Friday, 23 October 2026

Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks (opens in a new tab)

Microsoft Security ·Microsoft Security Research, Mahesh Mandava, Srinivasan Govindarajan, Sagar Patil and Suriyaraj Natarajan ·fetched 23 Oct 2026, 23:40 UTC Must read Research agreed3/3

Why readBreaks down how the malicious LiteLLM 1.107.0 wheel executed on plain Python interpreter startup, without the package ever being imported, and what credentials it harvested.

A compromised LiteLLM 1.107.0 release was published to PyPI on October 21, 2026 and distributed through official container images. The payload ran during normal interpreter initialization via a path extension (.pth) and a Unix loader persisted through site-specific configuration, so merely starting Python in an affected environment could trigger it, with no import required. Microsoft documents two execution paths, a credential collector sweeping developer tools, AI applications, cloud environments, browsers and infrastructure, plus a database module reading credential and model-configuration records from the LiteLLM proxy, with Windows and macOS endpoint observations and IOCs.

microsoft.com → (opens in a new tab)

MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration (opens in a new tab)

ESET WeLiveSecurity ·fetched 23 Oct 2026, 11:41 UTC Must read Research agreed3/3

Why readDocuments MythicRatatoskr, a Go backdoor that hides its C&C inside the Yggdrasil mesh network, and traces a UAC-0099 handoff to Sandworm that ended in a wiper against a Ukrainian grain logistics firm.

UAC-0099 gained initial access to a Ukrainian grain logistics company on 16 July 2025 via spearphishing, executing the MATCHWOK backdoor, then deployed the previously undocumented MythicRatatoskr the next day. MythicRatatoskr is written in Go and reaches its C&C over the Yggdrasil mesh overlay rather than conventional infrastructure, which breaks the usual IP and domain-based blocking and hunting assumptions. Access was handed to Sandworm, which ran a data-wiping attack on 17 September 2025; findings were presented at LABScon and Virus Bulletin.

welivesecurity.com → (opens in a new tab)

M365 Token Spray and Replay Campaign Compromises Business Email Accounts (opens in a new tab)

Huntress ·fetched 23 Oct 2026, 11:41 UTC Must read Research agreed3/3

Why readTen weeks of telemetry on an M365 AiTM token-replay campaign, with the hosting provider, the post-compromise persistence pattern (48 rogue Entra devices, MFA method replacement, inbox rules) and the containment steps that actually work.

Huntress tracked an adversary-in-the-middle campaign that captured M365 sign-in sessions and replayed stolen tokens from IP space belonging to German hosting provider 1337 Services GmbH, responding to incidents at 79 organizations with at least 497 successful sign-ins against more than 200,000 failed attempts. Post-access activity included registering at least 48 rogue Entra devices, wiping and replacing victim MFA methods, and creating inbox rules to hide BEC-related mail; one compromised account was used to send a payroll-themed email externally. Containment requires revoking sessions and resetting the password, then removing attacker-registered devices and MFA methods, since a password reset alone leaves those in place.

huntress.com → (opens in a new tab)

Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents (opens in a new tab)

The Record ·fetched 23 Oct 2026, 07:37 UTC agreed3/3

Why readMicrosoft puts a name and a method behind the ConnectWise supply chain compromise: Storm-0940, running an AI penetration testing framework called ARTEX against hundreds of further targets.

Microsoft attributes the recent ConnectWise breach to Storm-0940, a Chinese state aligned group that has been using an AI pentest framework named ARTEX to break into cloud infrastructure since September. Victims span government, aerospace, defence, finance, manufacturing, technology and energy. The claimed differentiator is speed; Microsoft says the tooling compressed the usual recon, credential theft and privilege escalation chain into a far shorter window, and the same playbook is being pointed at hundreds of other organisations. Treat this as a campaign and attribution story first, with the AI angle as the reason the tempo changed.

Also covered byDark Reading (opens in a new tab).

therecord.media → (opens in a new tab)

Infostealer riding the AI Train (opens in a new tab)

Check Point Research ·fetched 23 Oct 2026, 15:37 UTC Research agreed3/3

Why readNew infostealer Aokigahara steals session and config files for Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI alongside SSH keys and AWS/Azure/GCP credentials.

Aokigahara, likely an evolution of malware previously tracked as Kamidere or Stygian, extends the usual browser, VPN, wallet and password-manager theft to AI developer tooling: authentication files, session data and configuration for Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, Copilot and Gemini CLI. Its collection scope also covers Git credential files, SSH private keys and cloud credential and config files, pointing at developer and cloud environments rather than consumer targets. The monetisation angle is resale of paid AI accounts and session tokens, which makes AI tool credentials a defensible thing to rotate and monitor.

research.checkpoint.com → (opens in a new tab)

Risky Bulletin: Supply chain attack lets ransomware group inside 40 shipping companies (opens in a new tab)

Risky Business News ·fetched 23 Oct 2026, 07:37 UTC agreed3/3

Why readOne supplier compromise put a ransomware crew inside roughly 40 shipping companies, and PHP2Shell exploitation is now live in the wild.

Risky Business reports a ransomware group pivoting through a single supply chain compromise into around 40 shipping firms, a sector where operational downtime carries immediate freight consequences. The same bulletin notes active exploitation of PHP2Shell beginning, GoDaddy revoking 400,000 certificates, and the Pentagon standing up a technology sabotage unit. It is a roundup, so each thread needs the linked source for specifics, but the shipping and PHP2Shell items are worth chasing today.

risky.biz → (opens in a new tab)

The Current Landscape of OAuth Attacks (opens in a new tab)

Unit 42 ·Beliz Kaleli, Diva-Oriane Marty, Oleksii Alex Starov and Shawn He Shuang ·fetched 23 Oct 2026, 19:40 UTC agreed2/3

Why readA current read on how attackers moved from stealing passwords to stealing consent, and why that beats MFA rather than going around it.

Unit 42 maps the OAuth abuse landscape: once an attacker holds an access or refresh token, the access survives password resets and MFA re-enrolment because the theft happens at the authorization layer, after authentication has already succeeded. The report describes phishing-as-a-service templates, dynamic evasion code and LLM-generated brand impersonation being used to drive consent grants at scale. Volume stays low relative to credential phishing, but each success yields durable reach across every service tied to the identity, with no credential alerts to trip.

unit42.paloaltonetworks.com → (opens in a new tab)

Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016 (opens in a new tab)

SecurityWeek ·Eduard Kovacs ·fetched 23 Oct 2026, 07:37 UTC agreed3/3

Why readSemperis says the Iranian APT Prince of Persia (Infy) ran a C&C server from US-based hosting this year, its first time doing so since 2016, after an unprecedented three-month operational blackout.

Semperis researchers, who have tracked the group's infrastructure continuously, report that Prince of Persia took one C&C server offline within a week of SafeBreach's February 2026 report and then relocated the rest. Operations stopped for roughly three months, the longest confirmed pause in the group's near-20-year history, overlapping the Iran/US/Israel conflict that began on February 28. When it resumed, one of the C&C servers was hosted in the United States. Targeting remains Iranian dissidents plus government and private entities in the US, Europe and the Middle East.

securityweek.com → (opens in a new tab)

Unboxing Phishing Kits: Huntress Examines 3 Real Kits (opens in a new tab)

Huntress ·fetched 23 Oct 2026, 07:37 UTC agreed3/3

Why readWalkthrough of three staged phishing kits, including the admin dashboards operators use to work stolen credentials, seen from the defender's side.

Huntress analysts unpack recently staged phishing kits, from simple HTML-and-script single-page credential grabbers up to kits shipping admin dashboards for managing captured sessions and credentials. The piece pairs kit internals with what the resulting activity looks like in telemetry. It is a video recap rather than new research, but useful grounding if you are writing detections for commodity credential theft.

huntress.com → (opens in a new tab)

CVE-2026-114625: Arista VeloCloud Orchestrator, Arista VeloCloud Orchestrator SQL Injection Vulnerability (opens in a new tab)

CISA KEV ·fetched 23 Oct 2026, 19:40 UTC Must read CVE-2026-114625 Exploited in the wild · patch by 2026-10-26 EPSS 0.6% agreed3/3

Why readCISA added a SQL injection flaw in on-prem Arista VeloCloud Orchestrator (CVE-2026-114625) to KEV with a 2026-10-26 remediation deadline.

Arista VeloCloud Orchestrator on-prem carries a SQL injection flaw that lets a remote attacker reach privileged internal functionality and compromise the VCO host and the data it manages. KEV listing means exploitation is confirmed; federal agencies must apply vendor mitigations by 2026-10-26 under BOD 26-04, or discontinue use where no mitigation exists. EPSS is still low at 0.0056, so the KEV entry rather than the scoring is the reason to move: SD-WAN orchestrators are management-plane assets with reach into every branch device.

arista.com → (opens in a new tab)

CVE-2026-110447: Collabora Collabora Online – Built-in CODE Server, Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (opens in a new tab)

CISA KEV ·fetched 23 Oct 2026, 23:40 UTC Must read CVE-2026-110447 Exploited in the wild · patch by 2026-10-26 EPSS 1.2% agreed3/3

Why readKEV addition with a 2026-10-26 federal deadline: OS command injection in the Collabora Online built-in CODE server shipped with Nextcloud gives remote code execution.

CVE-2026-110447 lets an attacker reach remote code execution against Nextcloud deployments running the bundled Collabora Online CODE server, specifically in the state where the CODE server is not running. CISA added it to KEV with a remediation due date of 2026-10-26 under BOD 26-04, including the forensics triage requirements for affected assets. EPSS is still low at 0.012, but KEV membership means exploitation is confirmed; patch or discontinue the component.

help.nextcloud.com → (opens in a new tab)

php2shell: Two Critical PHP Vulnerabilities Expose Web Servers to Remote Code Execution (opens in a new tab)

Sygnia ·Sygnia ·fetched 23 Oct 2026, 11:41 UTC Must read agreed3/3

Why readTwo unauthenticated RCE bugs in PHP itself, CVSS 9.2, with attack traffic already observed and fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 out since 21 October 2026.

CVE-2026-109618 and CVE-2026-109619, dubbed php2shell, allow unauthenticated remote code execution against the PHP runtime rather than any individual application or plugin, so every vulnerable web host is in scope regardless of CMS or framework. Apache mod_php carries the highest demonstrated risk, with PHP-FPM and other SAPIs also requiring updates. Researchers have seen attack traffic against both and public research has achieved RCE in a lab configuration; the configuration-based mitigations PHP published only narrow specific exploitation paths, so patching to the fixed releases is the real fix.

Also covered bySnyk (opens in a new tab),SANS ISC Diary (opens in a new tab),Truesec (opens in a new tab),Cybersecurity Dive (opens in a new tab),oss-security (opens in a new tab),SANS ISC Diary (opens in a new tab),Tenable Research (opens in a new tab).

sygnia.co → (opens in a new tab)

New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 (opens in a new tab)

Help Net Security ·Mirko Zorz ·fetched 23 Oct 2026, 07:37 UTC Must read CVE-2026-109618 EPSS 5.8% agreed3/3

Why readA free scanner for the PHP2Shell pair, CVE-2026-109618 and CVE-2026-109619, which give pre-auth RCE against PHP apps in default mod_php and PHP-FPM setups.

Searchlight Cyber has published php2shell-scanner, an open source checker for the two PHP remote code execution bugs patched on 21 October. The flaws reach pre-auth RCE under stock Apache mod_php and PHP-FPM configurations, with exploitation confirmed against WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud and Magento, so the exposed estate is effectively anything running PHP behind a web server. The scanner is the practical takeaway; the item itself is a tool announcement rather than original analysis, but the underlying bug class makes rapid inventory worth doing today.

helpnetsecurity.com → (opens in a new tab)

How CVE-2026-73570 turns a Zimbra log file into remote code execution (opens in a new tab)

Elastic Security Labs ·Eric Forte ·fetched 23 Oct 2026, 15:37 UTC CVE-2026-73570 EPSS 71.7% agreed3/3

Why readWalks the full chain for CVE-2026-73570: one malformed recipient address lands in /var/log/zimbra.log and the Swatchdog monitoring daemon executes it, giving unauthenticated RCE on an internet-facing mail server.

CVE-2026-73570 is an unauthenticated command injection in Zimbra where the injection sink is not the mail parser but the log pipeline. A malformed recipient address is written verbatim to /var/log/zimbra.log, and the Swatchdog daemon that monitors the log matches it and runs the attacker-supplied command. EPSS sits at 0.72 (99.4th percentile), and the write-up reproduces the exploit on representative systems to build detection rules, so defenders get both the mechanism and the telemetry to hunt on.

elastic.co → (opens in a new tab)

Node2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius affects many libraries & apps using HTTPs. (opens in a new tab)

Aikido Security ·fetched 23 Oct 2026, 23:40 UTC CVE-2026-111497 EPSS 0.5% agreed3/3

Why readCVE-2026-111497 in Brotli decoding reaches far past Node.js: Python's Brotli and brotlicffi, libbrotli, C++ and Envoy are all affected, and the mitigation if you cannot patch is to disable Brotli decoding.

The flaw behind Node2Shell is in Brotli itself, so any library or service that decodes Brotli is in scope rather than just Node.js. Aikido found the same vulnerable code compiled into the PyPI packages Brotli and brotlicffi, and reports patches now out for libbrotli, Python, C++, Node.js and Envoy, with other ecosystems still unpatched. Apache and Nginx do not decode Brotli by default, which narrows the exposure for reverse proxies; where no patch exists, turn Brotli decoding off.

Also covered byAikido Security (opens in a new tab).

aikido.dev → (opens in a new tab)

nginx RCEs CVE-2026-93479, CVE-2026-15176 (opens in a new tab)

oss-security ·fetched 23 Oct 2026, 23:40 UTC CVE-2026-15176 EPSS 0.6% agreed3/3

Why readOpen source nginx before 1.31.7 and 1.30.6 is affected by several issues, at least two of which carry remote code execution potential.

F5 published advisory K000163408 covering issues that reach open source nginx, including CVE-2026-93479 and CVE-2026-15176. The fixed versions are 1.31.7 and 1.30.6; nginx's own advisory page makes publication dates hard to pin down and the team does not post to oss-security, so inventory work is on you. Given how much internet-facing surface runs nginx as a reverse proxy, this is a same-week patch cycle even with EPSS still low.

seclists.org → (opens in a new tab)

CVE-2026-113672 (CVSS 9.9): Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evalu (opens in a new tab)

NVD ·fetched 23 Oct 2026, 11:41 UTC CVE-2026-113672 CVSS 9.9 EPSS 0.8% agreed3/3

Why readArgo CD's repo-server evaluates .jsonnet imports without confining them to the repo root, so a committed file reads service-account tokens and repository credentials off the pod.

CVE-2026-113672 (CVSS 9.9) affects Argo CD from 0.9.0 up to 3.3.15, 3.4.10, 3.5.4 and 3.6.0-rc2. The jsonnet importer honours absolute paths, parent-directory traversal and repository symlinks, exposing anything the repo-server can read including /proc/self/environ, projected service-account tokens and mounted private keys; routing the contents into a ConfigMap returns them to the caller despite Secret redaction. Delivery needs only a commit to a watched repository or a POST to /api/v1/applications/manifestsWithFiles, which requires just Application get permission, and importstr on /dev/zero exhausts repo-server memory.

nvd.nist.gov → (opens in a new tab)

CVE-2026-113708 (CVSS 9.9): Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref (opens in a new tab)

NVD ·fetched 23 Oct 2026, 11:41 UTC CVE-2026-113708 CVSS 9.9 EPSS 0.7% agreed3/3

Why readA leading-hyphen Kustomize ref value reaches git fetch as --upload-pack and executes commands inside argocd-repo-server, and blocking egress does not stop it.

CVE-2026-113708 (CVSS 9.9) covers Argo CD 2.7.0 through 3.3.15, 3.4.10, 3.5.4 and 3.6.0-rc2, where ref and version query values from remote Kustomize resource, base or component URLs are passed to git fetch without an end-of-options separator. With a file:// local transport the injected --upload-pack command runs as the repo-server user, reads repository credentials and returns output through manifest-generation errors; https:// remotes do not execute it, and because the local transport never leaves the pod, egress filtering is no mitigation. The upload path via POST /api/v1/applications/manifestsWithFiles needs only Application get, not update, sync or repository write.

nvd.nist.gov → (opens in a new tab)

CVE-2026-70386 (CVSS 8.5): Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS (opens in a new tab)

NVD ·fetched 23 Oct 2026, 23:40 UTC CVE-2026-70386 CVSS 8.5 EPSS 1.2% agreed3/3

Why readAny zero-permission Android app on affected OxygenOS builds gets arbitrary shell as uid 0 in the dumpstate SELinux domain, with no user interaction.

Two defects combine: OnePlus's atlasservice binder interface accepts setEvent(String8, String8) from any caller with no authorization check, and OplusAtlasLogWriter::handleEvent for atlas_event_multimedia_audio_dumpsys copies the caller value into the oplus.audio.dumpinfo.type system property, then starts the root init service audiodumpinfo which passes it unsanitized to system(). Affects OxygenOS 16.1.0 before 16.1.10.500, 16.0.0 before 16.0.5.1200, and 15.0.0 before 15.0.0.2000. Local vector, but a fully weaponisable local privilege escalation across a large consumer handset fleet and a real problem for BYOD estates.

nvd.nist.gov → (opens in a new tab)

CVE-2026-82814 (CVSS 8.8): The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10 (opens in a new tab)

NVD ·fetched 23 Oct 2026, 23:40 UTC CVE-2026-82814 CVSS 8.8 EPSS 0.5% agreed3/3

Why readDuplicator up to 1.5.17 and Duplicator Pro up to 4.6.10 deserialize untrusted database content during migration, with two different working gadget chains documented.

DUPX_UpdateEngine::unserializeTest() unserializes site content during the search-and-replace step of a migration, so an unauthenticated attacker stores a serialized payload in public content and waits for an administrator to build a package and import it. Duplicator Free bundles a Requests 1.7 POP chain giving attacker-chosen callbacks and direct OS command execution; Pro bundles an IndexList destructor gadget that deletes an attacker-chosen file, and deleting wp-config.php reopens the setup wizard for a takeover. Exploitation needs the package built after the payload is stored plus an admin migration action, which lowers the odds but not the impact on a plugin with a very large install base.

nvd.nist.gov → (opens in a new tab)

CVE-2026-112712 (CVSS 9.1): @fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped midd (opens in a new tab)

NVD ·fetched 23 Oct 2026, 15:37 UTC CVE-2026-112712 CVSS 9.1 EPSS 0.3% agreed3/3

Why readPath-scoped middleware in @fastify/middie 9.0.0 through 9.3.5 can be silently skipped while the route still executes, so authentication or rate limiting registered via use() may never run.

The use() function joined a middleware mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router actually serves, most commonly when the scope prefix ended in a slash, and also for array mount paths and paths written without a leading slash. When the two disagree the middleware is skipped but the handler runs, so a single unauthenticated request bypasses auth, authz or rate limiting attached that way. Fixed in 9.3.6; the interim workaround is to enforce authorization in a preHandler hook that runs after route resolution.

nvd.nist.gov → (opens in a new tab)

Metasploit Wrap Up: Langflow, MongoDB, and More (opens in a new tab)

Rapid7 ·Alan David Foster ·fetched 23 Oct 2026, 19:40 UTC Must read Research CVE-2026-10134 EPSS 6.2% agreed3/3

Why readEleven new Metasploit modules land, six of them against Langflow covering auth bypass and three unauthenticated RCE paths across releases 1.0.0 through 1.11.4.

The Langflow cluster covers an authentication bypass (CVE-2026-93680), unauthenticated RCE via CVE-2026-0768, CVE-2026-0769 and CVE-2026-10134, and two authenticated code execution flaws (CVE-2026-7873, CVE-2026-93674), credited to rmhowe425 with research by Peter Girnus and n0k0. Also shipped: a pre-auth RCE chain against OpenCTI from kmkz, three new MongoDB auxiliary modules, an Apache Solr version scanner, and a 4gaBoards mass user information disclosure module (CVE-2026-53959). If you run Langflow or OpenCTI internally, weaponised coverage is now public and the exposure assessment is immediate.

rapid7.com → (opens in a new tab)

eMudhra / emSign CA Compromise: What Python, pip, and CI/CD Users Need to Update (opens in a new tab)

StepSecurity (CI/CD) ·fetched 23 Oct 2026, 03:44 UTC Must read agreed3/3

Why readConcrete remediation for the eMudhra/emSign CA incident across pip, uv, virtual environments and CI/CD base images, following Python's 20 October 2026 advisory to update packaging tools.

Google confirmed that eight eMudhra intermediate CA certificates had private keys generated with insufficient randomness, meaning anyone recovering a key can mint certificates that impersonate HTTPS sites to clients still trusting the affected chain. For software delivery the consequence is that a dependency downloader could accept an attacker's response as authentic without the package registry being touched at all, given an attacker positioned to intercept or redirect the connection. The post lists which Python tooling is affected, reports verified certificate-trust test results, and gives update steps for pip, uv, venvs and CI images.

Also covered byUnit 42 (opens in a new tab),Rediff MoneyWiz (opens in a new tab),Business Standard (opens in a new tab),Daily Excelsior (opens in a new tab),India.com (opens in a new tab),Adda247 (opens in a new tab),TechGig (opens in a new tab),BizzBuzz (opens in a new tab).

stepsecurity.io → (opens in a new tab)

Compromised TLS Certificates (opens in a new tab)

Schneier on Security ·Bruce Schneier ·fetched 23 Oct 2026, 11:41 UTC Must read agreed3/3

Why readA publicly trusted CA issued certificates whose P-384 private keys held single-digit bits of entropy, which means anyone can recover them and impersonate the named hosts.

Eight TLS certificates from Indian CA eMudhra Limited were found carrying NIST P-384 private keys with roughly 3 to 8 bits of entropy instead of the expected 384, with recorded key values as small as 4 and 56. Researchers quoted in the writeup suspect a key generation interface with a misused size parameter or example code that reached production, and the more damning point is that nobody caught it at issuance or during CA audits. The immediate exposure lands on VPN users in jurisdictions where traffic interception is routine, but the broader lesson is that WebPKI trust still rests on issuance hygiene no relying party can verify directly.

schneier.com → (opens in a new tab)

RDP: Forensic analysis of Windows Remote Desktop Protocol artifacts (opens in a new tab)

Magnet Forensics ·HaadiyaAli ·fetched 23 Oct 2026, 19:40 UTC agreed3/3

Why readMaps which RDP artefacts survive on the source host versus the destination host, and which of them prove an interactive session rather than a mere connection attempt.

Walks Windows RDP forensics from both ends of the connection: source-side evidence of attempted destinations and the account used, destination-side evidence of who connected, from where, and the session start and end times. The central argument is that no single artefact carries the whole story, so conclusions should rest on several artefacts agreeing, and that the session should be treated as an investigative window to be filled in with execution, filesystem, network and data-movement evidence including drive and clipboard redirection transfers. Practical grounding for lateral-movement timelines.

magnetforensics.com → (opens in a new tab)

AfterDeleteBench: Auditing Post-Deletion Information Persistence in LLM Agents (opens in a new tab)

arXiv cs.CR (AI) ·Ehsan Saleh, Roozbeh Nahavandi, Sama Salarian, Raef Bassily ·fetched 23 Oct 2026, 11:41 UTC Must read Research agreed3/3

Why readDeleting a memory record from an LLM agent does not delete the information: a single query recovered a supposedly deleted secret from Qwen2.5-7B-Instruct in about two thirds of cases.

AfterDeleteBench audits whether information survives deletion in fixed-weight LLM agents with persistent memory, comparing an exposed-then-deleted agent against a matched never-exposed control so recovery can be attributed to the original exposure. Never-exposed controls recovered nothing, while the exposed-then-deleted agent gave up the secret roughly two thirds of the time. More awkward for anyone claiming GDPR-style erasure: even with no verbatim copy left, exact reconstruction from separately stored components under a public composition rule succeeded in 62-99% of cases across Qwen, Mistral and Phi-3.

arxiv.org → (opens in a new tab)

CVE-2026-114053 (CVSS 9.2): vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting c (opens in a new tab)

NVD ·fetched 23 Oct 2026, 23:40 UTC Must read CVE-2026-114053 CVSS 9.2 EPSS 0.5% agreed3/3

Why readvLLM lets a request pick which revision of remote processor code gets imported, turning the unauthenticated /tokenize endpoint into code execution when trust_remote_code is on.

From 0.7.3 until 0.31.0, vLLM passes the client-supplied mm_processor_kwargs.code_revision straight through to Transformers AutoProcessor.from_pretrained, so the caller, not the operator, decides which revision of a model's dynamic processor code is loaded. With trust_remote_code enabled and an attacker able to push a revision into the served model repository, a single multimodal request to the unauthenticated /tokenize endpoint runs arbitrary Python inside the API process. It is a clean example of request-controlled parameters reaching a loader that was only ever meant to take operator input, and it argues for pinning revisions and treating model repositories as a supply chain boundary.

nvd.nist.gov → (opens in a new tab)

Amplifying Latency and Cost of LLM Inference via Rowhammer Attack (opens in a new tab)

arXiv cs.CR (AI) ·Mrityunjay Shukla, Shubham Roy, Biswabandan Panda ·fetched 23 Oct 2026, 23:40 UTC Must read Research agreed3/3

Why readA single DRAM bit-flip in the compiler, not the model, makes GPU inference permanently slower while every output stays correct.

LLVMhammer targets Triton's MLIR/LLVM just-in-time pipeline on the host CPU, flipping a bit in a performance-critical optimization pass so the compiler emits a functionally identical but slower GPU kernel. Because Triton caches compiled kernels to disk, one successful flip persists across later runs, and because the affected stages are target-independent the technique does not care which GPU vendor is downstream. The authors also release Karnage, a tool that locates exploitable flip sites automatically. Treat this as a cost and capacity attack on inference infrastructure: nothing in output quality monitoring will show it.

arxiv.org → (opens in a new tab)

OpenShell – A safe, private runtime for fleets of autonomous AI agents (opens in a new tab)

Hacker News ·niemandhier ·fetched 23 Oct 2026, 03:44 UTC Must read Research 324 points agreed3/3

Why readA sandbox runtime for autonomous agents that enforces file, syscall and network policy in the kernel and keeps real credentials out of the agent's reach entirely.

OpenShell 0.1.x runs each agent in an isolated sandbox where kernel controls mediate file access and system calls, and every outbound connection passes a policy check before leaving. Credentials are never visible to the agent: the runtime injects them into requests bound for approved destinations. Policy changes are checked by formal verification before they apply, so an operator can see what a loosened rule would permit before shipping it. For anyone running agents with package-install and API-call rights, this is a deployable alternative to container-only isolation.

github.com → (opens in a new tab) Discussion (opens in a new tab)

WildFakeToolBench: Benchmarking AI-Generated Image Detectors with Web-Sourced Image Processing (opens in a new tab)

arXiv cs.CR (AI) ·Mingjie Li, Yukun Jiang, Yicong Tan, Yang Zhang ·fetched 23 Oct 2026, 15:37 UTC Research agreed3/3

Why readBenchmark of 156 executable image-processing tools scraped from public forums achieves 25-100% attack success against six state-of-the-art AI-image detectors.

WildFakeToolBench builds 156 runnable tools from 220 public sources across 142 domains, each retaining its source evidence and passing syntax, execution and output-distortion checks without feedback from the detectors under test. Run against 105 images from five generators, the strongest individual tools beat every one of six image-processing baselines, with attack success rates between 25.25% and 100% across six detectors. The argument is that LLM-assisted code translation lets an attacker assemble these evasion tools from forum posts with no specialist knowledge or local GPU, which undercuts detector deployments relying on robustness to ordinary post-processing.

arxiv.org → (opens in a new tab)

AgentPhishing: A Benchmark of LLM Email Agents Under Adaptive Attack (opens in a new tab)

arXiv cs.CR (AI) ·Justin Tan, Miao Li, Ding Zhao ·fetched 23 Oct 2026, 07:37 UTC Research agreed3/3

Why readA benchmark showing LLM email agents handle known phishing corpora but comply with malicious requests once the mail is optimised against them, plus the optimiser that does it.

AgentPhishing evaluates whether persuasive phishing both evades agent detection and induces compliance, which existing detection-oriented datasets never measured. The authors build PhishOpt, which optimises reusable email-generation skills against individual agents under realism constraints, then analyse the successful emails through Cialdini's persuasion principles to derive a universal generation skill that transfers. The finding that matters: agents that correctly flag stock phishing samples fail against adaptively generated ones.

arxiv.org → (opens in a new tab)

OP-Print: Tracing Membership Imprints in On-Policy Self-Distillation (opens in a new tab)

arXiv cs.CR (all) ·Qi Li, Xinchao Wang ·fetched 23 Oct 2026, 03:44 UTC Research agreed3/3

Why readFirst membership inference attack framework aimed at on-policy self-distillation, showing the memorisation imprint is sparse and concentrated at uncertainty-sensitive correction sites.

OP-Print attacks models trained with on-policy self-distillation, where a student's own outputs (enriched with extra context or demonstrations) serve as supervision. The finding behind it is that the supervision imprint is structured rather than spread across the rollout, concentrating on correction sites where the two coupled views disagree, which gives a targeted attack signal. Separate variants are built for gray-box access, which aggregates the privileged signal directly, and black-box access. Relevant to anyone treating teacher-free distillation as a privacy-preserving training choice.

arxiv.org → (opens in a new tab)

Social-HUMINT: An LLM-Augmented Unified Framework for Measuring Social Media Exposure (opens in a new tab)

arXiv cs.CR (AI) ·Pellegrino Casoria, Simon Pietro Romano ·fetched 23 Oct 2026, 03:44 UTC Research agreed3/3

Why readA validated taxonomy of 38 SOCMINT and Cyber-HUMINT capabilities plus a method for measuring how far LLM-inferred profiles enable social engineering against a given target.

The paper unifies SOCMINT and Cyber-HUMINT into a single doctrine-grounded taxonomy of 38 capabilities mapped across the CTI lifecycle, validated by domain experts at Fleiss' kappa 0.92. It argues exposure is not what a person posts but what an LLM can infer from it, and operationalises that by scoring profiling accuracy and the attack surface the profile opens. Useful for anyone building a measurable social-engineering exposure assessment rather than ad hoc OSINT checks.

arxiv.org → (opens in a new tab)

CVE-2026-111767 (CVSS 8.6): MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the ex (opens in a new tab)

NVD ·fetched 23 Oct 2026, 11:41 UTC CVE-2026-111767 CVSS 8.6 EPSS 0.3% agreed3/3

Why readThe official MCP TypeScript SDK let clients sharing an InMemoryTaskStore list, read and cancel each other's tasks because tasks carried no session ownership check.

CVE-2026-111767 affects MCP TypeScript SDK 1.24.0 up to 1.32.0: the experimental tasks feature (taskStore) never validated which session created a task. Any client on a shared InMemoryTaskStore could enumerate and cancel tasks belonging to other sessions, a straightforward cross-tenant break in multi-client MCP servers. Fixed in 1.32.0; anyone running the experimental tasks feature should upgrade and audit who shared a store.

nvd.nist.gov → (opens in a new tab)

SecLog-Bench: A Scalable Benchmark for Cybersecurity Log Reasoning with Scaffolded Evidence (opens in a new tab)

arXiv cs.CR (AI) ·Yifan Wang, Dongliang Xu, Xiaoyong Li, Jing Li ·fetched 23 Oct 2026, 19:40 UTC Research agreed3/3

Why readA benchmark that measures how well eight mainstream LLMs reconstruct attack progression from audit, application and network logs when given a scaffolded evidence chain.

SecLog-Bench builds an extensible simulation platform covering 29 attack scenarios and generates multi-source logs (audit, application, network traffic) labelled by attack stage, with each sample annotated with a structured step-by-step evidence chain rather than a binary attack label. Eight LLMs are evaluated on post-detection attack-progress reasoning with that scaffolding supplied. Useful as a yardstick for anyone considering LLM-assisted log triage, though it measures reasoning given curated evidence rather than detection from raw telemetry.

arxiv.org → (opens in a new tab)

CVE-2026-105772 (CVSS 9.1): Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated atta (opens in a new tab)

NVD ·fetched 23 Oct 2026, 11:41 UTC CVE-2026-105772 CVSS 9.1 EPSS 0.5% agreed3/3

Why readAgent frameworks are shipping the same path traversal bugs web apps shipped a decade ago, and this one needs no authentication.

Google ADK TypeScript versions 0.4.0 up to 0.6.0 fail to sanitise userId and sessionId in FileArtifactService, so traversal sequences including percent-encoded forms escape the artifact storage root. An unauthenticated remote caller can read files matching the artifact layout, and write outside the root when an agent tool calls saveArtifact. Only deployments that exposed the API server with the non-default FileArtifactService are affected; the default InMemoryArtifactService is not, and 0.6.0 fixes it.

nvd.nist.gov → (opens in a new tab)

CVE-2026-112380 (CVSS 9.0): Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group t (opens in a new tab)

NVD ·fetched 23 Oct 2026, 15:37 UTC CVE-2026-112380 CVSS 9.0 EPSS 0.4% agreed2/3

Why readA worked example of a consumer messaging group being wired up as an unauthenticated control plane for an AI agent with host command execution.

Kiro Crew before 0.7.2 does not check authorization on messages arriving through its WhatsApp group channel, so any member of a group the operator configured can steer the operator's other agent sessions and run arbitrary commands on the host. The interesting part is the architecture, not the missing check: a chat room membership list becomes the effective access control boundary for an agent runtime. Anyone running agent frameworks with chat integrations should audit which channel identities map to which privileges, and upgrade to 0.7.2.

nvd.nist.gov → (opens in a new tab)

Below the Threshold: Why Britain’s Smallest Power Generators Face a Four-Year Cyber Security Gap (opens in a new tab)

IOActive ·Christian Powills ·fetched 23 Oct 2026, 15:37 UTC Must read agreed3/3

Why readLays out the exact regulatory gap that leaves UK sub-2GW and distribution-connected generators outside NIS 2018, with Cyber Essentials Plus baselines not landing until end of 2030.

The NIS Regulations 2018 capture electricity generation only at 2GW cumulative capacity and explicitly exclude generators not connected to a transmission system, which left a small gas generator taken offline for four days in July 2026 outside the regime. DESNZ and Ofgem confirmed on 5 August 2026 that baseline requirements for all Ofgem licensees will be built on Cyber Essentials Plus, consulted on in 2027 and in place by end of 2030, and the same response concedes Cyber Essentials Plus excludes OT and lacks governance, incident response, risk management and supply chain controls. IT/OT segregation was the most requested additional control in consultation responses and is not in the proposed baseline, which is a specific, arguable criticism anyone running UK distributed generation can take to their own risk register.

ioactive.com → (opens in a new tab)

EU Regulators to Investigate Booking.com Over Scam Risks (opens in a new tab)

Infosecurity Magazine ·fetched 23 Oct 2026, 03:44 UTC agreed3/3

Why readThe Commission is testing whether anti-phishing and anti-fraud controls count as systemic risk duties under the DSA, which sets the bar for every large platform that brokers payments or messaging.

The European Commission has opened a DSA proceeding against Booking.com over fraudulent listings and phishing, examining how reservation and guest data is shared with accommodation providers and whether that data gets misused to solicit fraudulent payments. The in-platform messaging service and its abuse potential are a named focus area. No findings yet, so the value for now is the scope, which maps directly onto controls that marketplace and travel operators will be asked to evidence.

infosecurity-magazine.com → (opens in a new tab)

FCC bans two devices with surveillance chips linked to Huawei (opens in a new tab)

The Record ·fetched 23 Oct 2026, 23:40 UTC agreed3/3

Why readFirst device ban under the FCC rules that took effect 13 October, covering a wireless video transmitter and a dashcam built on Huawei subsidiary HiSilicon chips.

The FCC blocked two devices from entering the US market because they contain HiSilicon components, the first enforcement since rules effective 13 October extended the covered list to otherwise lawful devices containing smart components from listed firms. HiSilicon markets the parts for surveillance use with built-in face detection. Procurement and supply-chain teams buying white-label video or telematics hardware now have a compliance exposure that did not exist two weeks ago.

therecord.media → (opens in a new tab)

UK proposes 14-year prison terms for undersea cable sabotage (opens in a new tab)

The Record ·fetched 23 Oct 2026, 15:37 UTC agreed3/3

Why readUK consultation would replace the 1885 Submarine Telegraph Act with offences carrying 14 years and unlimited fines for damaging subsea cables, interconnectors and pipelines.

The British government opened a consultation proposing criminal offences covering telecommunications cables, electricity interconnectors and pipelines that carry 99% of UK international data traffic and supply 74% of its gas. The current law, the Submarine Telegraph Act 1885, caps penalties at a £1,000 fine and five years. The move follows incidents such as the Eagle S tanker anchor damage to the Estlink 2 Finland-Estonia interconnector, and signals how hybrid-warfare threats to subsea infrastructure are being brought into criminal law.

Also covered byHelp Net Security (opens in a new tab).

therecord.media → (opens in a new tab)

Who Checked It? Attestations, Gemara, and CRA Due Diligence (opens in a new tab)

OpenSSF ·OpenSSF ·fetched 23 Oct 2026, 11:41 UTC agreed2/3

Why readSeparates what an attestation actually asserts from who vouched for it, which is the distinction that decides whether an artifact satisfies Cyber Resilience Act due diligence or just looks like it does.

Eddie Knight argues that attestations suffer from functional overload: the term has a clear definition but wildly divergent implementations, so two artifacts both called attestations can carry very different evidentiary weight. The piece works through how Gemara models the relationship between a claim, the evidence behind it, and the party asserting it, then maps that onto the due diligence obligations the EU Cyber Resilience Act places on manufacturers consuming open source components. Useful for anyone currently deciding which supply chain artifacts to collect and retain for CRA conformity, rather than discovering later that they collected the wrong kind.

openssf.org → (opens in a new tab)

Now Google says it might use your Gmail and Google Photos data to target ads (opens in a new tab)

Hacker News ·JustSkyfall ·fetched 23 Oct 2026, 23:40 UTC 208 points agreed3/3

Why readGoogle quietly carved an exception into its promise never to use Gmail, Drive and Photos content for ad targeting.

As of 16 October the privacy policy now says the no-ads-from-your-mail guarantee holds unless you choose to make that data available to other Google services that support personalized ads, which is exactly what connecting Personal Intelligence to AI Mode does. Google says advertisers never see the underlying content or identifiers, and that sensitive categories stay off limits. For governance teams the practical question is whether staff enabling a convenience feature in a managed Workspace estate are opting corporate correspondence into an ad-targeting surface.

theverge.com → (opens in a new tab) Discussion (opens in a new tab)

Compliance takeaways from the SEC’s new examination handbook (opens in a new tab)

Compliance Week ·Jaclyn Jaeger ·fetched 23 Oct 2026, 15:37 UTC agreed3/3

Why readThe SEC has published an examination handbook documenting each stage of an exam, from first contact to deficiency letter, which changes how registrants prepare.

The SEC's new exam handbook formalises what firms can expect at every stage of an examination and what examiners will ask for. For registrants, this moves exam preparation from folklore to a documented process, including the deficiency letter stage. The piece is compliance-side guidance rather than security-specific, so the value is in knowing the handbook exists and what it covers.

complianceweek.com → (opens in a new tab)

Toronto crime tips org freezes operations after details of data breach come to light (opens in a new tab)

The Record ·fetched 23 Oct 2026, 03:44 UTC Must read agreed3/3

Why readCrime Stoppers Canada froze operations after CBC reporters re-identified anonymous tipsters from 1.5 million leaked tips, a worked example of anonymity promises failing in a third-party breach.

Toronto's Crime Stoppers chapter halted operations hours after CBC reported that more than 1.5 million tips across Canadian chapters were exposed, with roughly half of the sample containing personal information and some records going back 25 years. Reporters reached more than a dozen supposedly anonymous tipsters using data released via DDoSecrets in March. The chapters had confirmed the breach but disclosed nothing about scope, pointing at vendor Navigate360 and its subsidiary P3 Global, which is the familiar third-party disclosure failure with unusually severe consequences for the people in the data.

therecord.media → (opens in a new tab)

Quest Diagnostics confirms patient information accessed in cyberattack, systems temporarily shut down (opens in a new tab)

Google News: incidents · Fox Business ·fetched 23 Oct 2026, 07:37 UTC Must read agreed3/3

Why readQuest Diagnostics confirms patient data was accessed and that it took systems offline, the kind of healthcare incident peers and boards will ask about this week.

Quest Diagnostics acknowledged a cyberattack in which patient information was accessed, and temporarily shut down systems in response. No scope, attribution or technical detail has been published yet. For a national clinical laboratory, the containment-by-shutdown decision and the patient-data exposure are both items a health-sector board will raise.

Also covered byNJBIZ (opens in a new tab).

news.google.com → (opens in a new tab)

Capcom data breach exposes 11.7 million account records (opens in a new tab)

Help Net Security ·Sinisa Markovic ·fetched 23 Oct 2026, 11:41 UTC Must read agreed3/3

Why readCapcom confirmed unauthorized third-party access to CAPCOM ID account data covering 11.7 million records, detected and confirmed on 19 October.

Capcom disclosed that a third party gained unauthorized access to customer information tied to CAPCOM ID, the account used for its web services and online play, affecting around 11.7 million records. Suspicious activity was detected on 19 October 2026 and the intrusion confirmed the same day. Account holders should expect phishing that impersonates Capcom; this is the company's second major incident after the 2020 Ragnar Locker attack.

Also covered byInfosecurity Magazine (opens in a new tab).

helpnetsecurity.com → (opens in a new tab)

South Carolina officials offer assistance after state capital hit with cyberattack (opens in a new tab)

The Record ·fetched 23 Oct 2026, 11:41 UTC agreed3/3

Why readColumbia, South Carolina has citizen-facing utility payment, GIS and animal services systems down after a cyberattack, with state law enforcement leading the response.

The city of Columbia, the South Carolina state capital with roughly 150,000 residents, identified suspicious activity and handed the investigation to the South Carolina Law Enforcement Division. The MyColaSC portal used for utility bill payment and non-emergency reporting is offline, along with GIS and animal services systems; residents have been told to phone in issues instead. The city has not said whether ransomware is involved and no group has claimed it, which is the detail peers in municipal government will be watching for.

therecord.media → (opens in a new tab)

Pentagon sued over data breach affecting more than 3 million people (opens in a new tab)

Google News: incidents · Federal News Network ·fetched 23 Oct 2026, 03:44 UTC agreed3/3

Why readClass action against the Pentagon over a breach affecting more than three million people, which puts federal breach liability back on the agenda.

The Department of Defense faces litigation over a data breach said to affect over three million individuals. Only the headline and outlet reached us, so the cause, the records involved and the legal theory are not described; the fact of a suit at that scale against DoD is the item.

Also covered byCybersecurity Insiders (opens in a new tab).

news.google.com → (opens in a new tab)

North Korean internet was hit by DDoS cyberattack, network monitoring firm says (opens in a new tab)

Google News: incidents · Reuters ·fetched 23 Oct 2026, 23:40 UTC agreed3/3

Why readNorth Korea's national internet connectivity was knocked down by a DDoS attack, per network monitoring telemetry.

A network monitoring firm observed a denial of service attack against North Korean internet infrastructure, reported by Reuters. No attribution is offered and the headline-level item carries no traffic figures or duration, but the event is the kind of state-level disruption an executive team will ask about.

news.google.com → (opens in a new tab)

Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals (opens in a new tab)

Google News: incidents · The HIPAA Journal ·fetched 23 Oct 2026, 11:41 UTC agreed3/3

Why readA Manhattan law firm notified 197,000 individuals of a PHI breach, another data point on legal-sector custody of healthcare records.

A Manhattan law firm has disclosed a data breach involving protected health information belonging to roughly 197,000 people. The report carries the headcount and the sector but no attribution, intrusion vector, or timeline. Relevant mainly as HIPAA exposure for third-party counsel holding client health data.

news.google.com → (opens in a new tab)

UltraMobile Imaging Identifies Data Breach Impacting 75,000 Individuals (opens in a new tab)

Google News: incidents · The HIPAA Journal ·fetched 23 Oct 2026, 15:37 UTC agreed3/3

Why readUltraMobile Imaging is notifying 75,000 people of a data breach; the headline is the whole story.

A HIPAA Journal item, reaching us via a Google News stub, reporting that UltraMobile Imaging identified a breach affecting 75,000 individuals. There is no cause, no timeline, no data-category detail and no attribution in the text available. A named organisation and a count, but too small and too thin to move anyone outside that provider's supply chain.

news.google.com → (opens in a new tab)