Saturday, 31 October 2026

Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer (opens in a new tab)

Cisco Talos ·Ryan Fetterman ·fetched 31 Oct 2026, 15:42 UTC Must read Research agreed3/3

Why readFirst solid documentation of malware using an LLM as an analyst rather than a code generator, including a model failover chain built specifically to route around refusals.

Talos details VOLTA-AUTODOXER, a self-deleting Windows infostealer that harvests the usual browser credentials, cookies, cards, sessions and wallets, then ships a structured evidence bundle to an LLM to rank the victim's assets by monetisation value. When a model declines the profiling request, the implant falls through a chain of three models, which tells you the operators hit guardrails during development and engineered around them. The sample also runs without attacker-owned infrastructure, so the usual C2 indicators are not where defenders should look.

blog.talosintelligence.com → (opens in a new tab)

Inside a malicious Claude Code-branded extension and its persistent SSH backdoor (opens in a new tab)

Microsoft Security ·Microsoft Security Research ·fetched 31 Oct 2026, 03:39 UTC Must read Research agreed3/3

Why readFull breakdown of the backdoored anthropic.claude-code extension versions 2.1.313 and 2.1.312, including the reverse SSH tunnel persistence, IOCs and hunting queries.

A tampered copy of the Claude Code extension was served from the Cursor marketplace on 29 October 2026 for roughly eleven hours (02:27 to 13:35 PDT), affecting versions 2.1.313 and 2.1.312; the Microsoft Visual Studio Marketplace and the npm package were not affected. The payload performs host reconnaissance, writes attacker SSH authorized keys and establishes reverse SSH forwarding (ATT&CK T1572) with platform-specific startup persistence. The post ships indicators, advanced hunting queries and a remediation path covering key rotation and tunnel identity cleanup, which is what anyone running Cursor in that window needs today.

Also covered byThe Register Security (opens in a new tab),WIRED Security (opens in a new tab),Dark Reading (opens in a new tab),oss-security (opens in a new tab).

microsoft.com → (opens in a new tab)

Chinese Actor Compromises US Government Network Via Chained PHP2Shell Exploit (opens in a new tab)

Infosecurity Magazine ·fetched 31 Oct 2026, 07:37 UTC Must read agreed3/3

Why readA suspected Chinese state actor chained the PHP2Shell exploit with a Linux kernel privilege-escalation bug to root 25 Palo Alto firewall and management servers, ending with persistent access to a US government Active Directory domain.

Investigation by Dream traces the campaign across the United States, Japan, Taiwan and South Korea, with concentrated effort on three servers in a US government-affiliated environment. Compromising management servers rather than just the firewalls themselves gives the operator a trusted path into internal infrastructure, which is how the AD domain access followed. Targeting confined to four states regarded as primary intelligence priorities is the main attribution signal offered.

infosecurity-magazine.com → (opens in a new tab)

Trezor warns of suspected crypto-theft implant in hardware wallet (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 31 Oct 2026, 07:37 UTC agreed3/3

Why readA hardware wallet bought through a named reseller allegedly contained an extra board with a cellular radio positioned to read the recovery phrase off the screen.

An Indonesian buyer who purchased a Trezor Safe 5 from reseller CryptoBilis via Tokopedia in August 2026 reports finding an additional circuit board sandwiched between the mainboard and the display, carrying a cellular module and antenna. On the unconfirmed description, the implant could read screen contents including the seed phrase and exfiltrate over the mobile network, defeating the air gap the device exists to provide. Trezor has not yet received the unit and the finding is unverified, but it has told potentially affected buyers to migrate keys and assets now, and the case is a concrete argument for buying security hardware only through first party channels.

bleepingcomputer.com → (opens in a new tab)

Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see (opens in a new tab)

The Register Security ·fetched 31 Oct 2026, 03:39 UTC agreed3/3

Why readThe n0n ransomware operator left its own server exposed, and SOCRadar's look inside found every single intrusion across 23 organisations began with weak or stolen credentials, not an exploit.

The operator targeted 23 organisations across 14 countries, spending over $7,000 on AI services to assist development while relying on entirely conventional access. In some cases it stole and encrypted files and also deleted data and backups to remove any recovery path. The finding that no vulnerability was exploited in any documented compromise is a useful corrective to the AI-finds-exploits narrative, and an argument for where credential hardening budget goes.

theregister.com → (opens in a new tab)

Fake PDF and search tools hijacked searches for 13.4 million Chrome users (opens in a new tab)

Malwarebytes Labs ·fetched 31 Oct 2026, 03:39 UTC agreed2/3

Why readNames both the scale and the distribution trick of a decade long search hijacking operation: 319 Chrome extensions, roughly 13.4 million installs, queries proxied through operator servers.

Socket researcher John Tuckner identified 319 extensions sold as manual finders, PDF converters, safe search and AI search tools that changed the default search engine and routed queries through infrastructure the operators controlled before passing them to Yahoo or Bing, capturing the queries and collecting referral payments. Most listings were unlisted in the Chrome Web Store, reachable by direct link from an ad landing page but invisible to anyone browsing the store, which is the part defenders should note when writing extension policy. This is Malwarebytes reporting Socket's findings rather than adding independent telemetry.

malwarebytes.com → (opens in a new tab)

Planning for Russia’s escalating hybrid war (opens in a new tab)

Intel 471 ·fetched 31 Oct 2026, 15:42 UTC agreed2/3

Why readSignposts for when Russian hybrid activity against Europe escalates further, framed for briefing upward rather than for the SOC queue.

Intel 471's geopolitical team reads Q3 2026 as a continued shift in Russia's European campaign from influence operations toward sabotage, drone incursions and destructive cyber operations, aimed at interrupting military and energy support to Ukraine. The analysis sets that against thinned European energy reserves heading into winter and rising defence spending, and checks three of the team's 2026 predictions against what actually happened. Useful for scenario planning if you run infrastructure, logistics or energy operations in Europe; light on technical detail or indicators.

intel471.com → (opens in a new tab)

September 2026 Threat Trend Report on APT Attacks (South Korea) (opens in a new tab)

AhnLab ASEC ·ATCP ·fetched 31 Oct 2026, 23:38 UTC agreed3/3

Why readAhnLab's own telemetry on APT activity against Korean targets during September 2026, broken down by distribution method and execution type.

The monthly report classifies APT attacks against Korean entities observed through AhnLab's infrastructure in September 2026, with statistics and functional characteristics for each attack type. The value is the distribution-method and execution-type breakdown, which is first-party visibility few others have into DPRK-adjacent targeting of the peninsula. The feed text is a stub, so the substance sits behind the link rather than in the summary.

asec.ahnlab.com → (opens in a new tab)

Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 31 Oct 2026, 15:42 UTC Must read CVE-2026-111357 EPSS 0.5% agreed3/3

Why readCISA added CVE-2026-111357 and CVE-2026-118527 in Ivanti Connect Secure to KEV, completing the three-bug chain UTA0576 is using with CVE-2026-104935 to reach unauthenticated root.

CVE-2026-111357 (CVSS 8.8) is a missing authentication check allowing local privilege escalation, and CVE-2026-118527 (CVSS 4.3) lets a remote authenticated attacker write attacker-controlled files to a known path. Chained with the authentication bypass CVE-2026-104935 (CVSS 8.6, added to KEV on 13 October 2026), they give unauthenticated root on an internet-facing appliance; Volexity documented the chain in use by a previously undocumented actor tracked as UTA0576. KEV membership carries a federal remediation deadline, and the low individual CVSS on the file-write bug is exactly why it was overlooked.

thehackernews.com → (opens in a new tab)

U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog (opens in a new tab)

Security Affairs ·Pierluigi Paganini ·fetched 31 Oct 2026, 23:38 UTC Must read CVE-2026-118527 EPSS 0.5% agreed3/3

Why readCVE-2026-111357 and CVE-2026-118527 in Ivanti Connect Secure are now KEV-listed, putting a federal remediation deadline on an internet-facing VPN already under in-the-wild attack.

CISA added two Ivanti Connect Secure flaws to the KEV catalog: CVE-2026-111357 (CVSS 8.8), a missing authentication check allowing local privilege escalation, and CVE-2026-118527 (CVSS 4.3), a predictable identifier allowing an authenticated remote attacker to write malicious files to a known location. Volexity documented the pair in mid-October as part of a chain producing unauthenticated remote code execution on Connect Secure appliances. Neither CVSS score reflects the chained impact; the KEV listing does, and Ivanti has published upgrade instructions.

securityaffairs.com → (opens in a new tab)

Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 31 Oct 2026, 07:37 UTC Must read CVE-2026-118539 EPSS 0.2% agreed3/3

Why readDrupal Commerce Core versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13 carry a missing-authorization access bypass, rated highly critical and confirmed by Drupal as exploited in the wild.

CVE-2026-118539 stems from routes and entity fields in the Commerce module not being sufficiently protected, allowing an access bypass that Drupal says may financially impact the vendor running the store. Drupal confirmed active exploitation but published no detail on the campaign or scale, and the fix is to update to the current release. Anyone running Drupal Commerce on an internet-facing storefront should treat this as same-day work regardless of the low EPSS figure, which lags confirmed exploitation.

Also covered bySecurity Affairs (opens in a new tab).

thehackernews.com → (opens in a new tab)

Critical Linux kernel flaw allows remote root attacks on MPTCP servers (opens in a new tab)

BleepingComputer ·Lawrence Abrams ·fetched 31 Oct 2026, 03:39 UTC Must read agreed3/3

Why readCVE-2026-98432 is a 9.8 use-after-free in the Linux kernel's IPv4 TCP code with a working unauthenticated remote root exploit against MPTCP listeners.

The race condition sits in the kernel's IPv4 TCP networking path and affects kernels back to 4.4, which covers current Ubuntu, RHEL and Rocky Linux builds. Anthropic researchers built an exploit achieving remote root on servers with an MPTCP listener; the flaw also reaches ordinary TCP connections, though RCE has not been publicly demonstrated there. Inventory anything running MPTCP, then patch broadly, because the vulnerable code is not MPTCP-specific.

Also covered byThe Hacker News (opens in a new tab).

bleepingcomputer.com → (opens in a new tab)

Testing a PHP2Shell exploit in the era of AI-hallucinated PoCs (opens in a new tab)

Intel 471 ·fetched 31 Oct 2026, 07:37 UTC agreed3/3

Why readHands-on triage of PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) including which circulating proof-of-concept code is real and which is AI-hallucinated.

The two memory-safety flaws in the core PHP interpreter were disclosed Oct 21, exploitation attempts began several days before disclosure, and CISA has confirmed active exploitation in the wild; a prolific ransomware affiliate claims a working exploit. The piece tests circulating exploit code against the bugs and separates functioning PoCs from fabricated ones, which matters because PHP runs roughly 70% of websites and is embedded in appliances and NAS devices where patching lags. Useful both as patch prioritisation input and as a worked example of validating PoCs before trusting them.

intel471.com → (opens in a new tab)

New Android SMS of Death exploit can remotely crash unpatched phones (opens in a new tab)

BleepingComputer ·Lawrence Abrams ·fetched 31 Oct 2026, 23:38 UTC Research CVE-2026-58882 agreed3/3

Why readPublic PoC for a zero-click Android SMS crash, with the bug located in WapPushOverSms.decodeWapPdu and Android 12 and 13 left unpatched.

CVE-2026-58882, dubbed SMS of Death, lets an attacker interrupt cellular service or crash a handset with a crafted message, with no user interaction and no visible trace because Android processes the PDU before it reaches the inbox. Researcher Mark Blah traced it to improper validation of a header-length value in WapPushOverSms.decodeWapPdu and published both analysis and a working proof of concept. Google reportedly fixed it in the October 2026 updates for Android 14 through 17, though it does not appear in the October bulletin, and Android 12 and 13 devices did not receive the fix. Impact is denial of service, including disruption of in-progress emergency calls.

bleepingcomputer.com → (opens in a new tab)

CVE-2026-118633 (CVSS 9.2): A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a (opens in a new tab)

NVD ·fetched 31 Oct 2026, 15:42 UTC CVE-2026-118633 CVSS 9.2 EPSS 0.6% agreed3/3

Why readUnauthenticated remote code execution as root in all versions of Sophos UTM via the email proxy, on a product that is end-of-life and requires a manual patch.

A path traversal in Sophos UTM lets a remote unauthenticated attacker win a race condition, by sustaining repeated requests for a few minutes, and execute code as root when the email proxy runs with scanning enabled. Every version is affected and the product is end-of-life, so no automatic update will carry the fix: it has to be installed by hand. CVSS 9.2 and an internet-facing mail path make this the item on this list most likely to be weaponised, regardless of the currently low EPSS.

nvd.nist.gov → (opens in a new tab)

CVE-2026-98432: init_on_free=1 as an additional interim mitigation (opens in a new tab)

oss-security ·fetched 31 Oct 2026, 19:40 UTC CVE-2026-98432 EPSS 0.5% agreed3/3

Why readAdds a mitigation for the CVE-2026-98432 IPv4 TCP inet_opt use-after-free that the published vendor guidance leaves out, for hosts that cannot take the fixed kernel yet.

The circulated interim advice, including AlmaLinux's, is an nftables rule dropping inbound TCP carrying IPv4 options plus disabling MPTCP. This oss-security post argues the init_on_free=1 boot parameter belongs alongside those, since zeroing freed memory undercuts the reuse step the use-after-free depends on. It is defence in depth rather than a fix, and init_on_free carries a measurable performance cost, so weigh it per host class; the value is that it reaches configurations the filtering rule does not cover.

seclists.org → (opens in a new tab)

CVE-2026-118636: Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder (opens in a new tab)

oss-security ·fetched 31 Oct 2026, 11:38 UTC Research CVE-2026-118636 agreed3/3

Why readApache MINA 3.0.0 through 3.0.0-M2 calls ObjectInputStream.readObject() on frame bytes with no class filter, and the 3.0.0 branch is unsupported, so there is no patch to apply.

JavaNativeMessageDecoder in the MINA 3.0 codec module deserialises frame bytes through ObjectInputStream.readObject() without a class filter, opening gadget-chain RCE for any application that places it in front of an untrusted peer. CVSS 9.8, network reachable, no privileges or user interaction. The 3.0.0 branch was unsupported when the CVE was assigned, which makes this a remove-or-replace job rather than an upgrade.

seclists.org → (opens in a new tab)

Re: CVE-2026-102508: Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade (opens in a new tab)

oss-security ·fetched 31 Oct 2026, 03:39 UTC Research CVE-2026-102509 EPSS 0.4% agreed3/3

Why readThe reporter's own breakdown of CVE-2026-102508 and CVE-2026-102509 in Apache PLC4X: OPC UA secure channel integrity bypass, unverifiable server certificates and silent downgrade, with no fix available on the 0.13.x branch.

Two defects in the asymmetric receive path of the PLC4X OPC UA implementation, present in 0.9.0 through 0.13.1, break the guarantees of the secure channel: integrity can be bypassed, server certificates cannot be verified, and the channel silently downgrades. Because PLC4X is a client library, the threat model is a malicious or impersonated server, or an attacker on the network path, which is exactly the position an OT network segmentation failure hands someone. Both are fixed only in 1.0.0 with no backport to 0.13.x, so affected users face a major-version migration rather than a patch.

seclists.org → (opens in a new tab)

CVE-2026-114278 (CVSS 9.8): The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init (opens in a new tab)

NVD ·fetched 31 Oct 2026, 11:38 UTC CVE-2026-114278 CVSS 9.8 EPSS 0.9% agreed3/3

Why readUnauthenticated RCE in che-machine-exec, and the vulnerable configuration (authentication disabled) is the default.

The /exec/init and /exec/config JSON endpoints take the username and namespace fields and concatenate them straight into an `sh -c "echo "..." > ..."` invocation with no escaping, so `$(...)` or backticks in either field execute. With authentication off by default, any network-reachable attacker gets code execution inside the containers che-machine-exec is wired to. Anyone running Eclipse Che workspaces should confirm the service is not exposed beyond the cluster.

nvd.nist.gov → (opens in a new tab)

CVE-2026-116078 (CVSS 8.7): Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remot (opens in a new tab)

NVD ·fetched 31 Oct 2026, 11:38 UTC Research CVE-2026-116078 CVSS 8.7 EPSS 0.5% agreed3/3

Why readAny Phoenix or Plug route that reads a request body can be memory-exhausted by splitting the body into 1-byte HTTP/2 DATA frames, because bandit's :length option counts bytes rather than frames.

do_read_data/5 in lib/bandit/http2/stream.ex retains each DATA frame payload as its own list element until the read completes, so a one-byte-per-frame body costs a list cell plus a binary term per byte. Interleaving across up to 500 concurrent streams per connection sustains the growth; the reporter measured 100 streams holding 25 to 40 MiB of stream process memory for 5 MB sent. Affects bandit from 0.3.1 before 1.14.1, and any route behind Plug.Parsers is in scope.

nvd.nist.gov → (opens in a new tab)

DYNAS: A Dynamic Network Penetration Testing Framework Using Deep Hierarchical Reinforcement Learning (opens in a new tab)

arXiv cs.CR (all) ·Md. Rakibul Hassan, Majedul Islam, Md. Ashraful Alam, Muhammad Iqbal Hossain ·fetched 31 Oct 2026, 23:38 UTC Research agreed2/3

Why readAn automated pentest simulator that finally models a defender, including stateful IDS reactions, scan false positives and negatives, service outages and action timeouts, which is where most RL attack research quietly cheats.

DYNAS is a parameterised network attack simulator built to evaluate reinforcement learning agents under non stationary and defended conditions rather than the static, perfectly observable topologies common in this literature. The authors pair it with Pen DHRL, a recurrent manager and worker policy that picks persistent subgoals conditioned on IDS state, and report higher reward per step and more captured hosts than GNN, invariant and attention baselines, including when trained without IDS and evaluated with it. The environment design is the more durable contribution; the policy results are self reported against the authors' own baselines and should be read as such.

arxiv.org → (opens in a new tab)

Introducing the Cloudflare PHP Capture the Flag challenge (opens in a new tab)

Cloudflare Blog ·Dan Jones ·fetched 31 Oct 2026, 23:38 UTC agreed2/3

Why readCloudflare concedes that researcher submitted php2shell WAF bypasses have already forced managed rule changes, which matters if you treated those rules as adequate mitigation.

Cloudflare has opened a capture the flag inviting researchers to produce materially distinct, reproducible bypasses of its php2shell WAF protections, paid through its HackerOne programme. The October 30 update confirms the exercise has already produced new detections and changes to managed rules, documented in the WAF changelog. The practical takeaway for defenders is the admission itself: edge filtering for the PHP vulnerabilities was bypassable, so anyone who deferred patching on the strength of WAF coverage should revisit that decision and check the changelog for what shifted.

blog.cloudflare.com → (opens in a new tab)

NyxFoundation/nyxis: A Lean backend framework whose authorization safety is formally proven. The developer writes only a Cedar schema and policies; handlers are built on Supabase Auth and PostgreSQL. (opens in a new tab)

GitHub: new security tools ·NyxFoundation ·fetched 31 Oct 2026, 19:40 UTC Research ★ 313 agreed3/3

Why readA Lean 4 backend framework that machine-checks, on every build, that no HTTP request sequence lets a principal exceed its Cedar-declared permissions.

Nyxis has the developer write only a Cedar schema and policies, with handlers built on Supabase Auth and PostgreSQL, and emits a Lean proof that no sequence of requests allows an authenticated principal to read, modify, delete or grant beyond its permissions. The Lean kernel rechecks the property on every lake build, so authorization review collapses to reading the schema and confirming the proof. It is v0.1.9 and ASSUMPTIONS.md spells out what sits outside the trusted boundary, so treat it as an interesting approach to AI-written handler code rather than something to put in production now.

github.com → (opens in a new tab)

Deep Learning Based Behavioral Drift Modeling for Continuous Biometric Authentication (opens in a new tab)

arXiv cs.CR (all) ·Suprava Saha Dibya, Minar, Abdulla Al Noman, Md. Zafir Abid Shresto ·fetched 31 Oct 2026, 19:40 UTC Research agreed3/3

Why readTwo-stage keystroke biometric scheme hitting 3.77% EER on fixed-text login, with free-text drift monitoring that forces re-authentication on anomaly.

Level 1 does fixed-text password authentication with Temporal Convolutional Networks, contrastive learning and population-based training, reporting 3.77% equal error rate on the GREYC dataset. Level 2 then monitors free-text typing continuously with a four-model ensemble against the Buffalo dataset, falling back to Level 1 when behavioural drift suggests session hijacking. The drift modelling via PBT is the novel part; EER in that range is still too high to gate anything on its own, so treat it as a session-risk signal rather than an authenticator.

arxiv.org → (opens in a new tab)

Understanding Post-Quantum Cryptography Adoption: Practices, Challenges, and Evolution in Open-Source Software (opens in a new tab)

arXiv cs.CR (AI) ·Souhardya Saha Dip, Moshood A. Fakorede, Krishna Upadhyay, Umar Farooq ·fetched 31 Oct 2026, 07:37 UTC Research agreed3/3

Why readMining 114,361 commits across 179 repos shows what actually breaks when projects adopt post-quantum crypto: build, packaging and dependency failures plus functional defects are roughly half of all reported problems.

The study classifies PQC-related commits and issues across open-source repositories and finds 90% of commits are maintenance of existing support rather than new adoption, with an 11-category taxonomy of recurring technical challenges derived from issue discussions. Build, packaging and dependency failures together with functional defects account for about half of categorised issues. Time-series analysis around NIST standardisation milestones shows first implementations clustering after the 2024 finalisation, which gives teams planning their own migration a realistic picture of the friction ahead.

arxiv.org → (opens in a new tab)

Choosing a WAAP in 2026: 3 questions that separate the shortlist (opens in a new tab)

CSO Online ·fetched 31 Oct 2026, 03:39 UTC agreed2/3

Why readPoints at the AMTSO certified SecureIQLab Cloud WAAP v5.0 results, where 12 platforms ran 1,608 attack and 1,487 legitimate traffic scenarios and finished between 100% and roughly 61%.

The piece treats WAAP consolidation, putting WAF, API security, bot management, DDoS and client side script protection behind one service, as a settled category whose remaining question is evidence rather than features. Its argument is that security efficacy and false positive rate have to be read as a pair, and it cites the August 2026 SecureIQLab validation as the certified comparison now available to buyers. The procurement advice around it is generic, so the value is the pointer to the test data.

csoonline.com → (opens in a new tab)

YARA-X 1.22.1 Release, (Sat, Oct 31st) (opens in a new tab)

SANS ISC Diary ·fetched 31 Oct 2026, 11:38 UTC agreed2/3

Why readThe release note matters less than what it reveals: YARA 4.6.0 shipped without the 64-bit integer built-ins, so rule authors needing them have only one option.

YARA-X 1.22.1 is a two bugfix release. The accompanying YARA 4.6.0 release does not backport the int64, int64be, uint64 and uint64be helpers that YARA-X added, which Stevens reads as confirmation that YARA-X is now the maintained line. Detection engineers writing rules that parse 64-bit fields should plan migration rather than expect parity in classic YARA.

isc.sans.edu → (opens in a new tab)

RecHash: Segmented Hash-Entangled Chains for Stateful Sequential Authentication (opens in a new tab)

arXiv cs.CR (all) ·Luis Adrián Lizama-Pérez ·fetched 31 Oct 2026, 15:42 UTC Research agreed3/3

Why readA single-author preprint giving exact capacity arithmetic for segmented hash-chain authentication, useful if you are sizing a one-way-chain scheme and need the slot count and per-record overhead up front.

RecHash assigns each record to a predetermined segment of paired hash chains, with complementary positions encoding digest blocks, so every digest fits any scheduled slot regardless of what came before. The authors give a closed-form slot count of floor(L/(2^ceil(l/k)+1)) and work a concrete case: a 256-bit digest over 32 chain pairs at length 65535 yields 254 application records plus a renewal certificate, costing 2048 bytes of openings per record. It is an incremental extension of a 2019 construction rather than a new primitive, and the 2KB-per-message overhead limits it to settings where signature verification is genuinely unavailable.

arxiv.org → (opens in a new tab)

Wireshark 5.0.0rc1 Release, (Sat, Oct 31st) (opens in a new tab)

SANS ISC Diary ·fetched 31 Oct 2026, 23:38 UTC agreed2/3

Why readWireshark 5.0 is close enough that anyone maintaining custom dissectors, Lua plugins or shared profiles should start compatibility testing now.

A release candidate for Wireshark 5.0.0 has been published, signalling the first major version bump in some time. The diary itself is a two line announcement with no changelog analysis, so the value is purely the timing cue: pull the RC into a lab build and check that in house dissectors, capture filters and analyst profiles still load before the stable release lands in your package repos.

isc.sans.edu → (opens in a new tab)

A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 31 Oct 2026, 23:38 UTC Must read agreed3/3

Why readA shared ChatGPT link could execute attacker code in the victim's signed-in session and read their private conversations, triggered by opening the link alone.

Parameter found that a maliciously crafted ChatGPT public share link runs attacker-controlled code with the same privileges as the real ChatGPT origin once the victim opens it, originally needing one click on the Preview button and later firing automatically. The code enumerated recent conversations and opened private chats. Reported through OpenAI's bug bounty on 18 October, rated P1, and fixed eight days later, so the value now is the attack pattern: share links as a delivery channel into an authenticated AI session.

thehackernews.com → (opens in a new tab)

Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched (opens in a new tab)

The Register Security ·fetched 31 Oct 2026, 23:38 UTC Must read agreed3/3

Why readA shared bug class in the embedded browsers of Cursor, Copilot, Claude Desktop, VS Code and Codex allows host code execution, file theft and address-bar spoofing, with the OpenAI and Microsoft issues still unpatched.

Forever Security's 'Embrace' research shows five AI developer tools enriched their embedded browsers past the normal browser threat model, treating rendered page content as agent input, as the authority on a tab's own address, or as reach onto the host. Four flaws were disclosed to vendors; GitHub fixed Copilot independently, while the Codex and VS Code issues remain open for developers running affected configurations. The common root cause matters more than any single bug: embedded browsing surfaces in agentic IDEs inherit host privilege that a real browser would never grant.

theregister.com → (opens in a new tab)

“Black October” for AI Developer Platforms (opens in a new tab)

Wiz ·Rami McCarthy ·fetched 31 Oct 2026, 03:39 UTC Must read agreed3/3

Why readThe one place the month's nine separate AI platform incidents are treated as a single campaign rather than nine unrelated outages.

Wiz counts at least nine AI developer platforms disclosing security incidents during October 2026, among them Railway, Lightning AI, Fireworks, OpenCode, Warp and Zeabur. Several victims describe what they call agent swarm activity, and OpenCode and CommandCode attribute their incidents to attempted model distillation. Zeabur has published a full write-up and is shutting down over it; Railway has issued a preliminary timeline, while most other reports are still thin on technical detail.

wiz.io → (opens in a new tab)

Scan Before You Install: Detecting and Mitigating Local and Composite Vulnerabilities in Skills (opens in a new tab)

arXiv cs.CR (AI) ·Parth A. Gandhi, Avital Aviv, Prasanna N. Wudali, Yuval Elovici ·fetched 31 Oct 2026, 07:37 UTC Research agreed3/3

Why readA scanner for agent skills that catches unintended vulnerabilities and cross-skill composite risks, with 89.8% precision confirmed by analysts across 1,587 skills from the 75 most-starred GitHub repos.

Agent skills bundle natural-language instructions, scripts and reference files that an LLM agent loads with file system, shell and network access, and existing scanners only look for deliberately malicious ones in isolation. The six-module scanner adds local analysis for unintended weaknesses in benign skills and composite analysis for multi-skill interactions, reporting 95.90% recall at 4.22% false positives on a 556-case SkillTrustBench subset and F1 0.947 on 1,000 MalSkillBench skills, ahead of Cisco Skill Scanner, NVIDIA SkillSpector, AgentSkillsScanner and SkillSieve. Three analysts confirmed 53 of 59 findings across 23 real repositories, so the vulnerable-skill problem in public repos is measurable, not hypothetical.

arxiv.org → (opens in a new tab)

CVE-2026-119050 (CVSS 9.2): Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying (opens in a new tab)

NVD ·fetched 31 Oct 2026, 23:38 UTC CVE-2026-119050 CVSS 9.2 EPSS 0.4% agreed3/3

Why readPrompt injection reaches code execution in the Agno agent framework through 3.1.11 because PandasTools passes model-controlled names straight into getattr().

CVE-2026-119050 (CVSS 9.2) is an unsafe reflection bug in Agno's PandasTools: the model can name any pandas function and it is resolved via getattr() and called. An attacker who controls input to the agent can steer it to pandas.read_pickle against an attacker-hosted path for deserialisation code execution, or to other readers for local file disclosure. This is the concrete shape of the agent tool-surface problem, where the LLM's output is treated as a trusted function selector, and worth checking for in any homegrown tool wrapper as well as in Agno deployments.

nvd.nist.gov → (opens in a new tab)

CVE-2026-61546 (CVSS 8.8): AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21. (opens in a new tab)

NVD ·fetched 31 Oct 2026, 19:40 UTC CVE-2026-61546 CVSS 8.8 EPSS 0.2% agreed3/3

Why readA concrete worked example of the local MCP listener problem: a malicious web page reaching 127.0.0.1:3141 via DNS rebinding and calling tools/call with no credential.

AnkiMCP before 0.21.0 sets enable_dns_rebinding_protection=False in TransportSecuritySettings while defaulting http_enabled on 127.0.0.1:3141 at the root path, with no bearer token, session secret or Host and Origin allowlist enforced ahead of initialize, tools/list and tools/call. A victim browsing a hostile page while Anki runs lets the attacker enumerate tools, read the collection and perform enabled write operations, with no LAN position required. The pattern generalises to any locally bound MCP server shipping with FastMCP protections disabled, which makes it worth reading past the niche product.

nvd.nist.gov → (opens in a new tab)

Jailbreak Connectivity: Towards Diverse, Transferable, and Universal Multimodal Large Language Model Jailbreak (opens in a new tab)

arXiv cs.CR (AI) ·Xu Zhang, Ziqing Hu, Shuo Han, Ren Wang ·fetched 31 Oct 2026, 07:37 UTC Research agreed3/3

Why readVisual jailbreaks optimised as continuous adversarial paths rather than single images hit 84-98% ASR on Qwen3-VL-8B, InternVL3.5-8B and Gemma-3-12B, and transfer to GPT-5.6 and Gemini 3.1 Pro.

Jailbreak Connectivity exploits the observation that effective adversarial images sit in connected low-loss regions, so sampling along a path yields many distinct working jailbreaks instead of one brittle example. On MM-SafetyBench it reports average attack success of 84.01%, 85.77% and 97.95% against three open multimodal models, beating the strongest baseline by up to 68.36 points, and improves on FigStep by 24.69 and 27.34 points in black-box tests against GPT-5.6 and Gemini 3.1 Pro. The practical takeaway is that patching individual adversarial images is futile when the vulnerable region is continuous.

arxiv.org → (opens in a new tab)

Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims (opens in a new tab)

WIRED Security ·Lily Hay Newman, Matt Burgess ·fetched 31 Oct 2026, 19:40 UTC agreed3/3

Why readFirst solid documentation of a commodity infostealer calling commercial LLM APIs to triage its own victims and rank which stolen identities are worth working.

Cisco Talos researchers detail a strain they call Volta-Autodoxer, after the name the malware uses for itself, which bolts LLM-driven profiling onto the usual infostealer harvest of credentials, session cookies, tokens and card data. The addition shifts the economics: instead of dumping bulk logs for manual sifting, operators get automatic victim profiling that surfaces high-value targets straight away. Given that infostealer logs seeded the Snowflake-linked intrusions at AT&T and Ticketmaster and the Disney data theft, faster triage of stolen credential sets shortens the window defenders have between theft and exploitation.

wired.com → (opens in a new tab)

Systematic Evaluation of Adversarial Jailbreaking Attacks and Defenses Across Seven Large Language Models (opens in a new tab)

arXiv cs.CR (AI) ·Md. Robiul Islam Niloy, Abu Sayed Md. Mostafizur Rahaman ·fetched 31 Oct 2026, 07:37 UTC Research agreed3/3

Why readMeasured jailbreak success rates across seven open-weight and API models, with the finding that obfuscation attacks transfer everywhere and model size does not predict robustness.

Five attack families (direct requests, roleplay, hypothetical framing, instruction override, obfuscation) were run against Llama-3-8B, Llama-3.1-8B, Llama-3.2-3B, Mistral-7B, Qwen2.5-7B, Gemma2-9B and Phi-4-14B. Obfuscation reached a mean attack success rate of 54.3% and succeeded at nonzero rates against every model tested, while parameter count showed no significant correlation with robustness (Spearman r=-0.57, p=0.18) and models in the same architecture family diverged sharply. Four defences were evaluated against the two weakest models, which gives a usable baseline for anyone selecting a model or a filtering layer for a safety-sensitive deployment.

arxiv.org → (opens in a new tab)

CVE-2026-118683 (CVSS 8.6): MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a bundle's configs/logging.conf (opens in a new tab)

NVD ·fetched 31 Oct 2026, 15:42 UTC CVE-2026-118683 CVSS 8.6 EPSS 0.5% agreed3/3

Why readThe sink is the interesting part: a bundle's `configs/logging.conf` reaches `logging.config.fileConfig`, which evaluates the handler class and args fields.

MONAI from 1.2.0 up to 1.6.1 constructs a `ConfigWorkflow` by handing the bundle's logging configuration straight to Python's `fileConfig`, and that function `eval()`s the `class` and `args` entries. Publishing a malicious bundle is therefore enough to run arbitrary Python the moment a victim loads or runs it, before any model or inference code executes. The lesson generalizes: anywhere a pipeline parses an untrusted `logging.conf`, the same primitive exists, MONAI or not.

nvd.nist.gov → (opens in a new tab)

Judging Before Propagation: Task-Graph Contextual Integrity for Multi-Agent Privacy (opens in a new tab)

arXiv cs.CR (AI) ·Hengyu Wu, Blaise Delattre, Yang Cao ·fetched 31 Oct 2026, 07:37 UTC Research agreed3/3

Why readA formalization for deciding whether an inter-agent disclosure is appropriate given where that information will propagate downstream, not just whether the immediate recipient should see it.

Task-Graph Contextual Integrity models a multi-agent workflow as a Multi-Agent Task Graph and extends Contextual Integrity from atomic transfers to stateful, graph-level flows, judging a disclosure against both its intended propagation scope and the recipient's history. The stated gap is real: existing agentic CI mechanisms evaluate each release locally, so a transfer that is fine in isolation can become a leak once combined with prior disclosures or passed to downstream agents. Relevant to anyone designing guardrails for agent systems with persistent memory and inter-agent messaging.

arxiv.org → (opens in a new tab)

CVE-2026-118619 (CVSS 8.8): Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary (opens in a new tab)

NVD ·fetched 31 Oct 2026, 15:42 UTC CVE-2026-118619 CVSS 8.8 EPSS 0.5% agreed2/3

Why readUltralytics sits inside a great many computer vision pipelines, and this turns a remote asset fetch from Google Drive into code execution in the calling process.

ZDI reports that Ultralytics fails to validate a user-supplied path before using it in file operations while handling Google Drive downloads, so crafted content can write outside the intended location and execute code as the current process. Exploitation requires the victim to open attacker-supplied content, which in practice means a notebook, a training script, or a shared asset reference someone pasted in. Given the package's reach and its earlier supply-chain trouble, treat any pipeline that pulls weights or datasets from remote links as in scope.

nvd.nist.gov → (opens in a new tab)

British intelligence agency misplaced 'thousands' of storage devices, years later still can't say how many (opens in a new tab)

The Register Security ·fetched 31 Oct 2026, 19:40 UTC agreed3/3

Why readA signals intelligence agency cannot say how many removable drives holding surveillance material it has lost, and its own regulator has been raising this for several years without resolution.

The Investigatory Powers Commissioner's Office annual report states that GCHQ has lost a "very significant number" of removable storage devices that may hold Investigatory Powers Act material, and still has no clear account of the scale, location or recoverability. Lord Brian Leveson writes that the underlying issues were first flagged to him years ago and that the passage of time without a full account raises the need for sustained senior attention. For anyone building a media control or asset inventory argument internally, this is a well-documented example of the failure mode at the highest assurance tier.

theregister.com → (opens in a new tab)

Photo ID, bank checks, face scan? The UK’s age-check options (opens in a new tab)

Malwarebytes Labs ·fetched 31 Oct 2026, 07:37 UTC agreed3/3

Why readThe four age-assurance methods Ofcom deems highly effective ahead of the UK under-16 social media ban: photo ID matching, bank-held age data, facial age estimation and digital ID services.

Ofcom has set out the options platforms could use to verify that users are 16 or over, with Parliament and government still to decide how the ban operates. Each option pushes identity data into a new place: ID document matching creates a passport image trail, bank checks tie social accounts to financial identity, and facial estimation puts biometric inference in the path of ordinary use. Relevant to anyone who will have to build, procure or assure one of these flows for a UK-facing service.

malwarebytes.com → (opens in a new tab)

Hackers steal $6.3 billion from Binance in record crypto heist (opens in a new tab)

Ars Technica Security ·Nikou Asgari, Financial Times ·fetched 31 Oct 2026, 03:39 UTC Must read agreed3/3

Why readThe largest crypto theft on record, $6.3 billion from Binance, with withdrawals suspended and roughly $3.3 billion already moved into unfreezable assets.

Binance has halted all withdrawals after putting the estimated total impact of the intrusion at about $6.3 billion, of which around $3 billion, mostly stablecoins, has been frozen. Elliptic says the attacker converted roughly $3.3 billion into assets that cannot be frozen and is working to cash out into fiat. Any board with exchange counterparty exposure, custody arrangements or crypto treasury will ask about this before Monday.

Also covered byInfosecurity Magazine (opens in a new tab),TechCrunch Security (opens in a new tab),WIRED Security (opens in a new tab),Malwarebytes Labs (opens in a new tab),BBC Technology (opens in a new tab),StepSecurity (CI/CD) (opens in a new tab).

arstechnica.com → (opens in a new tab)

Northflank security breach leads to abuse of customers' AI API keys (opens in a new tab)

BleepingComputer ·Lawrence Abrams ·fetched 31 Oct 2026, 19:40 UTC agreed3/3

Why readNorthflank customers are told to assume every environment variable was decrypted and to rotate all keys, after AI API keys were abused.

Northflank disclosed a security incident on October 30 after a threat alert from Wiz, initially warning customers to rotate environment variables and API keys, then escalating to tell all customers to assume their environment variables had been decrypted. Stored secrets on the platform include database passwords, cloud credentials and auth tokens, and the observed abuse was of customers' AI API keys. If any team in your org deploys on Northflank, the rotation is immediate and the blast radius extends to whatever those secrets reached.

bleepingcomputer.com → (opens in a new tab)

Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 31 Oct 2026, 19:40 UTC agreed3/3

Why readChainalysis confirms an intruder reached internal tools and took customer user IDs, names, emails and org role labels, and attributes the access to 'offensive agentic techniques'.

Chainalysis disclosed that an external actor accessed internal systems this month and exfiltrated non-sensitive customer identity data: user IDs, full names, email addresses and organisation role labels for provisioned platform users. The company says investigation content, authentication credentials and session tokens were not reached, and that it is patching and hardening in response. The claim that agentic AI tooling drove the intrusion is notable but unsupported by any published detail, so treat it as the company's characterisation rather than a finding; the concrete exposure is a directory of named investigators at customer organisations.

Also covered byNewsCord (opens in a new tab).

thehackernews.com → (opens in a new tab)

Hackers steal and publish data on 41,000 Homeland Security workers (opens in a new tab)

Malwarebytes Labs ·fetched 31 Oct 2026, 19:40 UTC agreed3/3

Why readWork details and internal group memberships for more than 41,000 DHS employees were stolen and published.

Attackers published employment details and internal group membership data covering over 41,000 Department of Homeland Security workers. The exposure is less about credentials than about targeting: the group memberships map individuals to functions, which supports tailored phishing, harassment, stalking and physical threat. Any organisation holding comparable staff directory data should treat this as the worked example of why internal org structure is sensitive on its own.

Also covered byWIRED Security (opens in a new tab).

malwarebytes.com → (opens in a new tab)

GM cracks the petty cash box for multistate driver tracking settlement (opens in a new tab)

The Register Security ·fetched 31 Oct 2026, 07:37 UTC agreed3/3

Why readGM is paying $220 million to 36 attorneys general over selling driver telematics, including precise location, speed and seatbelt use, to brokers who fed it to insurers setting premiums.

The multistate settlement, announced by the Washington state AG, resolves allegations that GM collected and sold driving data without informed consent, more than two years after the New York Times reporting that surfaced the practice. The figure is under 7 percent of GM's $3.3 billion Q3 net income, which sets the going rate for consent failures at scale. Any business monetising device or vehicle telemetry now has a concrete number and a 36-jurisdiction coalition to point at when consent design is questioned internally.

theregister.com → (opens in a new tab)

Linode Security Incident (opens in a new tab)

Hacker News ·lacoolj ·fetched 31 Oct 2026, 07:37 UTC 179 points agreed3/3

Why readAkamai is deploying mitigations across the Linode Compute platform for an unnamed attack vector and is telling customers to apply upstream OS updates to their own workloads now.

The status-page notice says mitigations for a known underlying attack vector are being rolled out while impact analysis continues, with no evidence so far of exploitation on the Akamai Compute platform. The customer-facing action is explicit: patch guest operating systems from the upstream vendor as soon as updates land, which puts the work on tenants rather than the provider. Detail is deliberately thin, so the thing to track is the follow-up update; if you run production on Linode, this is the Monday question.

status.linode.com → (opens in a new tab) Discussion (opens in a new tab)

4 Canadian Firms Fall Prey to Industry-Wide Cyberattack (opens in a new tab)

Google News: incidents · Law.com ·fetched 31 Oct 2026, 15:42 UTC agreed3/3

Why readFour Canadian firms hit in what is being reported as an industry-wide attack, the kind of sector-level event peers in the same market will be asked about.

Law.com reports a coordinated cyberattack affecting four Canadian firms, framed as industry-wide rather than isolated. Only the headline reached us, so the firms, the sector specifics and the intrusion vector are not available here. Worth flagging for leaders with Canadian operations or counterparties pending fuller reporting.

news.google.com → (opens in a new tab)

Data Breach Hits Operator of South Texas Nuclear Power Plant (opens in a new tab)

Google News: incidents · GovTech ·fetched 31 Oct 2026, 03:39 UTC agreed3/3

Why readA breach at the operator of the South Texas Project nuclear plant, which will prompt questions about data held by critical-infrastructure operators.

GovTech reports a data breach at the operator of the South Texas nuclear power plant. The item as received is a headline only, with no scope, data types or timeline stated. Treat it as a flag to watch for the operator's own disclosure and any NRC or state notification that follows.

news.google.com → (opens in a new tab)

Data breach could affect all California students enrolled since 2023, state warns (opens in a new tab)

Google News: incidents · YourCentralValley.com ·fetched 31 Oct 2026, 07:37 UTC agreed2/3

Why readThe stated blast radius is every student enrolled in California since 2023, which makes this one of the largest education-sector notification events to date.

California officials are warning that a breach may have exposed records for all students enrolled in the state since 2023. The coverage so far is a state advisory rather than a technical disclosure, so the intrusion vector, the data classes involved and the responsible system are not yet established. The number worth carrying forward is the scope: a statewide student population across three enrollment years, which sets the scale of the notification and the credit-monitoring obligation that follows.

news.google.com → (opens in a new tab)

Assad regime hacker who caused $136 billion market drop sentenced to 42 months (opens in a new tab)

Help Net Security ·Sinisa Markovic ·fetched 31 Oct 2026, 07:37 UTC agreed3/3

Why readAhmad Umar Agha, the Syrian Electronic Army operator behind the hijacked AP Twitter account that briefly wiped $136 billion off US markets, got 42 months in the Eastern District of Virginia.

DOJ announced the sentencing of Agha, known as Th3Pr0, for his role in the hacking conspiracy run by Syrian Electronic Army figures aligned with the Assad regime. The case is best remembered for the fake White House explosion tweet that triggered a flash crash, the canonical example of account takeover as market manipulation. Closure on a long-running prosecution rather than anything new operationally.

helpnetsecurity.com → (opens in a new tab)

August 2026 Healthcare Data Breach Report (opens in a new tab)

Google News: incidents · The HIPAA Journal ·fetched 31 Oct 2026, 15:42 UTC agreed3/3

Why readThe monthly HIPAA breach tally for August 2026, which is the baseline number healthcare boards and their counsel ask about.

HIPAA Journal's recurring monthly report aggregates US healthcare breaches reported to OCR, covering incident counts, records exposed and the largest reporting entities. Only the headline reached us, so the specific figures and named organisations for August are not available here. Useful as sector trend context for healthcare security leaders, not as technical material.

news.google.com → (opens in a new tab)

Covenant Health agrees to $2M data breach settlement (opens in a new tab)

Google News: incidents · WGME ·fetched 31 Oct 2026, 23:38 UTC agreed3/3

Why readCovenant Health has agreed to a $2M settlement over its data breach, a useful reference point for healthcare boards pricing breach-litigation exposure.

Covenant Health settled the class action brought over its data breach for $2 million. The figure is the only substance reported here; there is no detail on class size, per-claimant payouts, or the remediation commitments usually attached to healthcare settlements. Useful mainly as a comparable when estimating post-breach legal cost in the provider sector.

news.google.com → (opens in a new tab)