Saturday, 7 November 2026

From Streaming to Stealing: Mirax and the Rise of Server-side Android Device Takeover in META (opens in a new tab)

Group-IB ·fetched 7 Nov 2026, 15:40 UTC Must read Research agreed3/3

Why readPrimary telemetry on Mirax, an Android banking RAT that moved device takeover logic server-side and abused Accessibility Services against retail banking customers across the META region.

Group-IB confirmed thousands of infected Android handsets belonging to retail banking customers between March and September 2026, with activity spikes over the Eid holidays and at the end of July. The campaign uses streaming app lures and dynamically generated overlays, drives takeover from server-side C2 rather than on-device logic, and abuses Accessibility Service permissions to act on the victim's behalf. Confirmed unauthorised international transfers to suspected mule accounts put reported losses in the millions of dollars, with real figures likely higher.

group-ib.com → (opens in a new tab)

CISA, FBI Urge Action to Protect Industrial Refrigeration Networks (opens in a new tab)

Infosecurity Magazine ·fetched 7 Nov 2026, 07:42 UTC agreed3/3

Why readFederal confirmation that industrial refrigeration and cold chain monitoring systems are being targeted globally, with attackers remotely altering temperature setpoints.

CISA, the FBI and partner agencies say they are aware of malicious cyber activity against internet-connected industrial refrigeration and cold chain monitoring systems, including attempts to change temperatures. The advisory follows the October 2026 compromise of systems administered by refrigeration vendor Danfoss, which forced supermarket chains in France and elsewhere to destroy stock. The practical takeaway for operators is that setpoint tampering is a destructive capability against food and medical inventory, and these controllers should not be reachable from the internet.

infosecurity-magazine.com → (opens in a new tab)

Infostealers In Banking Fraud: How Stolen Credentials Lead To Silent Intrusions (opens in a new tab)

Group-IB ·fetched 7 Nov 2026, 11:38 UTC agreed2/3

Why readNames the organisational gap that infostealer logs exploit, the weeks-long window between credential theft and the first fraudulent transaction, which sits between the fraud team's remit and the SOC's.

Group-IB traces how a single stolen log gets reused across several distinct fraud crimes rather than burned on one, and argues the damaging phase is the quiet period before any transaction fires, when nothing in the fraud monitoring stack has anything to score. The practical implication is that detection has to key on credential appearance in stealer logs and on session or device anomalies at login, not on transaction behaviour. It is vendor analysis rather than a campaign writeup, so expect framing and telemetry claims rather than indicators you can deploy.

group-ib.com → (opens in a new tab)

CVE-2026-102895 (CVSS 9.8): GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/au (opens in a new tab)

NVD ·fetched 7 Nov 2026, 11:38 UTC Must read CVE-2026-102895 CVSS 9.8 EPSS 0.3% agreed3/3

Why readUnauthenticated administrative access to GPUStack before 2.2.0 via a spoofable X-GPUStack-Real-IP loopback header, with exploitation already observed against a 2.1.1 deployment.

get_current_user in gpustack/api/auth.py treated loopback-sourced requests as the built-in administrator whenever force_auth_localhost was false, which was the default; client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP value of 127.0.0.1, so the check was remotely forgeable. The result is full admin takeover: user and model changes, persistent admin API keys, disclosure of worker and cloud provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation in the wild is confirmed and the fix is 2.2.0, so treat exposed GPU cluster managers as compromise candidates, not just patch candidates.

nvd.nist.gov → (opens in a new tab)

SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins (opens in a new tab)

SecurityWeek ·Eduard Kovacs ·fetched 7 Nov 2026, 11:38 UTC Must read CVE-2026-19868 agreed3/3

Why readCVE-2026-19868 lets an attacker with credentials for one SonicOS login method bypass SAML checks including SAML-enforced MFA, and it is already being exploited.

SonicWall has patched a SonicOS flaw that undermines SAML authentication on VPN logins: credentials valid for a different login method can be used to get past the SAML path, defeating MFA enforced through it. Exploitation has been observed, which makes this an immediate patch for anyone running SonicWall VPN at the edge. Until patched, assume SAML-enforced MFA on affected appliances is not a reliable control and review VPN authentication logs for logins that bypassed the expected flow.

securityweek.com → (opens in a new tab)

Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 7 Nov 2026, 23:42 UTC Must read CVE-2024-27834 EPSS 1.5% agreed3/3

Why readCVE-2024-27834, an Apple Pointer Authentication bypass patched in May 2024, is now in CISA KEV after Sekoia tied APT29 to exploitation of already-patched Safari and Chrome bugs.

CISA added CVE-2024-27834 (CVSS 5.5), an improper authentication issue letting an attacker with arbitrary read/write bypass Pointer Authentication, to the KEV catalog. Apple fixed it in iOS/iPadOS 16.7.8, iOS/iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5 and Safari 17.5 after it was demonstrated as a zero-day at Pwn2Own Vancouver 2024. The KEV listing follows Sekoia reporting that actors linked to APT29 chained previously patched Safari and Chrome flaws to deliver browser and device data stealers, so unpatched or long-lived Apple fleets are the exposure here despite the modest CVSS and low EPSS (0.015).

thehackernews.com → (opens in a new tab)

CVE-2026-83542 (CVSS 9.8): Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attac (opens in a new tab)

NVD ·fetched 7 Nov 2026, 23:42 UTC Must read CVE-2026-83542 CVSS 9.8 EPSS 1.1% agreed3/3

Why readUnauthenticated RCE in Apache OFBiz 24.09 before 24.09.08, with a second, explicitly unauthenticated route at /sfa/control/editPortalPageColumnWidth that returns command output directly.

The attack stages crafted widget XML in a multipart upload that is kept in flight, then overrides mainDecoratorLocation through an anonymous JSON request so OFBiz loads the staged XML from the live process file descriptor and evaluates an unsandboxed Groovy expression while rendering the authentication-failure page. Nothing needs to be written to disk and the multipart body does not need to be malformed. OFBiz has a long history of mass exploitation and prior KEV entries, so 24.09.08 should be treated as urgent on any internet-facing instance.

nvd.nist.gov → (opens in a new tab)

Meet *sshole, the vulnerability that lets hackers SSH into Linux devices (opens in a new tab)

Ars Technica Security ·Dan Goodin ·fetched 7 Nov 2026, 23:42 UTC agreed3/3

Why readA decade-old OpenSSH-plus-musl interaction lets an attacker log into Alpine Linux systems with no password, on first connection, every time.

The bug lives in how OpenSSH handles authentication when built against musl rather than glibc, and it only bites where PAM is not in use, which is the common Alpine configuration. Exploitation also requires at least one account whose password is hashed with SHA256 or SHA512 and a target account set passwordless via a "*" in the password field. Alpine is heavily used as a container base, so the practical question is how many of your images ship sshd under those conditions; other musl-based distributions may be affected on the same terms.

Also covered byStepSecurity (CI/CD) (opens in a new tab),oss-security (opens in a new tab).

arstechnica.com → (opens in a new tab)

CVE-2026-122299 (CVSS 8.6): Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last (opens in a new tab)

NVD ·fetched 7 Nov 2026, 15:40 UTC CVE-2026-122299 CVSS 8.6 EPSS 0.3% agreed3/3

Why readA commit with two tree headers resolves one way in core git and another in dulwich, so reviewers and CI can approve one tree while Poetry installs a different one.

Dulwich before 1.2.20 resolves a duplicate tree header in _parse_commit to the last occurrence, while core git takes the first. Poetry 2.5.1 ships that version and uses dulwich by default for git dependency installs, so a crafted commit presents a benign tree to anyone reviewing it or to CI running git, while the Poetry checkout pulls an attacker controlled tree with its own setup.py or build scripts. That is unreviewed code execution on the build host, with the review step actively showing the wrong thing; pin dulwich to 1.2.20 or later anywhere Poetry resolves git dependencies.

nvd.nist.gov → (opens in a new tab)

CVE-2026-117691 (CVSS 9.1): A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter (opens in a new tab)

NVD ·fetched 7 Nov 2026, 23:42 UTC CVE-2026-117691 CVSS 9.1 EPSS 0.3% agreed3/3

Why readKeycloak's SAML HTTP-Redirect binding verifies signatures against literal parameter names while the server also accepts percent-encoded ones such as %53AMLResponse, allowing an unsigned assertion to be processed.

The parser and the signature-verification path disagree on parameter naming, so an attacker can submit a crafted unsigned SAML message that the server acts on in place of the legitimately signed one, taking over any federated account. Keycloak sits in front of a great deal of enterprise SSO, and the underlying parameter-name decoding desync is worth checking for in any other SAML implementation you maintain. Unauthenticated, network-reachable, CVSS 9.1.

nvd.nist.gov → (opens in a new tab)

CVE-2026-122311 (CVSS 9.4): Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced (opens in a new tab)

NVD ·fetched 7 Nov 2026, 19:42 UTC CVE-2026-122311 CVSS 9.4 EPSS 0.4% agreed3/3

Why readPath traversal in Kyverno's resource.get() and resource.post() lets a namespace tenant insert .. segments and act cluster-wide as the admission controller's ServiceAccount.

CVE-2026-122311 affects Kyverno 1.16.0 up to 1.19.2: path segments in the resource argument of resource.get() and resource.post() are not validated, so a tenant who can create a NamespacedValidatingPolicy escapes namespace confinement with .. traversal. The resulting reads and writes run with the admission controller's ServiceAccount, which in a default install is enough for cluster takeover. EPSS is still low at 0.00448, but on any multi-tenant cluster where namespace admins are untrusted this is a privilege boundary that does not hold; upgrade to 1.19.2.

nvd.nist.gov → (opens in a new tab)

CVE-2026-109518: apt Flaw Lets Attackers Swap Packages After Verification and Run Code as Root (opens in a new tab)

StepSecurity (CI/CD) ·fetched 7 Nov 2026, 19:42 UTC CVE-2026-109518 EPSS 0.9% agreed3/3

Why readAn apt verification bypass (CVE-2026-109518) lets a network-positioned attacker swap a package after signature checking and execute as root on Debian and Ubuntu systems, including every CI runner that calls apt-get install.

Debian and Ubuntu shipped fixes on 4 November 2026 for a flaw in apt's HTTP download handling that allows a package to be substituted after apt has verified it; because installs run as root, the swapped content runs with full machine control. Max Justicz, who reported the closely related CVE-2019-3462 in 2019, found this one too. The blast radius is largest in CI/CD, where sudo apt-get install is routine in GitHub Actions workflows, Dockerfiles and runner images, so self-hosted runners and base images need patching alongside production hosts. EPSS is currently low (0.009) because the attack needs traffic tampering, but the affected surface is enormous.

stepsecurity.io → (opens in a new tab)

CVE-2026-123033 (CVSS 8.3): Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their respective f (opens in a new tab)

NVD ·fetched 7 Nov 2026, 23:42 UTC CVE-2026-123033 CVSS 8.3 EPSS 0.4% agreed3/3

Why readAn attacker on the same layer-2 segment gets unauthenticated full-admin API access and root on TrueNAS SCALE before 25.10.8, including single-node Community Edition boxes with no HA licence.

CVE-2026-123033 (CVSS 8.3) is an authentication bypass in the HA heartbeat origin check in middlewared. The ha_permission hook is registered unconditionally with no failover-licence or heartbeat-interface check, so any unauthenticated connection whose TCP peer address is the hardcoded 169.254.10.1 or 169.254.10.2 and whose source port is 1024 or below is handed a node credential authorized for every API method. Both conditions are properties of the attacker's own socket, so nothing has to be forged. Fixed in 25.10.8 (and the corresponding builds in other release trains) by requiring that the connection terminate on the local HA heartbeat listener.

nvd.nist.gov → (opens in a new tab)

CVE-2026-82907 (CVSS 9.8): Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthentic (opens in a new tab)

NVD ·fetched 7 Nov 2026, 23:42 UTC CVE-2026-82907 CVSS 9.8 EPSS 0.8% agreed3/3

Why readA captured externalLoginKey in Apache OFBiz is a cookie-free bearer credential that never expires, is never bound to a client and is not invalidated after use, giving a full session in every webapp the victim can reach.

checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks, so a replayed key authenticates outright. The framework makes capture easy: it appends live keys to every cross-webapp link it renders, and WidgetWorker's unvalidated inter-app link target lets an authenticated user's key be attached to an attacker-chosen absolute URL and delivered to an external server. Affects 24.09 before 24.09.08.

nvd.nist.gov → (opens in a new tab)

GhostMap: The Android flaw that crashes your phone before you open the app (opens in a new tab)

Bitdefender Labs ·Alecsandru Cătălin DAJ ·fetched 7 Nov 2026, 19:42 UTC Research agreed3/3

Why readA malformed ZIP entry in an APK, specifically the compression method and declared uncompressed length fields, puts Android into a permanent crash loop at install time with no code execution, no permissions and no user interaction beyond installing.

Bitdefender Labs traced emulator crashes in its analysis pipeline, first seen on 12 August 2026 from a banking dropper that never ran, to Android itself mishandling two fields inside a ZIP entry. The result is a core system process that crashes, restarts and crashes again, leaving the device in a boot loop that survives reboot and safe mode; recovery means a factory reset and data loss, unless USB debugging was already enabled and the file can be deleted over ADB before the device reboots. No permissions are granted and the app contains no executable code, which puts the whole attack in the install path and makes this a credible destructive payload for anyone shipping sideloaded APKs.

bitdefender.com → (opens in a new tab)

Insignary Releases Free Insignary-Chk Tool to Detect PHP2Shell and Node2Shell Exposure (opens in a new tab)

Cybersecurity News ·Cybernewswire ·fetched 7 Nov 2026, 03:43 UTC Must read CVE-2026-109618 EPSS 82.6% agreed3/3

Why readFree read-only scanner that finds Linux hosts and container images still exposed to the actively exploited PHP RCE pair, CVE-2026-109618 and CVE-2026-109619, with EPSS at 0.83.

Insignary released insignary-chk, a free read-only checker for PHP2Shell (CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2) and Node2Shell exposure across servers and container images. The PHP flaws sit in the runtime rather than application code, so source review will not find them; fixes shipped on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and 8.1 and earlier are end of life with no patch. Affected deployment modes include Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. The post is vendor-issued via newswire, but the scanner is something a reader can pull and run today.

cybersecuritynews.com → (opens in a new tab)

Show HN: Coldframe, a honeypot that poses as a supermarket fridge controller (opens in a new tab)

Hacker News ·hedgerow-dev ·fetched 7 Nov 2026, 19:42 UTC Research CVE-2025-41450 EPSS 0.9% 92 points agreed3/3

Why readA single-file stdlib Python honeypot that passes as a Danfoss AK-SM 800A or Dixell XWEB refrigeration controller on Shodan and logs CVE-2025-41450 'code of the day' bypass attempts.

Coldframe reproduces the fingerprints Shodan uses to classify these units: header order matching a real AK-SM 800A's nginx responses, page titles, certificate fields, TLS versions, and a Dixell persona that sends no Server header and pads its page to exactly 8,202 bytes. Both personas are indexed as genuine devices rather than honeypots. It recognises exploit attempts against CVE-2025-41450, the Danfoss login bypass, and records whether the submitted code was correct for the day, building on eppser/danfoss-ak-sm-decoy plus published Synacktiv, Claroty and Ironhackers research. For anyone running OT deception, the fingerprint-matching work is the reusable part regardless of whether you care about supermarket refrigeration.

github.com → (opens in a new tab) Discussion (opens in a new tab)

Cloudy Skies: Early Detection of Jamming Against Iridium LEO Satellite-IoT Links (opens in a new tab)

arXiv cs.CR (all) ·Ingrid Huso, Giulia Fliescher, Savio Sciancalepore, Gabriele Oligeri ·fetched 7 Nov 2026, 15:40 UTC Research agreed3/3

Why readA publicly released real-world dataset of Iridium satellite-IoT traffic under 47 distinct jamming conditions, plus a comparison of three one-class autoencoder detectors that work on correctly decoded messages before the link fails.

The authors collected Iridium LEO messages across two propagation environments, static and mobile receivers, and varying jammer distances, powers and signal types, and released the data. They then test whether physical-layer features of the messages that still decode are enough to flag jamming early, benchmarking three autoencoder-based anomaly detectors. Relevant if you run or monitor satellite-IoT links for remote assets; the dataset is the durable contribution.

arxiv.org → (opens in a new tab)

Stealthy Malicious Interference Detection in UAV Formations: A Power-Domain Signaling Game Approach (opens in a new tab)

arXiv cs.CR (all) ·Jianle Ba, Shaolong Guo, Yuntao Wang, Xin Wu ·fetched 7 Nov 2026, 23:42 UTC Research agreed2/3

Why readA concrete method for telling a jammer that deliberately throttles its power to look like ordinary interference apart from genuine spectrum congestion in a drone swarm.

The authors model the interfering UAV as a hidden type, benign or jamming, in a Bayesian signaling game where the adversary tunes transmit power to disguise SINR degradation as normal link fluctuation. The defender maintains a posterior belief updated from observed SINR and uses it to decide between normal operation and defensive power boosting, with the paper characterising the pure-strategy equilibria. It is theoretical work aimed at RF and drone security specialists; there is no implementation or field data here for a general detection engineering audience.

arxiv.org → (opens in a new tab)

Magnet Witness 2.0: Expanded enhancement, large-case performance, and improved reporting (opens in a new tab)

Magnet Forensics ·HaadiyaAli ·fetched 7 Nov 2026, 07:42 UTC agreed3/3

Why readWitness 2.0 adds Sharpen, De-Interlace, Line Doubling and Frame Rate filters so routine video enhancement stays inside the evidence tool rather than moving media to a third-party application.

Magnet's forensic video platform gains four enhancement filters plus faster case loading, clip-list responsiveness and large-report generation for high-volume clip collections. Applied enhancements are documented automatically, which matters for the record of work performed when the output goes to legal review. Worth an upgrade if your unit handles CCTV volume; the capability is incremental rather than new ground.

magnetforensics.com → (opens in a new tab)

ARTEX abuse expands as cybercriminals target financial sector (opens in a new tab)

Microsoft Security ·Microsoft Threat Intelligence ·fetched 7 Nov 2026, 07:42 UTC Must read Research agreed3/3

Why readFirst-party Microsoft telemetry on an agentic AI offensive framework used in live intrusions, with the actor, the RATs it drops, and detection content to hunt it.

Microsoft Threat Intelligence reports that Storm-3358, a Cambodia-based financially motivated cluster focused on Southeast Asian financial organizations, began using the agentic offensive framework ARTEX in October 2026. ARTEX agents scan internet-facing systems, exploit flaws including anonymous file upload and SSRF, then use netcat and curl to pull down the WISP, vshell and AdaptixC2 RATs for persistence and lateral movement. The writeup ships indicators, hunting queries and Defender detections, which makes it one of the few agentic AI attack stories with something a defender can actually run today.

Also covered byInfosecurity Magazine (opens in a new tab).

microsoft.com → (opens in a new tab)

A Gingerbread House for LLM Agents: Source-Planned Honeypots That Lure Autonomous Attackers into an Isolated Shadow (opens in a new tab)

arXiv cs.CR (AI) ·Seungdeok Roh, Seokjun Ryu, Sohee Park, Daeseon Choi ·fetched 7 Nov 2026, 03:43 UTC Must read Research agreed3/3

Why readMeasured results showing a source-planned honeypot plus attacker-confirming router cut autonomous LLM exploitation of CVE-Bench targets from 26/40 to 5/40, and ARTEX to zero.

An LLM defender plans a static honeypot from the application's own source, and a router diverts every subsequent request from a client confirmed as an attacker, including a working exploit, into an isolated shadow copy. On the 40 critical CVE-Bench tasks the static plan dropped real compromise from 26/40 to 5/40 against Claude Opus 4.8 and from 20/40 to 0/40 for the ARTEX attack framework, with 0/20 on 20 held-out tasks not used in the design. The authors are explicit about the residual risk: in roughly half the deception runs the exploit succeeded against the shadow, so the defence relocated a working exploit rather than defeating it.

arxiv.org → (opens in a new tab)

Securing Web Agents with the Compile-Then-Execute Paradigm (opens in a new tab)

arXiv cs.CR (AI) ·Annabella Chow, Jinhao Zhu, Sylvie Venuto, Abdulaziz Alharbi ·fetched 7 Nov 2026, 23:42 UTC Must read Research agreed3/3

Why readA web agent architecture that blocks prompt-injection control-flow hijacking by compiling the user task to Python before any untrusted page content is seen, benchmarked on 581 WebArena Verified tasks.

Baya replaces the ReAct loop with a compile-then-execute design: the planning model never observes live website content, instead emitting a Python program against a Trusted Website API ahead of time. Injected page content can influence values or pick among pre-compiled branches, but cannot redefine the task or make the model synthesise new operations at runtime. Reported aggregate utility is 77.8% across 581 WebArena Verified tasks, which is the number to argue with when weighing the utility cost of the restriction.

arxiv.org → (opens in a new tab)

SPILLWAY: Separating Target Admission from Sanitization to Defend Tool-Using Agents against Prompt Injection (opens in a new tab)

arXiv cs.CR (AI) ·Woosang Lim, Yeseul Chang, Jaewoo Lee ·fetched 7 Nov 2026, 19:42 UTC Must read Research agreed3/3

Why readSPILLWAY proposes a deterministic admission check for tool-using agents: a call is allowed only when target values absent from the user's task came back from a read-only tool in a typed field.

The paper separates target admission from sanitization so the security decision no longer depends on a model that has read attacker-controlled text. Targets such as an email sender or a payment account arrive in typed tool returns, while injected instructions arrive as free text, and that distinction becomes the enforcement boundary; a fixed-rule sanitizer strips instruction-like spans and retains them as evidence. The approach avoids a per-task planning model, which is the usual cost of provenance-based defences.

arxiv.org → (opens in a new tab)

ChatGPT silently passes data between connectors and the bounty wants an ID card (opens in a new tab)

Hacker News ·Aldipower ·fetched 7 Nov 2026, 15:40 UTC Research 90 points agreed3/3

Why readReproducible case where ChatGPT routed a follow-up tool call through a different connector than the one that started the flow, carrying a one-time confirmation code across OAuth client boundaries without telling the user.

With two connectors enabled against the same MCP server, each holding its own OAuth client, the model issued a confirmation tool call through connector A and then routed the follow-up call through connector B, passing along the one-time confirmation code from A's MCP Apps widget. The server sees two separate clients for one user, so a value scoped to one authorisation context lands in another with no UI disclosure of the switch. The report includes the setup and the step-by-step repro, and the disclosure thread itself is a useful read on how this class of agent-routing bug is being handled.

community.openai.com → (opens in a new tab) Discussion (opens in a new tab)

Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs (opens in a new tab)

arXiv cs.CR (AI) ·Xiaobo Chen, Genliang Zhu, Ziyuan Wang, Chu Wang ·fetched 7 Nov 2026, 15:40 UTC Research agreed3/3

Why readMeasures how much requirement drift and in-transit tampering you can remove from multi-agent LLM handoffs by signing a requirement manifest with HMAC-SHA256 and verifying it in code rather than with another model.

A preregistered study on 1,440 Qwen3-8B trajectories across five threat conditions compared free-text, structured JSON and signed requirement-manifest handoffs between orchestrator and subagents. Signed manifests cut unsafe commits under attack from 69.4% to 9.0% with no net loss of conformant commits versus structured handoffs, and an unsigned manifest committed violations in 79% of mutated runs against none for the signed version. A deterministic verifier beat an LLM checker on the same trajectories: 78.7% of violating decisions caught at a 7% false alarm rate, versus 59.0% at 50%.

arxiv.org → (opens in a new tab)

CVE-2026-122135 (CVSS 8.6): Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configured gpg.pr (opens in a new tab)

NVD ·fetched 7 Nov 2026, 15:40 UTC CVE-2026-122135 CVSS 8.6 EPSS 0.5% agreed3/3

Why readOpening a crafted repo in Mistral Vibe runs attacker code before the trust prompt, via git's gpg.program and log.showSignature settings carried in the repository config.

CVE-2026-122135 affects Mistral Vibe before 3.0.3: project context collection runs git log against a repository that sets gpg.program and log.showSignature with a signed commit, so git invokes the attacker's binary at session start. The important detail is the ordering, since execution happens before any trust decision is presented to the user. The gpg.program vector applies to any tool that shells out to git log inside an unvetted clone, not just this agent.

nvd.nist.gov → (opens in a new tab)

CVE-2026-82033 (CVSS 8.6): DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication vulnerability in its web profile HTTP and (opens in a new tab)

NVD ·fetched 7 Nov 2026, 07:42 UTC CVE-2026-82033 CVSS 8.6 EPSS 0.2% agreed3/3

Why readAn AI coding agent's local control plane with no authentication: any process on the box can call session.prompt to run commands as the user, and bypass the human tool-approval prompt entirely.

DeepSeek Harness before 0.1.2-alpha.2 (commit 3e24087) exposes HTTP and WebSocket RPC on the web profile with no auth, so any local process, even one running as a different OS user, can reach session.create and session.prompt. That reaches the agent's bash and filesystem tools for arbitrary command execution using the victim's model credentials, and live session traffic and logs are readable over the ungated event mux. Approval gating falls too: POST /api/respond validates only rpcId, approvalId and sessionId, all broadcast on that same stream. The pattern generalises beyond this product to any agent harness that assumes localhost is a trust boundary.

nvd.nist.gov → (opens in a new tab)

JailBound: FOL-Guided Jailbreak Evaluation for Exploring LLM Behavioral Boundaries (opens in a new tab)

arXiv cs.CR (AI) ·Fazong Wu, Xin Wang, Ming Yang, Zhenyong Zhang ·fetched 7 Nov 2026, 07:42 UTC Research agreed3/3

Why readA jailbreak evaluation framework that maps the local boundary between refusal and unsafe response instead of just reporting attack success rate.

JailBound pairs automated benchmark construction with a first-order loss guided dual-branch search, organising threats by risk category, application domain and attack type. A fine-tuned meta-attack generator synthesises prompts across those conditions, and the FOL signal is used to characterise how behaviour shifts locally rather than optimising ASR alone. Useful for anyone building internal red-team harnesses for a deployed assistant, though it is methodology rather than a new attack class.

arxiv.org → (opens in a new tab)

MEvince: Knowledge-Constrained LLM Reasoning for Technique Identification from Malware Reports (opens in a new tab)

arXiv cs.CR (AI) ·Hongyu She, Yiling He, Mengda Xie, Yiping Liu ·fetched 7 Nov 2026, 11:38 UTC Research agreed3/3

Why readAddresses the specific failure mode that makes naive LLM report-to-ATT&CK mapping untrustworthy: the model assigning techniques on plausible association rather than evidence actually present in the report.

MEvince builds a shared behavioural representation by agentically mining ATT&CK technique documentation, then uses it in two online stages: primitive-guided extraction that structures observations and links each one back to its source passage, and evidence-aligned retrieval that matches that grouped evidence against technique profiles. The design targets two hard cases, evidence scattered across long heterogeneous reports and sibling techniques that differ only in small decisive details. For anyone automating CTI enrichment, the citation-back-to-passage constraint is the part worth borrowing even without the full framework.

arxiv.org → (opens in a new tab)

CVE-2026-103002 (CVSS 8.8): GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy for (opens in a new tab)

NVD ·fetched 7 Nov 2026, 11:38 UTC CVE-2026-103002 CVSS 8.8 EPSS 0.4% agreed3/3

Why readShows how an AI serving control plane becomes a Kubernetes privilege escalation path: GPUStack proxied ordinary users' requests using a worker ServiceAccount with no resource-level authorization check.

In GPUStack 2.2.0 through 2.2.1, cluster_apiserver_proxy forwarded any authenticated non-administrator's request to a selected Kubernetes cluster and authenticated it with a reachable worker's ServiceAccount credentials. Within that ServiceAccount's permissions the caller could read secrets and other sensitive resources, create or modify workloads, or delete them, and attacker-controlled workloads give code execution in the target cluster. Version 2.2.2 fixes it; anyone running GPU fleets under GPUStack should also review what those worker ServiceAccounts are actually allowed to do.

nvd.nist.gov → (opens in a new tab)

CVE-2026-122133 (CVSS 8.6): Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a re (opens in a new tab)

NVD ·fetched 7 Nov 2026, 15:40 UTC CVE-2026-122133 CVSS 8.6 EPSS 0.4% agreed3/3

Why readSecond pre-trust-prompt code execution path in Mistral Vibe on Windows: a git.exe dropped in the repository root is picked up by SessionLogger and ProjectContextProvider.

CVE-2026-122133 is an untrusted search path issue in Mistral Vibe before 2.25.5 on Windows, where the current directory precedes PATH when the agent resolves git. Luring a user into opening a crafted repository runs the planted git.exe at session start, again before any trust prompt. Same class as CVE-2026-122135 and a reminder that agentic IDE tooling executes a lot of subprocesses in directories it has not yet decided to trust.

nvd.nist.gov → (opens in a new tab)

EU accuses TikTok of trapping users in harmful ‘rabbit holes’ (opens in a new tab)

The Record ·fetched 7 Nov 2026, 11:38 UTC agreed3/3

Why readFirst DSA enforcement action anywhere to target a recommender system directly, exposing TikTok to fines of up to 6% of global annual revenue.

The European Commission issued preliminary findings that TikTok's 'For You' algorithm breaches the Digital Services Act by pulling users into content loops on self-harm, sadness and body image. Officials described it as the first time regulators have challenged an engagement-based recommendation system itself rather than individual content, and said the target is the business model. Any platform operating a personalised feed in the EU now has a precedent to read against its own DSA risk assessment.

therecord.media → (opens in a new tab)

British soldier ignored order to pull his SIM card, then got blackmailed (opens in a new tab)

Ars Technica Security ·Cyrus Farivar ·fetched 7 Nov 2026, 15:40 UTC agreed2/3

Why readA documented end to end chain from one ignored opsec rule to a hacked phone, sextortion, and ten months in military detention, which is the rare compliance story with a verifiable consequence at the end of it.

Soldier Daniel Barton-Kennedy was ordered to remove the SIM card from his personal phone before deploying to a part of Estonia roughly 90 miles from the Russian border, and refused. His phone was compromised, intimate photos were stolen, and he was blackmailed; he later pled guilty to disobeying a lawful command, was reduced in rank, and received ten months detention. Beyond the individual case it is a reminder that personal devices carried by staff into sensitive locations are an adversary's cheapest route to coercion, and that the coercion target is the person, not the network.

arstechnica.com → (opens in a new tab)

Google Forcing AI on Students Is BS (opens in a new tab)

EFF Deeplinks ·Rory Mir ·fetched 7 Nov 2026, 07:42 UTC agreed2/3

Why readWhat Google's Classroom AI rollout actually left administrators able to turn off, and what switching Gemini off originally cost them.

Google enabled Gemini for 150 million K-12 Google Classroom users in August, then shipped an opt-out that would also have disabled Google search for the school. After public pressure it decoupled the controls and set Gemini, Gemini notebook and Search to off by default. EFF's argument is that the rollout pattern rather than the specific setting is the problem, since search itself continues moving toward a chatbot interface regardless of the toggle.

eff.org → (opens in a new tab)

Chainalysis says hackers stole credentials and tokens for all of its customers (opens in a new tab)

Ars Technica Security ·Dan Goodin ·fetched 7 Nov 2026, 19:42 UTC Must read agreed3/3

Why readChainalysis says attackers took names, usernames, password hashes and live session tokens for all of its users, a customer list that includes the FBI, ICE, the US Air Force, Microsoft, Coinbase and Barclays.

Chainalysis disclosed an October breach in which an external actor used AI agent-assisted offensive techniques to reach its systems and internal tools, and has now told customers that sensitive personal data including password hashes and live tokens was obtained for the entire user base. The company initially characterised the exposure as non-sensitive data such as user IDs, full names and email addresses. Live tokens for investigators at federal agencies and major financial institutions are the part that matters: anyone whose staff hold Chainalysis accounts should force credential and session invalidation now and check for onward access attempts.

arstechnica.com → (opens in a new tab)

Certificate authority DigiCert reports data breach involving business customer info (opens in a new tab)

The Record ·fetched 7 Nov 2026, 03:43 UTC agreed3/3

Why readA certificate authority disclosed that an internal business system sat externally reachable for roughly 16 months and was accessed by an outsider, with the post-mortem filed publicly on Mozilla's Bugzilla.

DigiCert moved an internal business system out of its VPN-restricted network in February 2025, leaving it externally accessible; on 2026-06-21 the company determined the exposure and found an unassigned account had been created, with the issue closed out by July 2. On October 19 DigiCert confirmed the database had been accessed from June 27 and classified it a reportable event, with customer names, business email addresses, phone numbers and documents involved. No certificate issuance compromise is claimed, but a CA publishing an incident timeline to Bugzilla is a root-program matter that peers and auditors will ask about.

Also covered bySecurityWeek (opens in a new tab).

therecord.media → (opens in a new tab)

Perry Johnson healthcare data breach: $10 mn settlement over 13.3 mn patients (opens in a new tab)

Google News: incidents · Beinsure ·fetched 7 Nov 2026, 23:42 UTC agreed3/3

Why readA $10m settlement over a healthcare breach affecting 13.3 million patients: a concrete per-record cost figure for anyone modelling breach liability.

Perry Johnson has agreed a $10m settlement covering a breach that exposed data on 13.3 million patients. The figure gives a usable datapoint for litigation-exposure and insurance conversations in healthcare. Coverage is headline-level with no detail on the original intrusion or the settlement terms.

news.google.com → (opens in a new tab)

FBI agent pleads guilty to stealing $2.4 million in crypto from nation-state hackers (opens in a new tab)

The Record ·fetched 7 Nov 2026, 07:42 UTC agreed3/3

Why readAn FBI Supervisory Special Agent in the Counterintelligence and Espionage Division pleaded guilty to moving $2.4m in crypto out of wallets tied to 35 active investigations, which is an evidence-custody failure anyone who hands seized assets to law enforcement should note.

Patrick Steven Yaroch, 37, admitted wire fraud and money laundering after making 100 transfers from 79 wallets starting in December 2024, taking from both adversarial nation-state holdings and at least 10 crime victims. He faces up to 20 years. The access came from his seniority on an investigative squad holding the codes and passwords, which raises an uncomfortable question about internal controls over seized cryptocurrency and about the integrity of evidence in the affected cases.

therecord.media → (opens in a new tab)

Cyberattack on Blood-Storage Systems Tests Cold-Chain Defenses (opens in a new tab)

Google News: incidents · Lab Manager ·fetched 7 Nov 2026, 07:42 UTC agreed3/3

Why readA cyberattack hitting blood-storage systems, which puts cold-chain and sample-integrity monitoring into the category of operational technology a healthcare board will ask about.

Lab Manager reports an intrusion affecting blood-storage infrastructure and the cold-chain controls around it. The item reached us as a headline with no named organisation, dates or attribution, so the technical picture is absent. The relevance is the target class: temperature-controlled storage is safety-critical and rarely covered by the same controls as clinical IT.

news.google.com → (opens in a new tab)

Mercado Bitcoin Is Reopening After a Cyberattack Froze Withdrawals for a Week. What Happens to Your Crypto When an Exchange Goes Dark? (opens in a new tab)

Google News: incidents · 24/7 Wall St. ·fetched 7 Nov 2026, 23:42 UTC agreed3/3

Why readMercado Bitcoin restoring service after a cyberattack froze customer withdrawals for a full week, a concrete outage-duration datapoint for exchange counterparty risk.

The Brazilian exchange is reopening after an attack halted withdrawals for roughly seven days. The piece pairs that with general discussion of customer exposure when an exchange goes dark. No incident detail, attribution or loss figure is given, so the week-long freeze is the fact worth keeping.

news.google.com → (opens in a new tab)

Nearly a week after cyberattack, Turning Stone still dealing with tech and phone outages across resort (opens in a new tab)

Google News: incidents · Syracuse.com ·fetched 7 Nov 2026, 03:43 UTC agreed3/3

Why readTurning Stone Resort Casino is still running degraded nearly a week after a cyberattack, with phone and IT systems down across the property.

Syracuse.com reports continuing technology and telephone outages across the Oneida Nation's Turning Stone resort roughly six days after the incident began. No actor, entry vector or extortion claim is attached yet, and the operator has not characterised data impact. The length of the outage is the story for anyone in hospitality and gaming: it is the same multi-day operational collapse pattern seen in the casino intrusions of recent years.

news.google.com → (opens in a new tab)

Russia’s Rosstat Struggles to Restore Systems After Major Cyberattack (opens in a new tab)

Google News: incidents · Bloomberg.com ·fetched 7 Nov 2026, 11:38 UTC agreed2/3

Why readA national statistics agency is days into recovery and still not back, which is the kind of sustained state-level outage that gets cited in board conversations about recovery time assumptions.

Bloomberg reports Russia's federal statistics service Rosstat is still working to restore systems following a major cyberattack, with the disruption affecting the body responsible for the country's official economic and demographic data. Coverage so far is headline-level, with no attribution, initial access vector or confirmation of data integrity impact. The signal here is duration and target class rather than technical detail.

news.google.com → (opens in a new tab)

TruStage cyberattack leaves grieving Las Vegas family waiting for insurance (opens in a new tab)

Google News: incidents · KTNV Las Vegas ·fetched 7 Nov 2026, 19:42 UTC agreed3/3

Why readTruStage, a named insurance provider, has a cyberattack disrupting claims payouts, with the consumer harm now surfacing in local news.

Local reporting ties a cyberattack at TruStage to a Las Vegas family's delayed insurance payout after a death. The item is thin on technical or investigative detail, but it establishes an operational outage at a named insurer and the kind of human-impact coverage that reaches executives and regulators. Peers in insurance and financial services should expect questions about claims continuity during an incident.

news.google.com → (opens in a new tab)

Meloni Blames Pro-Russia Hackers for Cyberattack on Minister (opens in a new tab)

Google News: incidents · Bloomberg.com ·fetched 7 Nov 2026, 15:40 UTC agreed2/3

Why readAn Italian head of government putting public attribution on a cyberattack against a sitting minister, which is the political precedent that shapes how other European states will handle their own incidents.

Prime Minister Giorgia Meloni has publicly blamed pro-Russia hackers for a cyberattack targeting one of her ministers. The reporting is short on technical detail, so the value here is the attribution decision itself rather than any indicator a defender can act on. Treat it as a marker of how quickly European governments are now willing to name a state-aligned actor in public, which matters for anyone briefing executives on geopolitical risk.

Also covered byDW.com (opens in a new tab).

news.google.com → (opens in a new tab)