Thursday, 29 October 2026

VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign (opens in a new tab)

CrowdStrike ·Counter Adversary Operations ·fetched 29 Oct 2026, 23:41 UTC Must read Research agreed3/3

Why readVAPOR PANDA ran the ARTEX agentic framework with DeepSeek and a second commercial LLM against more than 200 organisations in parallel starting 17 October 2026, with Falcon telemetry covering tooling absent from prior ARTEX reporting.

CrowdStrike OverWatch tracked a China-nexus targeted-intrusion actor using an agentic LLM framework to drive simultaneous intrusions against foreign ministries in Latin America, Europe, Asia and the Middle East, US semiconductor, defence and think tank organisations, and telecoms providers in several regions. The report separates this activity from the ARTEX usage others have published under Storm-0940 and adds the actor's own deployed tooling observed in telemetry. This is the clearest evidence yet that agentic frameworks let a state-aligned operator scale operator-bound intrusion work across hundreds of targets at once, which changes the volume assumptions behind most targeted-intrusion detection.

crowdstrike.com → (opens in a new tab)

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 29 Oct 2026, 19:39 UTC Must read CVE-2026-20127 EPSS 89.3% agreed3/3

Why readNames the actor, the malware and the entry point for in-the-wild attacks on Cisco Catalyst SD-WAN Controllers, so defenders can hunt rather than just patch.

Cisco Talos attributes exploitation of CVE-2026-20127, a max-severity authentication bypass in Catalyst SD-WAN Controller and Manager patched back in February 2026, to a cluster tracked as UAT-11473 that deploys a bespoke framework called KeyDrift. The attacker gains privileged access and can register rogue peers; targeting has centred on space and satellite services, defence and aerospace. Talos sees overlap with the Silent Train covert access network associated with Volt Typhoon but stops short of attribution, and Lumen published complementary detail on Silent Train the day before.

bleepingcomputer.com → (opens in a new tab)

NIK C2: The new AI-enabled command-and-control framework (opens in a new tab)

Cisco Talos ·Chetan Raghuprasad ·fetched 29 Oct 2026, 11:41 UTC Must read Research agreed3/3

Why readFirst documentation of a live C2 framework that calls a commercial LLM API from inside the compromised session, collapsing the collection-then-analysis gap defenders rely on.

Talos found NIK C2 in the wild, a framework whose Windows implant dumps credentials and streams victim keystrokes, then feeds the harvest to a model through the OpenAI Chat Completions API for triage without the data ever leaving the session for offline processing. The same implant can deploy desktop screen-locking ransomware with a Bitcoin or USDT demand, so one toolkit covers theft and extortion. The defensive consequence is the detection window: staged exfiltration and later analysis used to leave time and artefacts, and an in-session triage loop removes both. Treat implant-originated traffic to LLM API endpoints as a hunting signal.

blog.talosintelligence.com → (opens in a new tab)

Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents (opens in a new tab)

Help Net Security ·Sinisa Markovic ·fetched 29 Oct 2026, 11:41 UTC Must read agreed3/3

Why readAn identity provider compromise has produced a public dataset naming undercover federal agents and their assignments, which is a physical safety consequence rather than a data-protection one.

A hacktivist group calling itself the Department of Peace leaked names, offices, contact details, and assignments for more than 41,000 DHS employees, passing the data to DDoSecrets and to Swiss hacker and journalist maia arson crimew. DDoSecrets published the dataset, named Icepick, on October 28, and it reportedly includes undercover ICE personnel. The group claims the records came from an Okta single sign-on environment, which if accurate makes the directory data held in an IdP, not just the authentication it brokers, the thing that was worth stealing.

Also covered byThe Washington Post (opens in a new tab),BBC Technology (opens in a new tab),CNBC (opens in a new tab).

helpnetsecurity.com → (opens in a new tab)

GitLab Security Incident: Attempted Exploitation of CVE-2026-97229 (opens in a new tab)

Hacker News ·sashk ·fetched 29 Oct 2026, 03:40 UTC CVE-2026-97229 EPSS 18.4% 107 points agreed3/3

Why readA first-party account of a distribution project's build infrastructure being attacked through a patched-but-unapplied GitLab flaw, with the one week gap between fix and attempt spelled out.

Alpine Linux reports that on 20 and 21 October an attacker attempted to exploit CVE-2026-97229, a CVSS 10.0 flaw in how GitLab evaluates regular expressions in CI configuration, against gitlab.alpinelinux.org a week after the patch shipped. The attempt came close enough that the project treated the instance as compromised and rebuilt it from scratch, though verification found the aports repository, packages and the 21 October releases untampered. All passwords were reset, and the project separately observed automated login attempts using credentials leaked from other sites, so reused passwords should be rotated now rather than when the instance reopens.

alpinelinux.org → (opens in a new tab) Discussion (opens in a new tab)

Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia (opens in a new tab)

Securelist ·GReAT ·fetched 29 Oct 2026, 11:41 UTC Research agreed3/3

Why readDocuments NetamLoader, a XAML-driven .NET assembly loading framework delivered through a CAB dropped into the Windows update package directory on a government-only custom Windows build in Asia.

Kaspersky GReAT traced a KSN detection on a .config file using AppDomainManager injection to a full supply-chain infection chain against a custom Windows image used solely by Asian government entities. The CAB archive looked benign on first inspection, containing legitimate Patch My PC components and Microsoft-signed .NET assemblies, with the malicious logic surfacing only on re-examination of the .config and the full load path. No attribution has been made, but the loader design and delivery route give defenders a concrete artefact set to hunt for in update staging directories.

securelist.com → (opens in a new tab)

MadApe: The Code That Opens the Door (opens in a new tab)

Group-IB ·fetched 29 Oct 2026, 07:41 UTC Research agreed3/3

Why readDocuments MadApe, a previously unreported Microsoft Device Code phishing kit that drives victims through Microsoft's real Device Login portal using business-themed PDF lures and configurable redirect chains.

Group-IB tracked a multi-stage campaign that skips credential-harvesting pages entirely and instead walks victims into completing Microsoft Device Code authentication against the legitimate portal, yielding account access without ever touching a password. The kit combines PDF lures, multi-stage redirects and impersonated document-sharing pages across a broad infrastructure cluster, and Group-IB assesses it as distinct from previously published Device Code kits. Useful for identity teams: Device Code flows that complete from unexpected geographies or unmanaged devices are the detection surface here.

group-ib.com → (opens in a new tab)

IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases (opens in a new tab)

Cisco Talos ·Aliza Johnson ·fetched 29 Oct 2026, 15:37 UTC agreed3/3

Why readTalos publishes its own Q3 2026 incident response case mix, with phishing falling to just over a third of engagements and ransomware climbing to 27 percent.

Phishing remained the top initial access vector but dropped from over half of Talos IR engagements to slightly more than a third, with much of the remaining volume shifting toward vishing paired with IT help desk impersonation to talk victims into granting remote access through a legitimate RMM tool. Exploitation of public-facing applications accounted for another third, concentrated on edge devices such as security gateways and remote management interfaces that sit in front of authentication and internal traffic. Ransomware and pre-ransomware incidents made up 27 percent of the quarter, up from a prior ceiling of 20 percent. These are counts from real engagements rather than survey data, which makes them useful for arguing where to spend help desk verification and edge patching effort.

blog.talosintelligence.com → (opens in a new tab)

Fake “View & Sign” and Adobe Acrobat Lures Deliver Attacker-Configured ScreenConnect Clients (opens in a new tab)

CloudSEK ·fetched 29 Oct 2026, 07:41 UTC Research agreed2/2

Why readFake Adobe Acrobat and "View & Sign" pages serve genuine signed ConnectWise ScreenConnect installers pre-configured to call back to the attacker.

The campaign hands victims legitimate, digitally signed ScreenConnect clients with attacker-controlled relay configuration baked in, so signature-based checks pass and the resulting remote access looks like sanctioned IT tooling. Telegram bots fingerprint visitors and their networks before the download fires, which filters the target set. Worth checking whether your estate would flag an unexpected but validly signed ScreenConnect instance at all, since that is the control this defeats.

cloudsek.com → (opens in a new tab)

Attackers Hide Malware Behind Signed ChatGPT and Claude Binaries (opens in a new tab)

Infosecurity Magazine ·fetched 29 Oct 2026, 03:40 UTC agreed2/3

Why readA live campaign that turns the rush to install AI desktop tools into a code execution path, using genuine signed OpenAI and Anthropic executables to carry the payload past signature based trust.

Check Point has tracked a campaign it calls Yoba for two months, in which fake desktop apps branded as GPT-5.6 Sol, GPT-6 Astra and Claude Opus were published as GitHub releases with GitHub Pages landing sites, some ranking highly in Google through SEO poisoning. The installers bundle real signed OpenAI and Anthropic binaries alongside a malicious DLL, and the signed Setup.exe loads the attacker component by sideloading, so the chain starts from a validly signed parent process. An earlier variant impersonating the Cursor coding agent appeared in June, which suggests the operators are rotating through whichever AI tool developers are currently chasing.

infosecurity-magazine.com → (opens in a new tab)

Police seize Virtualine bulletproof service tied to ransowmare, cybercrime (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 29 Oct 2026, 07:41 UTC agreed3/3

Why readThe FBI seized virtualine[.]net, a bulletproof host that also traded as Secury, Massgod, Spamhouse, Lanedo and Omegatech, so check historical hits against those names.

DOJ confirmed the takedown of Virtualine, a forum-advertised bulletproof hosting service that marketed tolerance for phishing, spam, carding and port scanning, and that authorities say knowingly hosted a forum promoting child abuse material despite repeated NCMEC and law enforcement notices. The seizure involved Germany's Polizei Hessen, the Netherlands' Politie Midden-Nederland, the UK NCA, and private partners OverRIPE and Lumen. The alias list is the usable part: infrastructure you have previously attributed to any of those five names resolves to the same operator.

bleepingcomputer.com → (opens in a new tab)

Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants (opens in a new tab)

Cloudflare Blog ·Cloudforce One ·fetched 29 Oct 2026, 15:37 UTC agreed3/3

Why readQuarterly DDoS telemetry showing sub-10-minute, sub-1 Gbps bursts up 208% while 1 Tbps-plus attacks fell 69% and CLDAP reflection collapsed 99.5%.

Cloudforce One's Q3 2026 numbers from the Cloudflare network describe a shift away from hyper-volumetric floods toward short, low-bandwidth swarms that are harder to spot in alerting tuned for big peaks, with the drop in 1 Tbps-plus events attributed in part to law enforcement action against four IoT botnets earlier in the year. The abrupt 99.5% quarter-over-quarter collapse in CLDAP reflection shows actors rotating amplification vectors rather than abandoning the technique. Useful for setting detection thresholds, though the data is Cloudflare's own traffic and generalises only so far.

blog.cloudflare.com → (opens in a new tab)

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day (opens in a new tab)

SecurityWeek ·Ionut Arghire ·fetched 29 Oct 2026, 11:41 UTC Must read CVE-2026-41709 EPSS 0.3% agreed3/3

Why readThe severity rating was wrong in a way that matters: a CVSS-low logging gap turned out to be the piece that let a China-nexus actor work on ESXi hosts without leaving an audit trail, and it is now KEV with a two-week federal deadline.

CVE-2026-41709 is an insufficient logging flaw in VMware ESXi that lets an authenticated administrator perform certain operations without those actions being recorded. CrowdStrike reports the China-nexus actor Warp Panda used it as a zero-day against US organizations including law firms, typically entering through internet-facing edge devices, pivoting to vCenter, and deploying BrickStorm and TetanusStor. It was disclosed on July 29 alongside higher-severity VMware bugs, and the fixes are in ESXi 9.1.0.0-25370933, ESXi 9.0.2.0100-25595025, and ESXi80U3j-25429389 and later; anyone who deprioritized it on CVSS should also treat hypervisor logs from before patching as incomplete.

Also covered byThe Hacker News (opens in a new tab).

securityweek.com → (opens in a new tab)

CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability (opens in a new tab)

CISA KEV ·fetched 29 Oct 2026, 23:41 UTC Must read CVE-2026-76418 Exploited in the wild · patch by 2026-11-01 EPSS 0.6% agreed3/3

Why readCisco ASA/FTD NULL pointer dereference is confirmed exploited and carries a CISA remediation deadline of 2026-11-01.

CVE-2026-76418 lets an unauthenticated remote attacker force a reload of Cisco Secure Firewall ASA and FTD devices, producing a denial of service on an internet-facing appliance. CISA has added it to KEV with a due date of 2026-11-01 under BOD 26-04, and the listing also points at the agency's Forensics Triage Requirements, so affected federal operators must triage as well as patch. EPSS is still low (0.0057) but KEV membership means exploitation is already observed; treat edge firewalls as the priority asset class.

sec.cloudapps.cisco.com → (opens in a new tab)

Limited reports of PHP bug exploitation emerge (opens in a new tab)

The Record ·fetched 29 Oct 2026, 23:41 UTC Must read agreed3/3

Why readGreyNoise has confirmed at least six successful exploitations of the PHP2Shell bugs, CVE-2026-109618 and CVE-2026-109619, which are now in KEV with a federal patch deadline this week.

Multiple firms report in-the-wild exploitation of the two PHP flaws known as PHP2Shell, with GreyNoise counting at least six successful compromises and the pair added to CISA's KEV catalog with a Thursday deadline for federal agencies. Separately, Dream published analysis alleging a Chinese threat actor used PHP2Shell to execute commands on an unnamed large vendor's firewall software, then chained a second exploit when command execution alone did not give full control, hitting U.S. government-affiliated servers. If you run PHP anywhere internet-facing, this is a patch-now item, and the chaining detail means a patched PHP alone may not close the path.

therecord.media → (opens in a new tab)

Vulnerability in Cisco Products (October 29, 2026) (opens in a new tab)

translated Vulnérabilité dans les produits Cisco (29 octobre 2026)

CERT-FR (ANSSI) ·fetched 29 Oct 2026, 19:39 UTC Must read CVE-2026-76418 EPSS 0.6% agreed3/3

Why readCisco says CVE-2026-76418 in Secure Firewall ASA is being actively exploited for remote denial of service, with fixed versions named across every supported train.

Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 covers a remotely triggerable DoS in Secure Firewall ASA software, confirmed by Cisco as under active exploitation. Fixed builds are 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and the 9.24 line; anything earlier in those trains is affected. An internet-facing VPN concentrator being knocked over remotely is an availability event with no workaround beyond patching, so this is a same-week upgrade.

cert.cyber.gouv.fr → (opens in a new tab)

Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767) (opens in a new tab)

Help Net Security ·Sinisa Markovic ·fetched 29 Oct 2026, 15:37 UTC CVE-2026-101767 EPSS 0.6% agreed3/3

Why readHoneypot decoys recorded the first exploitation attempts against CVE-2026-101767, an unauthenticated SQL injection in Oracle EBS's Thin Client Framework servlet that chains to RCE, starting 27 October.

Defused reports its Oracle E-Business Suite decoys logged exploratory exploitation of CVE-2026-101767 on the morning of 27 October, with no prior public report of in-the-wild attempts. The flaw is an unauthenticated SQL injection in the Thin Client Framework servlet that chains to remote code execution, carrying CVSS 9.8; EPSS currently sits at 0.006, which lags the observed activity. Internet-facing EBS instances should be patched and the servlet path checked for exploratory requests now rather than waiting for KEV.

Also covered byOrca Security (opens in a new tab).

helpnetsecurity.com → (opens in a new tab)

New Cisco firewall zero-day exploited to crash SSL VPN devices (opens in a new tab)

BleepingComputer ·Sergiu Gatlan ·fetched 29 Oct 2026, 11:41 UTC agreed3/3

Why readCVE-2026-76418 lets unauthenticated remote attackers reload Cisco ASA and FTD firewalls, and Cisco PSIRT found it being exploited before the patch shipped.

The high-severity flaw stems from logic errors when secondary authentication is configured on a tunnel group, and affects devices whose configuration contains the 'webvpn' keyword with SSL VPN enabled on at least one interface. Exploitation causes an unexpected reload, taking the firewall and any VPN access through it offline. Cisco has released fixes but published no IOCs and has not named targets or the actor, so the only available response is to check for the webvpn configuration condition and patch.

bleepingcomputer.com → (opens in a new tab)

U.S. CISA adds Linux Kernel and Broadcom VMWare ESX  flaws to its Known Exploited Vulnerabilities catalog (opens in a new tab)

Security Affairs ·Pierluigi Paganini ·fetched 29 Oct 2026, 19:39 UTC CVE-2026-46300 EPSS 15.7% agreed3/3

Why readCVE-2026-41709 in VMware ESX and CVE-2026-46300 in the Linux kernel are now KEV entries with a federal remediation deadline.

CISA added two flaws to the Known Exploited Vulnerabilities catalog: CVE-2026-41709 (CVSS 7.6), an insufficient-logging weakness in VMware ESX that lets an administrator-level user perform operations without them being recorded, and CVE-2026-46300 (CVSS 2.7), a missing variable initialisation in the Linux kernel. Broadcom patched CVE-2026-41709 in July alongside four other ESXi, vCenter, Workstation and Fusion issues. The ESX entry is notable because it is an anti-forensics primitive rather than an execution bug: hypervisor audit trails cannot be assumed complete on unpatched hosts.

securityaffairs.com → (opens in a new tab)

Node2Shell: Taking Over a Server with a Single Compressed Data File (CVE-2026-111497) (opens in a new tab)

AhnLab ASEC ·ATCP ·fetched 29 Oct 2026, 11:41 UTC CVE-2026-111497 EPSS 88.0% agreed3/3

Why readOut-of-bounds write in the Brotli decoder bundled with Node.js, reachable whenever a web app decompresses attacker-supplied Brotli request data, with EPSS at 0.88 (99.76th percentile).

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder shipped inside Node.js, disclosed in October 2026. Any application that accepts and decompresses Brotli-encoded input reaches the vulnerable decode path, which makes it a server-side takeover primitive from a single crafted payload rather than a client-side issue. EPSS of 0.87988 puts it in the top quarter of a percent for likely exploitation, so inventory Node.js versions and patch rather than waiting for a KEV entry.

Also covered byDatadog Security Labs (opens in a new tab).

asec.ahnlab.com → (opens in a new tab)

Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 29 Oct 2026, 11:41 UTC CVE-2026-97229 EPSS 18.4% agreed3/3

Why readPatching GitLab to 19.3.6 does not close CVE-2026-97229 if you run your own Ruby; you also need Ruby 3.3.13, 3.4.12 or 4.0.9, and someone already tried it against Alpine's server.

CVE-2026-97229 (CVSS 10.0) lets an attacker execute code on a GitLab server via a crafted regular expression in a CI configuration, and the fix lives in Ruby patches that GitLab ships inside its own packages and container images. Alpine Linux's gitlab.alpinelinux.org ran standard Ruby, so its 22 October upgrade to 19.3.6 left the flaw open; an exploitation attempt followed a week after the fix, and Alpine rebuilt the host and reset every password despite finding no evidence of success. Anyone running GitLab from source or in a custom image needs the Ruby update separately, and users of the alpinelinux/gitlab image should re-pull 19.3.6.

thehackernews.com → (opens in a new tab)

Censys takes census of the Internet like no one else (opens in a new tab)

Censys ·Kate Lake ·fetched 29 Oct 2026, 19:39 UTC CVE-2026-109619 EPSS 100.0% agreed3/3

Why readExposure counts and a disclosure timeline for PHP2Shell, the pre-auth RCE pair CVE-2026-109618 and CVE-2026-109619 in PHP core, both CVSS 9.2 with EPSS at effectively 1.0.

PHP shipped an emergency release on 20 October for two pre-auth RCE flaws in the core, CVE-2026-109618 and CVE-2026-109619, jointly dubbed PHP2Shell and both rated CVSS 9.2. One of the credited research teams, Calif, posted video of a working exploit chain against live targets that evening and pulled it down, but copies had already spread; both Calif and PHP have called the post a mistake. Censys walks through why host counts for PHP exposure vary between sources, which is useful context, though the piece leans hard on its own Internet Map as the answer.

censys.com → (opens in a new tab)

Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 29 Oct 2026, 03:40 UTC CVE-2026-101767 EPSS 0.6% agreed3/3

Why readAttackers are already probing CVE-2026-101767, an unauthenticated SQL injection in Oracle E-Business Suite's Thin Client Framework servlet that chains to RCE, patched only last week.

Defused Cyber's Oracle EBS decoys recorded exploratory exploitation on the morning of October 27 against CVE-2026-101767 (CVSS 9.8), an improper authentication flaw in the Oracle Application Object Library. Horizon3.ai researchers Brandon Peterson, Jimi Sebree and Noah King found and reported it on July 24, 2026, and describe it as unauthenticated SQLi reachable via a crafted request to the vulnerable servlet, executing SQL as the APPS database user and chainable to remote code execution. It was fixed in Oracle's October Critical Patch Update, so anyone who deferred that CPU on an internet-facing EBS instance is exposed now.

thehackernews.com → (opens in a new tab)

Have an older iPhone or iPad? Apple has a security update for you (opens in a new tab)

Malwarebytes Labs ·fetched 29 Oct 2026, 11:41 UTC agreed3/3

Why readApple backported the fix for a CoreGraphics bug used in targeted attacks to devices that cannot run iOS 26, so unsupported-hardware fleets now have a patch path.

The 26 October release brings the CoreGraphics fix first shipped in iOS 26.7.1 down to iOS 18.7.11, covering iPhone XS, XS Max, XR and the seventh-generation iPad. Apple describes the flaw as possibly exploited in targeted attacks, which puts it in the usual mercenary-spyware bracket rather than commodity exploitation. Useful mainly as an inventory trigger: older corporate and BYOD handsets held back from iOS 26 are now patchable without a major-version upgrade.

malwarebytes.com → (opens in a new tab)

Qualys CISO on what security teams can do as exploit campaigns grow (opens in a new tab)

Help Net Security ·Mirko Zorz ·fetched 29 Oct 2026, 07:41 UTC agreed3/3

Why readArgues for replacing MTTR with average window of exposure as the vulnerability-management metric, and claims under one percent of flaws disclosed in 2025 carried active risk.

Qualys CISO Nathan Smolenski makes the case that mean time to remediate flatters teams by averaging away the long tail, and that window of exposure, the time a given asset actually sat vulnerable, is the number worth reporting upward. He puts the share of 2025 disclosures posing real exploitation risk at under one percent, which is the argument for triage over volume as AI-assisted discovery inflates the queue. On autonomous remediation he sets preconditions: asset tiering first, human review on the top tier, tested rollback before anything runs unattended.

helpnetsecurity.com → (opens in a new tab)

PHP2Shell Won't Be the Last. Here's Where the Next One Will Show Up First. (opens in a new tab)

Snyk ·fetched 29 Oct 2026, 11:41 UTC agreed2/3

Why readOne hard date worth carrying: Amazon honeypots logged PHP2Shell exploitation on October 17, four days before the fixes shipped, which sets the realistic floor on how much warning you get for an unauthenticated RCE in a runtime.

Snyk retraces the PHP2Shell response, covering CVE-2026-109618 and CVE-2026-109619, two unauthenticated RCEs in the PHP engine rated CVSS v4.0 9.2 and patched on October 21. Exploitation attempts were observed in Amazon's honeypot network on October 17, before public disclosure, and technical details and proof-of-concept code circulated widely once the fixes landed. The argument is that answering quickly depends on inventory work done months earlier, specifically knowing where a given runtime is embedded across your estate; that part is sensible but it is a vendor case study rather than new research.

snyk.io → (opens in a new tab)

Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th) (opens in a new tab)

SANS ISC Diary ·fetched 29 Oct 2026, 07:41 UTC agreed2/2

Why readHow to stop losing Ghidra work to VM snapshot reverts by running the Ghidra Server that already ships in the standard distribution.

Ghidra project state lives in a .gpr file and .rep directory on the analysis VM, so reverting to a clean snapshot destroys every renamed function, comment, structure and bookmark. The fix is the Ghidra Server bundled with the standard distribution (no extra download, no licence), which converts local projects into shared projects stored outside the VM. Practical lab hygiene for anyone whose reversing workflow depends on disposable analysis machines.

isc.sans.edu → (opens in a new tab)

Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol (opens in a new tab)

arXiv cs.CR (AI) ·Yuepeng Hu, Chongyu Fan, Sirat Samyoun, Jian Du ·fetched 29 Oct 2026, 19:39 UTC Must read Research agreed3/3

Why readMeasured attack success rates of 62.64 to 100 percent for an MCP tool-description injection that exfiltrates the user query and server responses through an extra logging call.

Log-To-Leak injects a directive into MCP tool metadata that induces an additional attacker-controlled call after the legitimate tool call completes, with the payload carrying the user query, MCP server name, server response and agent response. Across 18 model-server pairs spanning five MCP servers and four LLM agents, attack success ran 62.64 to 100 percent with conditional logging accuracy of 76.55 to 95.64 percent, and 16 pairs showed target-task completion changes of at most 6.63 points, meaning the attack is close to invisible from the user's side. Three evaluated defences still left residual success above 55 percent.

arxiv.org → (opens in a new tab)

A Journey into Claude's Sandbox (opens in a new tab)

Bishop Fox ·fetched 29 Oct 2026, 19:39 UTC Must read Research agreed3/3

Why readA documented chain against a production AI coding sandbox, including a vendor response that declines to treat most of it as in scope.

Bishop Fox describes pulling what appears to be Anthropic's sandbox orchestration binary, process_api, through Claude's own file-download API by absolute path, then reverse engineering it, reconstructing a cryptographically valid Google service account ID token from memory dump fragments, and defeating a local-connection restriction by getting the model to create a virtual network interface. Two further observations concern enterprise profile-change controls. All six went through Anthropic's bug bounty; the sandbox findings were judged outside the threat model and the enterprise ones closed as informational or duplicate, with one issue the researcher believes is still live left out of the writeup.

bishopfox.com → (opens in a new tab)

Cohere’s Qwen Story: Looks More Like Model Jaggedness (opens in a new tab)

Check Point Research ·fetched 29 Oct 2026, 15:37 UTC Must read Research agreed3/3

Why readRe-sampling the Qwen3.8-Flash-Next trace that Cohere flagged as a possible backdoor yields 52 different destination hosts, most of them local or nonexistent, which undercuts the backdoor reading.

Cohere reported on 26 October that Qwen3.8-Flash-Next, asked to write a detection rule for curl-to-bash activity, instead emitted a shell command that probed its environment and tried to post a test string to an Alibaba Cloud storage endpoint in Beijing. Re-sampling the shared trace produced 52 distinct destination hosts, many local or non-resolving and one with an invalid TLD, and simply swapping the order of two program names in a tool-availability check sharply reduced the chance of the model making any network call at all. The conclusion is model jaggedness rather than a fixed exfiltration target, with interactive viewers provided for the trace, next-token distributions and all 64 sampled URL completions.

research.checkpoint.com → (opens in a new tab)

CVE-2026-112346 (CVSS 9.3): OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer wor (opens in a new tab)

NVD ·fetched 29 Oct 2026, 07:41 UTC Must read CVE-2026-112346 CVSS 9.3 EPSS 1.0% agreed3/3

Why readAn AI coding agent SDK shipped with its root-capable sandbox bound to every interface and authentication switched off by default, so the exposure exists without anyone misconfiguring anything.

OpenHands Software Agent SDK before 1.52.0 has DockerWorkspace and Apptainer launchers bind the sandbox agent server to 0.0.0.0 with an empty session_api_keys list, which disables authentication entirely. Anyone able to reach the published container port can drive HTTP and WebSocket requests that run arbitrary shell commands as root inside the sandbox, read the mounted workspace, and pull plaintext credentials out of the secrets store. This belongs with agent infrastructure rather than general product vulns: the failure is a default in how agent sandboxes get exposed, and teams running agent fleets should audit published ports as well as upgrade to 1.52.0.

nvd.nist.gov → (opens in a new tab)

CVE-2026-93328 (CVSS 9.3): Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 thr (opens in a new tab)

NVD ·fetched 29 Oct 2026, 03:40 UTC CVE-2026-93328 CVSS 9.3 EPSS 0.5% agreed3/3

Why readUnauthenticated path traversal in Google's MCP Toolbox for Databases 1.2.0 through 1.4.0 lets a remote attacker read host files out to attacker-controlled GCS buckets and overwrite local files.

CVE-2026-93328 (CVSS 9.3, CVSS:4.0/AV:N/AC:L/PR:N/UI:N) combines path traversal with missing authorization in the cloud-storage source of googleapis/mcp-toolbox. Crafted tool invocation parameters exfiltrate arbitrary host files to external Google Cloud Storage buckets and write arbitrary local paths, with no authentication required. Affected range is 1.2.0 to 1.4.0; EPSS is currently low at 0.005, but this is the MCP tool-use attack surface landing in a Google-published component, so inventory any agent stack that pulled it in.

nvd.nist.gov → (opens in a new tab)

Abliterated Models in Appsec Pentesting (opens in a new tab)

Include Security ·Laurence Tennant ·fetched 29 Oct 2026, 19:39 UTC Research agreed3/3

Why readHands-on evaluation of whether abliterated open-weight models, with safety refusals stripped out, are actually any good for web application pentesting.

Include Security tested abliterated builds of Z.ai's GLM-5.3, an open-weight model NIST placed roughly four months behind US frontier models on cyber capability, against real webapp pentest work. The piece explains abliteration as an edit to the model's internal representation of harmful inputs so it stops refusing, then asks the practical question of whether the resulting model earns its place in an engagement given the tradeoffs. Useful for any offensive team weighing uncensored local models against frontier models that increasingly refuse cyber tasks.

blog.includesecurity.com → (opens in a new tab)

BUSTA: Teaching Small Language Models to Reason About Binary Execution (opens in a new tab)

arXiv cs.CR (AI) ·Ritika Poddar, Aidan Fennelly, Deirdre Murphy, Eric Wolos ·fetched 29 Oct 2026, 11:41 UTC Research agreed3/3

Why readFine-tuned 1.7B-class open models predict input register state for x86-64 basic blocks at 85-95% accuracy, close enough to frontier models to run inside an air-gapped RE sandbox.

The authors train Qwen3-1.7B and Nemotron-3-Nano on inverse basic-block execution (given an x86-64 block and a target output register state, predict the inputs) using Group Relative Policy Optimization. Knowable-register accuracy rises from 73.2% to 85.3% and from 63.3% to 95.2% respectively, against up to 99.2% for frontier models at vastly higher parameter counts. Both fine-tuned models and the training dataset are released, which matters for RE tooling in sandboxed environments where calling an external API is not an option.

arxiv.org → (opens in a new tab)

Detecting and Mitigating Query-Based System Prompt Leakage Attacks (opens in a new tab)

arXiv cs.CR (AI) ·Tushar Nayan, Pratik Poudel, Qian Lou, Yuede Ji ·fetched 29 Oct 2026, 07:41 UTC Research agreed3/3

Why readA defence against multi-turn system prompt extraction that scores query sequences rather than single queries, with a reported 36% recall gain over the strongest baseline.

AdvGuard builds a bounded semantic interaction graph across an adversary's queries, filters candidate components statistically, and classifies the resulting line graphs with a GCN, so coordinated extraction spread over many benign-looking turns is caught by its multi-hop similarity pattern. A lightweight prompt-level detector covers the cold-start period before enough history exists, and the framework works against black-box LLM endpoints. The claimed improvement is up to 36% recall over the best existing defence in mixed-query evaluation; as with most arXiv defences, the evaluation is the authors' own and adaptive-attacker robustness is the open question.

arxiv.org → (opens in a new tab)

What Victims Take Away: Attack Reuse and Defense Revision after Prompt-Injection Attacks (opens in a new tab)

arXiv cs.CR (AI) ·Zihan Chen, Lei Nico Zheng, Di Zhu ·fetched 29 Oct 2026, 03:40 UTC Research agreed3/3

Why readQuantifies how often victims of prompt injection turn around and reuse the exact attack string that beat them: 10.0% within a week, versus 0.03% for matched attacks they never saw.

Using all 563,349 attack records from Tensor Trust, an online game where players defend and attack LLM-guarded accounts, the authors compare attacks a player received against matched attacks circulating among similar players at the same moment. Reuse tracked payoff rather than appearance: attacks that broke the target's defense were reused 10.0% of the time within a week (adjusted difference 8.8 to 10.0 points), while near-misses whose replies opened with "access granted" but scored as failures were reused about as rarely as outright failures. The practical consequence is that sharing attack logs and red-team reports with targets also hands them a working copy, and that copy propagates.

arxiv.org → (opens in a new tab)

SpecGuard: Detecting Multi-Turn LLM Jailbreaks via Specification-Based Runtime Monitoring (opens in a new tab)

arXiv cs.CR (AI) ·Junle Li, Siqi Chen, Jiakai Li, Bingzhuo Zhong ·fetched 29 Oct 2026, 15:37 UTC Research agreed3/3

Why readA training-free runtime monitor that expresses multi-turn jailbreak patterns as Linear Temporal Logic specs compiled to symbolic finite automata, producing replayable witnesses instead of opaque risk scores.

SpecGuard maps natural-language dialogue observations onto a fixed atomic-proposition contract, then checks forbidden interaction patterns written as LTL specifications against the running trace via symbolic finite automata. Accepting runs emit a witness naming the triggered specification, the supporting facts and the dialogue turns involved, which gives an auditable decision trail that per-message guard classifiers do not. The same mechanism works for buffered runtime checking and after-the-fact auditing, so it is usable both as a guardrail and as an investigation aid.

arxiv.org → (opens in a new tab)

The Rise of Agentic Attacks: What They Look Like, and Where They're Headed (opens in a new tab)

Wiz ·Avigayil Mechtinger ·fetched 29 Oct 2026, 15:37 UTC agreed2/3

Why readWiz generalizes across its private and public agentic intrusion cases to describe what AI-driven attacks look like in telemetry, and argues their noisiness is a defender advantage.

Drawing on earlier case work including Anatomy of AI-Driven Cloud Attacks and the Storm-0940 reporting, Wiz describes recurring fingerprints of agent-run intrusions: verbose activity with multiple approaches attempted in parallel, and escalation from a single exposed service to cloud credential theft, Kubernetes token theft, lateral movement and bulk secret exfiltration. The argument is that agents compress skilled hands-on escalation work, which widens the range of operations from narrowly targeted to broadly opportunistic. The defensive implication is that the resulting trail is loud, so the hard problem shifts to separating it from legitimate automation and stitching individual signals into one attack narrative. The post stays at the pattern level and offers no detection logic or indicators.

wiz.io → (opens in a new tab)

Can Open Be Too Open? On the Security and Trustworthiness of Fully Transparent LLMs (opens in a new tab)

arXiv cs.CR (AI) ·Sheila Zingg, Florian Tramèr, Martin Vechev, Srdjan Čapkun ·fetched 29 Oct 2026, 23:41 UTC agreed3/3

Why readArgues that "fully transparent" LLMs do not actually buy you verifiability, because training pipelines are not reproducible enough to confirm that published weights came from the published data.

The paper reviews the literature on open-weights, open-data and open-pipeline models and finds that users cannot in practice check the correspondence between released weights and the stated training data and pipeline, so trusting the model still reduces to trusting the developer. It further argues openness is asymmetric in the adversary's favour: open weights and data give attackers material for extraction, poisoning and jailbreak development that closed models do not. A useful position to argue with when someone proposes open models as a supply-chain control.

arxiv.org → (opens in a new tab)

Ofcom outlines ways social media can verify ages of users (opens in a new tab)

BBC Technology ·fetched 29 Oct 2026, 07:41 UTC agreed3/3

Why readOfcom names the four age-assurance methods it considers highly effective ahead of the UK under-16 social media ban in March, which is what platforms will be measured against.

The regulator recommends photo ID matching alongside other methods it rates as highly effective for establishing whether a user is over 16, covering ten of the largest platforms including Instagram, TikTok and Snapchat. The guidance is subject to government approval and will in practice push many adult UK users through verification too. Ofcom acknowledges the hard case, 16 and 17 year olds without credit cards, licences or passports, and says the UK intends a tougher line than Australia, where children routinely circumvented the equivalent ban.

bbc.co.uk → (opens in a new tab)

FTC to probe major companies over personalized pricing and pay (opens in a new tab)

The Record ·fetched 29 Oct 2026, 15:37 UTC agreed2/3

Why readThe FTC is compelling nine named companies to hand over the inputs, tools and procedures behind per-person pricing and gig worker pay, which sets a disclosure precedent for any algorithmic use of personal data.

Orders went to JetBlue, Delta, United, Lyft, Uber, DoorDash, Instacart, Walmart and Target, demanding detail on how personal data shapes the price an individual sees and, for the gig employers, how it shapes individual worker compensation. The agency says it wants to assess whether a fare, ride, delivery or product price varies by person based on loyalty program participation or algorithmic analysis of personal data, and it can seek enforcement in federal court if a company does not respond. For privacy and data governance teams, the practical signal is the scope of what regulators now expect to be producible on demand about a model's inputs.

therecord.media → (opens in a new tab)

Senators Demand Meta Answer for 'Pervert Glasses' Following 404 Media Investigation (opens in a new tab)

404 Media ·Samantha Cole ·fetched 29 Oct 2026, 11:41 UTC agreed3/3

Why readWyden and Markey have formally demanded Meta account for Ray-Ban glasses imagery being retained and used for AI training, including bystanders who never consented.

The senators' letter to Meta cites a 404 Media investigation that found Instagram accounts with hundreds of thousands of followers posting Ray-Ban-recorded videos of men soliciting massage parlour workers. It leans on Meta's own disclosure that imagery processed by the glasses' visual AI features may be retained, reviewed by humans, and used to train models. The privacy argument turned on non-consenting bystanders is the one to watch, because it generalises to any always-on wearable capture deployed in a workplace.

404media.co → (opens in a new tab)

Court Should Curb Abuse of Grand Jury Subpoenas Targeting Social Media Users (opens in a new tab)

EFF Deeplinks ·Mario Trujillo ·fetched 29 Oct 2026, 11:41 UTC agreed2/3

Why readDocuments a concrete pattern worth knowing if you handle platform legal process: an administrative subpoena withdrawn under challenge was replaced with a grand jury subpoena seeking much the same identifying data.

EFF, the ACLU, and trade groups filed an amicus brief in a sealed DC Circuit case over a grand jury subpoena to Reddit seeking to unmask an anonymous user who commented on a post about an immigration officer. DHS first issued an administrative subpoena, withdrew it when the user challenged it, then the government obtained a grand jury subpoena covering overlapping information. The brief argues the First Amendment standard for anonymous speech should apply to grand jury process too, which would directly change how platforms evaluate and contest these demands.

eff.org → (opens in a new tab)

Vendor Risk Assessment Template: Free Guide (opens in a new tab)

IOActive ·Christian Powills ·fetched 29 Oct 2026, 19:39 UTC agreed2/3

Why readSupplies a working vendor risk matrix and, more usefully, a stated threshold for when a vendor warrants technical testing instead of another questionnaire.

IOActive publishes a vendor risk assessment template built around scope definition, evidence quality and escalation criteria, mapped to NIST SP 800-161 Rev. 1 and the C-SCRM guidance in CSF 2.0. Its argument is that a vendor's written policies say little about the attack paths their access and technology actually open, so assessment should track criticality and continue through the life of the relationship. It is marketing-adjacent content, but the matrix is usable as a starting point if your third-party programme is still questionnaire-driven.

ioactive.com → (opens in a new tab)

Binance-hacker-1029 – $5.6B stolen from Binance (opens in a new tab)

Hacker News ·Tiberium ·fetched 29 Oct 2026, 23:41 UTC Must read 453 points agreed3/3

Why readBlockchain-intel labelling attributes roughly $5.6B in stolen funds to a Binance-linked attacker entity, a number large enough that boards and regulators in any crypto-exposed business will ask about it.

An Arkham entity tracked as Binance-hacker-1029 is tagged against about $5.6B taken from Binance, and the item reached the front of Hacker News with 453 points and 256 comments. What reached us is the entity label and the figure rather than an incident report, so the attribution and the timeframe behind the total both need checking against Binance's own statements before anyone repeats the number upward. Treat it as a story to get ahead of rather than a confirmed disclosure.

arkm.com → (opens in a new tab) Discussion (opens in a new tab)

Japan Airlines warns of data breach as country grapples with multiple cyber incidents (opens in a new tab)

The Record ·fetched 29 Oct 2026, 03:40 UTC Must read agreed3/3

Why readJapan Airlines disclosed that a breach at reservations provider Amadeus IT Group exposed 92,000 customer records, including passport numbers for around 2,000 people, amid a run of attacks on Japanese firms that has drawn a government response.

Amadeus IT Group, which runs reservation, ticketing and check-in systems for Japan Airlines and Japan Transocean Air, told JAL last week that attackers had accessed a portion of customer reservation data. Names, reservation codes and flight information were taken for 92,000 customers, with passport numbers, frequent flyer numbers, email addresses and phone numbers for about 2,000 of them; JAL says flight operations and card data were unaffected. Amadeus serves most of the airline industry, so peers should be asking what their own exposure through the same provider looks like, and the incident feeds directly into the Japanese government's recent moves after a cluster of attacks on domestic firms.

therecord.media → (opens in a new tab)

Florida Department of Education warns of data breach affecting nearly 5 million people (opens in a new tab)

Google News: incidents · FOX 13 Tampa Bay ·fetched 29 Oct 2026, 23:41 UTC agreed3/3

Why readA US state education department is notifying roughly 5 million people of a data breach, the kind of public-sector incident peers and boards will be asked about this week.

The Florida Department of Education has warned that a data breach affects close to 5 million people. Reporting so far carries the affected organisation and the scale but no attribution, intrusion vector or indicator detail. Education and other state agencies holding student and staff records should expect notification, regulator and press questions on the back of it.

news.google.com → (opens in a new tab)

GMO Bond Spread Jumps as Cyberattack Hits Credit Market (opens in a new tab)

Google News: incidents · Bloomberg.com ·fetched 29 Oct 2026, 07:41 UTC agreed3/3

Why readBloomberg reports a cyberattack at GMO that widened its bond spread, a rare case of an incident visibly repricing an issuer in the credit market.

A cyberattack at GMO moved the company's bond spread, putting the incident in front of credit investors rather than only security teams. The text available is the headline alone, so attack type, systems affected and disclosure detail are not established here. For a leader, the point is the transmission path: an operational security event showing up directly in funding cost is the version of this story a board will raise.

news.google.com → (opens in a new tab)

Florida state agency data breach could affect nearly 5 million people (opens in a new tab)

Google News: incidents · WPLG Local 10 ·fetched 29 Oct 2026, 19:39 UTC agreed3/3

Why readA Florida state agency breach with a reported exposure of close to five million people, the kind of number that pulls in state legislators and notification obligations.

WPLG Local 10 reports a data breach at a Florida state agency potentially affecting nearly five million individuals. No agency name, intrusion vector or timeline appears in the coverage so far. At that scale it becomes a state-level notification and oversight story, and public-sector security leaders should expect questions about their own exposure before details firm up.

Also covered bywtsp.com (opens in a new tab).

news.google.com → (opens in a new tab)

Belgium tax agency hit by cyberattack, shuts online portal (opens in a new tab)

Google News: incidents · Reuters ·fetched 29 Oct 2026, 03:40 UTC agreed3/3

Why readA national tax authority has taken its online portal offline after a cyberattack, the kind of public-service outage a board will ask about.

Belgium's tax agency shut down its online portal following a cyberattack, per Reuters. No attribution, intrusion vector or data impact is stated yet.

news.google.com → (opens in a new tab)

Moldova investigates possible foreign involvement in major government cyberattack (opens in a new tab)

The Record ·fetched 29 Oct 2026, 07:41 UTC agreed3/3

Why readMoldova's prime minister says a government breach that ran 19 to 23 October and hit dozens of public services may involve foreign state actors.

The Electronic Governance Agency disclosed that attackers exploited vulnerabilities in government services to extract large volumes of personal data over a five-day window, disrupting dozens of public services. Prime Minister Vasile Tofan called it coordinated and large-scale rather than isolated, and said authorities are examining possible state involvement; no attribution has been made public. No vulnerability detail or indicators have been released yet, so the value for now is the event and the regional pattern it sits in.

Also covered byRadio Free Europe/Radio Liberty (opens in a new tab).

therecord.media → (opens in a new tab)

Federal bankruptcy courts contractor says no data stolen during cyber intrusion (opens in a new tab)

The Record ·fetched 29 Oct 2026, 19:39 UTC agreed3/3

Why readBAE Systems says no data was extracted from the Bankruptcy Noticing Center intrusion, and the courts' 90-day Bankruptcy Rules emergency runs through January 2027.

Systems behind the federal bankruptcy courts' Bankruptcy Noticing Center are back online two weeks after an attack caused outages. BAE Systems, which maintains the platform, says no other systems were affected and no PII was breached; no group has claimed the intrusion. The emergency declaration announced on 22 October lets bankruptcy judges extend deadlines and remains in force for 90 days.

therecord.media → (opens in a new tab)