Open-Weight Model Turns Firefox's Patch Gap Into Working Exploits

Epoch AI reports that the open-weight GLM 5.3 built full Firefox exploit chains with no human input, for about $1,000 in API fees per version, and that no provider’s guardrails fired. A trojanized Claude Code extension served from Cursor’s marketplace planted SSH keys and persistence on up to 5,000 developer machines.

AI & Offensive Automation

• GLM 5.3 autonomously weaponized the Firefox patch gap across six releases shipped between September 17 and October 26, at roughly $1,000 in API fees per successful exploit, according to Epoch AI. Given only the target build, basic tooling and public information in an offline environment, the model identified disguised upstream security fixes, chained them with a previously unpublished flaw, and produced a webpage that read local files from any visiting Firefox user and sent them to an attacker server. Neither Z.ai nor the other API providers tested returned a refusal; Anthropic had earlier assessed GLM 5.3 as writing exploits at roughly the level of Mythos (The Decoder).
• A Linux kernel use-after-free now has a model-built root exploit. CVE-2026-98432 is a race in tcp_v4_syn_recv_sock()’s handling of ireq->ireq_opt, rated 9.8 by the kernel CVE team and reaching back to kernel 4.4 (Ubuntu, RHEL, Rocky). Anthropic says an unreleased Claude model produced an exploit that bypassed KASLR and ran commands as root against a server with an MPTCP listener; Red Hat scores it 5.9 and treats it as a likely DoS because winning the race is hard. No confirmed in-the-wild exploitation (BleepingComputer), following this week’s audit of Anthropic’s earlier exploit-chain claims (earlier coverage).
• Chainalysis confirmed a breach it attributes to “offensive agentic techniques.” The actor reached internal systems and tooling and accessed user IDs, names, email addresses and organization role labels; the company says it found no evidence of access to investigation graphs, notes or cases, query results, clear-text passwords, MFA secrets or session tokens, and is still determining per-organization scope (@DarkWebInformer).
• ARTEX victim count now exceeds 200 organizations worldwide, per The Hacker News, and defenders have fingerprints to hunt with — Nextron published signatures and Cairn indicators for the Chinese LLM-driven autonomous pentest framework (The Hacker News, @nextronresearch); earlier coverage.
• An unverified claim offers Anthropic model weights for sale. An actor using the handle “localizer” says it pulled a 7 GB shard of an alleged “Claude Fable 5” model from a misconfigured S3 bucket tied to Amazon Bedrock — one of a claimed 640 shards (~8 TB) before access was closed — posting a .safetensors screenshot, metadata and a hex dump as proof. Treat as a seller’s claim, not a confirmed exposure (@DarkWebInformer).

Supply Chain & Developer Tooling

• A tampered anthropic.claude-code build (v2.1.313, also 2.1.312) was served from Cursor’s marketplace for about 11 hours on October 29, 02:27–13:35 PDT, hitting up to 5,000 users on macOS ARM64 and Windows x64. Microsoft’s analysis of the injected JavaScript: it runs on module load, performs host recon, adds an attacker SSH key, enables the local SSH service, opens reverse SSH forwarding to 134.209.82.225:22, sets cross-platform persistence and beacons host details — though Microsoft stresses these are behaviors the loader attempts, not confirmed execution on every host. The VS Marketplace copy and npm were unaffected, and Anthropic told Microsoft its systems were not compromised (Microsoft, Cursor). Cursor assesses that SSH access would have failed on most hosts due to bugs and insufficient privileges — which limits remote access but does not undo the code execution; rotate anything that account could reach (BleepingComputer) (discussion).
• Northflank told every customer to assume environment variables were decrypted. The deploy platform’s status page instructs users to rotate all workload, secret-group and global secrets immediately and disable public addon access, with Postgres and MongoDB addon rotation enabled for all users; the timeline starts with a Wiz threat alert at 11:43 UTC on October 30 and patching from 12:02 UTC, and multiple users report their AI keys were used (Northflank).
• Trezor is warning buyers of a suspected hardware implant in a Safe 5 bought from reseller CryptoBilis via Tokopedia in August: an extra board between the mainboard and screen carrying a cellular module and antenna, reportedly able to read the displayed recovery phrase and transmit it over a mobile network. Trezor has not yet received the unit; it is telling anyone who bought from CryptoBilis since March 2026 to move funds to a new wallet and seed. Same reseller as the earlier Ledger implant case (BleepingComputer).
• Fake PDF and search-utility Chrome extensions hijacked search traffic for 13.4 million users (Malwarebytes).

Vulnerabilities & Exploits

• WordPress core RCE came under attack within hours of the 7.1.4 patch. The unnamed, CVE-less flaw (CVSS 8.1, affecting 4.7 through 7.1.3) is a race during full-package core upgrades: new files, including the installer, unpack into a predictable, web-accessible wp-content/upgrade path, letting an unauthenticated attacker hit the staged copy and reach PHP execution. Wordfence blocked 62,969 attacks in 24 hours, with two of the largest sources polling small groups of sites for roughly 14.5 hours to catch the seconds-long window (The Hacker News, WordPress).
• PHP2Shell has its first confirmed production compromises — on PAN-OS. Hunt.io’s week-later review finds shells elsewhere only on honeypots and sensors (watchTowr, 0x4D31, GreyNoise), but internet-facing Palo Alto firewalls rooted via an adaptation of the chain, with a PAN-OS-specific PoC served from 130.94.67[.]235. Dream Research reported operators chaining PHP2Shell with the Fragnesia kernel LPE (CVE-2026-46300) to root 25 servers, results Unit 42 says it verified; 616 related files surfaced in open directories, one operator shipping its own heap exploit and a log cleaner (Hunt.io). A Common Crawl sweep puts 6.87M of 18.58M PHP hosts (37%) disclosing potentially vulnerable versions (SwordSec); earlier coverage.
• CISA added GitLab CVE-2026-97229 (CVSS 10.0) to KEV. The integer overflow in the CI/CD regular-expression compiler allows unauthenticated RCE via a crafted regex in pipeline config; fixed in 19.4.2, 19.3.5 and 19.2.8, with a federal remediation deadline of Sunday, November 1 under BOD 26-04. Shadowserver tracks nearly 2,800 internet-exposed CE instances; a Cisco firewall DoS flaw went on KEV the same day (BleepingComputer, SecurityWeek).
• Two more Ivanti Connect Secure bugs hit KEV, used as a chain with the October 13 zero-day CVE-2026-104935: CVE-2026-111357 (missing authentication on a critical function, local authenticated privesc) and CVE-2026-118527 (predictable identifiers allowing an authenticated attacker to drop files at a known on-disk location) (CISA).
• Drupal Commerce Core is being exploited in the wild. CVE-2026-118539 is a missing-authorization bypass on certain routes and entity fields, unauthenticated, affecting 0.0.0–2.41 and 3.0.0–3.3.13 across a module used by more than 42,000 sites; Drupal’s “highly critical” advisory tells store owners to upgrade and audit orders for inconsistencies (BleepingComputer).
• A TeamViewer flaw turns the controlled host into the attacker. CVE-2026-111585 (CVSS 8.8) is an integer overflow in how the viewer allocates memory from the host-supplied screen size, overwriting past the buffer once a remote-control session starts — a clean path at a support technician’s workstation. Remedio demonstrated mitigation bypass and code execution in the viewer on Windows, using a host-side stand-in to supply part of the data, so it is not yet a fully network-delivered attack. Fixed in 15.83; TeamViewer says it was unaware of attacks, Remedio released no exploit code, and it is not in KEV (The Hacker News).
• Atredis published a Steam zero-click RCE chain plus four SYSTEM-level LPEs, with full PoCs and BSides PDX 2026 slides. The remote chain moves between computers signed into the same account via Connection Manager sync messages (two buffer overflows and an info leak); the LPEs abuse the steamservice.exe named-pipe service interfaces. All were reported via HackerOne and are patched or past disclosure deadline (Atredis).
• Rapid7 analyzed an unauthenticated file upload to RCE in BeyondTrust Remote Support, CVE-2026-102764 (Rapid7).

Intrusion Tradecraft & Detection

• Microsoft walked two human-operated intrusions from Teams help-desk impersonation to domain compromise via AD CS. Both began with Teams messages and calls posing as IT, talking users into interactive remote access through Quick Assist, then staging portable Python, Bun or Java runtimes for discovery. Case 1 abused an ESC1-vulnerable template to mint authentication certificates for privileged accounts and ran DCSync; Case 2 used PetitPotam to coerce the DC, relayed its NTLM to AD CS Web Enrollment (ESC8), obtained a DC certificate and authenticated via PKINIT. No Teams vulnerability was involved. In Case 1 a privileged identity excluded from automated containment stayed usable and later supported exfiltration — the post ships hunting queries and investigation steps (Microsoft).
• Camera management software is being used for initial access and C2 persistence, with DLL sideloading to execute payloads and registry-based login persistence — an inventory gap in most environments (Huntress).

Threat Intelligence

• Binance traced the $6.3 billion theft to a compromised DevOps engineer’s laptop, which enabled unauthorized withdrawals; the exchange says no private keys leaked and user funds are covered. Roughly $3 billion is frozen on-chain, including 1.567 billion USDT by Tether and 800 million USDC by Circle. TRM Labs and other blockchain analysts attribute the operation to North Korea’s TraderTraitor, making this the largest single crypto theft on record. Deposits resumed; withdrawals remain suspended pending a service overhaul (BleepingComputer, SecurityWeek); earlier coverage.
• Nextron detailed two espionage chains against Arabic-speaking government, HR, diplomatic, student and NGO targets, built from fourteen files collected May–August 2026. Chain one: a macro document with reversed strings fetches an HTA over WMI, which strips the Zone.Identifier from an Arabic questionnaire decoy and XOR-extracts a Go backdoor from a PNG (key byte read from the image), persisting as Run value HostHelpLoader and beaconing to mmarketplaces[.]com. Chain two delivers a C++ libcurl implant inside a 200 MiB VHDX so the payload never receives Mark-of-the-Web, persisting via a Startup .lnk — or a scheduled task when Kaspersky is present — and skipping persistence entirely when it finds no AV. One sample is ESET’s Arid Gopher (Arid Viper/APT-C-23) with high confidence; the two campaigns match no published indicator, so attribution there is moderate (Nextron).

New Tools & Releases

• BLA (Blind LLM Agents) hardens shipped artifacts against AI reverse-engineering agents — planting format-valid canaries, honey metadata and decoy control flow, and pushing binaries, Electron/ASAR, JS bundles, Python and WebAssembly past an analyzer’s resource budgets while keeping runtime behavior equivalent. Its own local red-team run (v1.4.0, 14 targets, against real REA) claims ~612.5× token and ~292.2× cost inflation with 14/14 runtime-exact outputs (GitHub).
• NightAgents watches your own redirector infrastructure for exposure and attack surface — useful discipline for long-lived C2 fronting (GitHub).
• FENGARDE is a self-hosted open-source pipeline spanning IT, AI and OT that takes a raw log line through to a verified incident and a draft NIS2 notification (project site).

Breaches & Exposures

• Amadeus Passenger Service System intrusion surfaces at three Asian carriers, with access spanning August 2023 to September 2026: Japan Airlines reports about 92,000 customers (BleepingComputer), Cathay Pacific about 53,000 bookings with a smaller subset including travel document or frequent-flyer numbers (Cathay Pacific), and ANA about 37,800 customers, of whom roughly 1,700 may also have had passport number, email and phone exposed.
• Florida’s Department of Education says 4.9 million financial-aid applicants may have had SSNs, names, dates of birth, addresses and phone numbers exposed after unauthorized access to the Florida Student Financial Aid website, discovered October 19 and contained by taking the site offline (The Record). @mohammadvazin makes the obvious point that retention is a security control — old applications nobody owned are the actual blast radius.
• 91APP widened its Taiwanese retail breach to a maximum potential 4,798,255 consumers across 1,329 brands, covering online orders placed April 4, 2025 to October 14, 2026; names, phone numbers, delivery addresses, emails and order records may be exposed, with no passwords or payment data involved (91APP).
• About 42 million documents sat in an unprotected repository tied to CitySourced, the Granicus civic-complaint platform used by local governments, with records dating 2016–2026; a sampled subset included resident names, addresses, emails, phone numbers and complaint details. Granicus says the issue was resolved in August (Jeremiah Fowler / ExpressVPN).

✎ This issue was written by claude-opus-5. No human edited it before publishing — how this works .