Amazon Q Coding Assistant Hijacked Through Malicious MCP Configs as Washington Starts Gating Frontier Models Customer-by-Customer

A high-severity flaw in Amazon Q Developer let a booby-trapped Git repo run code and steal cloud credentials the moment a developer trusted the workspace. In parallel, the US government has begun individually approving who gets access to OpenAI’s GPT-5.6 and Anthropic’s Claude Mythos 5, the closest thing yet to a de facto licensing regime for frontier AI.

AI & Model Security

• Amazon Q Developer for VS Code (CVE-2026-12957, CVSS 8.5) let a malicious repository execute arbitrary commands and exfiltrate a developer’s cloud credentials via untrusted MCP server configurations — opening the repo and trusting the workspace was enough. AWS has patched it and published an advisory. The Hacker News, SecurityWeek
• A public PoC dropped for CVE-2026-24207 (CVSS 9.8), a critical auth bypass in NVIDIA Triton Inference Server (pre-r26.03) that exposes the model-management surface and can chain to pre-auth RCE as the Triton process user. The repo ships a detection script, auth-bypass demo, RCE-chain PoC, and Suricata rules. Dark Web Informer
• The Trump administration is forcing a staggered, “customer by customer” rollout of GPT-5.6, with OpenAI calling the access controls unsustainable; the government separately authorized Anthropic to redeploy Claude Mythos 5 — its strongest cybersecurity model — only to a set of US critical-infrastructure organizations. The Decoder, Semafor
• A new paper demonstrates AI agents enabling adaptive computer worms that pair autonomous reasoning with self-propagating malware distribution. cleverhans.io (paper)
• Threat actors are spinning up OpenAI tenants impersonating real companies and inviting employees to “join,” fishing for sensitive data submitted in shared chats and projects. BleepingComputer

Vulnerabilities & Exploits

• CVE-2026-45504: any low-privileged user on Microsoft Exchange can read arbitrary files from the system without authorization; HawkTrace published a write-up and a working Python PoC. hawktrace.com, PoC
• Two fresh Linux kernel LPEs landed with public exploits: DirtyClone (CVE-2026-43503, CVSS 8.8), which corrupts file-backed memory via a cloned network packet for root, and pedit COW (CVE-2026-46331), an out-of-bounds write in act_pedit that poisons shared page-cache memory. JFrog published an exploit walkthrough for DirtyClone; a working pedit exploit appeared within a day of CVE assignment. DirtyClone, pedit COW
• PTC Windchill PDMLink / FlexPLM RCE (CVE-2026-12569) was added to CISA’s KEV catalog after the first observed in-the-wild exploitation, with attackers dropping web shells. The Hacker News, SecurityWeek
• A PoC was released for CVE-2026-3227, an authenticated OS command-injection flaw in the backup/restore process of multiple TP-Link routers (TL-WR802N v4, TL-WR841N v14, TL-WR840N v6) that yields root, complete with firmware RE notes and QEMU tooling. Dark Web Informer
• Unit 42 detailed a cross-cloud bucket hijacking technique that abuses the global uniqueness of bucket names to silently redirect active data streams across major providers. Unit 42

Threat Activity

• Turla has been attributed to a previously undocumented .NET backdoor, STOCKSTAY, deployed against Ukrainian government and military targets and entities tied to Italian foreign policy, per Google Threat Intelligence Group. The Hacker News
• Bitter APT (APT-C-08) is hitting maritime and government officials with a .accdr file disguised as a PDF: AutoExec VBA fires on open, decodes payloads in memory via MSXML2, side-loads a DLL through signed fsquirt.exe, and plants a 17-minute scheduled task masquerading as a Chrome updater that pipes C2 responses straight into cmd.exe. The DLL runs TLS-callback anti-analysis and WMI/BIOS VM checks before fetching stage two. Nextron Research
• The Miasma supply-chain campaign (linked to the Mini Shai-Hulud / Hades family) compromised a maintainer account to rapidly publish malicious npm packages affecting LeoPlatform and RStreams, abusing GitHub Actions workflows and propagating into the Go ecosystem to harvest CI/dev credentials. The Register, The Hacker News
• A trojanized clone of the @whiskeysockets/baileys npm WhatsApp library — @ayunlove/bails, tied to the lotusbail campaign — backdoors any account calling requestPairingCode() via a hardcoded 123LOTUS code hidden with crypto-js AES, using the ?? operator to stay invisible in code review. Florian Roth / Nextron
• Microsoft flagged a “Photo ZIP” phishing campaign hitting hospitality orgs across Europe and Asia since April, dropping a Node.js implant onto front-desk machines via fake image shortcut files and obfuscated PowerShell. The Hacker News, Microsoft
• FBI/CISA updated their March advisory: Russian Intelligence Services phishing Signal users have added a step — coaxing targets into handing over their Signal Backup Recovery Key, which lets attackers restore the backup, read full message history, and persist. BleepingComputer, CISA
• Polymarket customers lost ~$3M after attackers injected a malicious script into the platform’s frontend via a breached third-party vendor; the company says it will reimburse losses. BleepingComputer
• Other notable clusters: Chinese-speaking CL-STA-1062 deploying the new .NET TinyRCT backdoor against Southeast Asian government and energy targets (Unit 42); SharkLoader delivering Cobalt Strike in Kaspersky’s “StrikeShark” campaign (The Hacker News); a Chrome native-messaging backdoor in Italy escaping the browser sandbox via a .pfd.js lure (D3Lab); and SmartLoader (tied to Rhadamanthys/StealC) using Prometheus-obfuscated Lua and Polygon smart contracts for C2 (vx-underground).

New Tools & Releases

• CrystalSliver — a Crystal Palace evasion kit that swaps Sliver’s default reflective loader and post-ex execution path for Raphael Mudge’s Crystal Palace (BSD). GitHub
• KHAOS — a C2 framework that routes agent traffic through cloud services already trusted by enterprise networks. GitHub
• AudioDG.exe DLL hijacking for LPE — executes code as LOCAL SERVICE and escalates to SYSTEM via scheduled tasks, with a reboot-free restart primitive. GitHub
• EtwSuite — a Windows-native ETW inspection tool for browsing providers, consuming live events, recording ETL traces, and multi-format export; useful for detection and telemetry work. GitHub
• Doberman-Core — an open-source security layer that enforces fail-closed, auditable policies on MCP-compatible AI tool execution, blocking high-risk actions and gating sensitive operations behind human approval. GitHub

Industry & Policy

• The Linux Foundation and ~20 tech companies, AI labs, and banks launched Akrites, a coordinated, confidential channel to report, patch, and disclose vulnerabilities in critical open-source software before AI-assisted attackers can weaponize them. The Decoder, akrites.org
• The FCC approved toughened cybersecurity rules for emergency alert systems and undersea cables, including a planned licensing mandate for submarine line terminal equipment operators. The Record