpt is light on the specific statutes.

complianceweek.com → (opens in a new tab)

TiDB Breach Exposes Flawed Cloud Security Assumptions (opens in a new tab)

Dark Reading ·Nate Nelson ·fetched 22 Oct 2026, 03:39 UTC agreed3/3

Why readA prompt to ask your managed database and SaaS vendors exactly what customer data they retain, because the TiDB breach surfaced data neither side was tracking.

Dark Reading uses the TiDB breach to argue that managed service providers often hold copies of customer data that neither the provider nor the customer has accounted for, and that the exposure only becomes visible once the provider is compromised. The practical takeaway sits with contracts and vendor questionnaires rather than detection: retention scope, copy locations, and who owns notification. There is little technical detail on the intrusion itself, so treat it as a third party risk prompt, not an incident report.

darkreading.com → (opens in a new tab)

Quest Diagnostics’ test results system breached in yet another medtech cyberattack (opens in a new tab)

Google News: incidents · Fierce Biotech ·fetched 22 Oct 2026, 19:41 UTC agreed3/3

Why readQuest Diagnostics has had its test results system breached, the latest in a run of attacks on medtech and diagnostics providers.

Fierce Biotech reports a breach of the system Quest Diagnostics uses to deliver test results. Detail is thin at this stage, with no attacker attribution, scope of records affected, or technical specifics disclosed. For healthcare and life sciences security leaders it is a named-peer incident touching clinical data flow, and worth having an answer ready on third-party diagnostics exposure.

Also covered byMedTech Dive (opens in a new tab).

news.google.com → (opens in a new tab)

Ahold Delhaize Cyberattack Hits US and EU Stores [2026] (opens in a new tab)

Google News: incidents · shattered.io ·fetched 22 Oct 2026, 07:40 UTC agreed3/3

Why readAhold Delhaize, one of the largest grocery groups in the US and Europe, reports store-level impact from a cyberattack.

Aggregator item reporting a cyberattack affecting Ahold Delhaize stores in both the US and EU. Only the headline is available, with no detail on the intrusion, data involved or operational impact. For a retail or food sector leader it is a peer incident worth tracking as fuller reporting lands.

news.google.com → (opens in a new tab)

DaVita agrees to $15M settlement in data breach lawsuit after cyberattack (opens in a new tab)

Google News: incidents · The Business Journals ·fetched 22 Oct 2026, 03:39 UTC agreed3/3

Why readDaVita settles its post-breach class action for $15 million, a concrete price tag for healthcare breach litigation.

Dialysis provider DaVita has agreed to a $15M settlement resolving the data breach lawsuit arising from its cyberattack. The figure is the usable fact here: a recent, named comparable for anyone sizing breach liability or arguing a cyber insurance position in healthcare. No technical detail accompanies the report.

news.google.com → (opens in a new tab)

Massive data breach targets Germany's AfD (opens in a new tab)

Google News: incidents · DW.com ·fetched 22 Oct 2026, 11:42 UTC agreed3/3

Why readA large data breach at Germany's AfD, a political party, with the attendant GDPR and political-exposure questions.

DW reports a substantial data breach affecting Germany's AfD party. Coverage at this stage is the event rather than the mechanism, with no attribution or technical detail attached. Relevant to anyone handling politically exposed member and donor data in the EU, and a likely regulatory notification case.

news.google.com → (opens in a new tab)

Tech trio launches $10 million initiative to help under-resourced utilities bolster cybersecurity (opens in a new tab)

The Record ·fetched 22 Oct 2026, 11:42 UTC agreed3/3

Why readAccenture, Dragos and SANS are putting $10 million into free OT security tooling and training for US utilities under $100 million in revenue, which covers 97% of them.

The Community Cyber Resilience Foundation, announced on 21 October 2026, will give up to 500 eligible US water, wastewater, electric and natural gas utilities free cybersecurity software, hardware, deployment services and training, including Dragos asset visibility tooling and SANS training. Eligibility is set at under $100 million in annual revenue, which the founders say captures 97% of US utilities. Worth raising with anyone running or overseeing a small utility, and a data point on who is filling the OT funding gap now that federal support is thinner.

therecord.media → (opens in a new tab)

Pentagon ignored cybersecurity flaws before data breach, Marines’ lawsuit says (opens in a new tab)

Google News: incidents · Military Times ·fetched 22 Oct 2026, 15:40 UTC agreed3/3

Why readMarines are suing over a Pentagon data breach, alleging known cybersecurity flaws went unaddressed beforehand, which is the negligence-exposure story peers will be asked about.

Military Times reports a lawsuit brought by Marines claiming the Pentagon was aware of cybersecurity deficiencies before the breach that exposed their data and did not act on them. Only the headline reached us, so the specific claims, defendants and breach timeline are not available here. The relevance is the pattern: litigation that turns prior knowledge of unremediated findings into liability.

Also covered byBloomberg Law News (opens in a new tab).

news.google.com → (opens in a new tab)

Srsly Risky Biz: OpenAI's Kazoo-Grade Spying Incident (opens in a new tab)

Risky Business News ·fetched 22 Oct 2026, 07:40 UTC agreed3/3

Why readContext on the physical bugging incident at OpenAI and why it does not read as conventional state espionage, plus how criminal AI use is shifting toward hands-off automated business models.

Tom Uren and Amberleigh Jack pick apart the OpenAI surveillance incident, arguing the tradecraft does not match normal state-backed collection while still making the case that frontier labs need to treat model weights and research as crown jewels. The second half covers criminals building harnesses that let AI do most of the operational work, moving them toward passive revenue models. Discussion rather than reporting, useful as framing for leaders fielding questions about AI lab security.

risky.biz → (opens in a new tab)