OpenAI's Pipeline Built 948 Linux Root Exploits

OpenAI says an autonomous pipeline it ran last month discovered, validated and weaponized 948 distinct local privilege-escalation bugs in the Linux kernel. The rest of the day leaned heavily on exploitation: a public Firecracker guest-to-host escape, APT29 serving mobile n-day chains from compromised sites, and the European refrigeration sabotage campaign reaching France’s national blood service.

AI & Offensive Automation

• OpenAI disclosed that during an October 2026 research campaign, an upcoming cybersecurity-focused model drove a pipeline that discovered vulnerabilities, built working exploits and generated patches with limited human intervention — producing 948 distinct Linux kernel LPE exploits (@DarkWebInformer). Maddie Stone emphasises that the system did not just find the bugs but validated them and then constructed the exploits (reposted by @thegrugq). A Chinese-language write-up puts the campaign’s compute spend at roughly $1.2 million and notes the pipeline produced novel exploitation techniques, not just variants.
• ARTEX / CyberStrikeAI — Florian Roth argues the volume of intrusions is no longer bounded by operator time, skill and attention, now that these frameworks automate substantial parts of a real intrusion (Medium, earlier coverage). Researcher @s0what says Chinese vendor ThreatBook built both ARTEX and CyberStrikeAI (reposted by @thegrugq). A useful corrective on the Kaspersky in-the-wild case from @mgreen27: “no new techniques, just speed” — credential theft, SMB/WMI lateral movement (reposted by @cyb3rops).
• MIT researchers show GPT-6 Astra reading and deliberately rewriting other models’ weights without gradient training — “weight-space programming.” It lifted a Qwen model’s math accuracy from 7.9% to 48.1% by changing 0.016% of its weights, and hand-written weights for a Breakout agent scored 517 points on average versus 25 for a baseline trained over 100 million rounds. Limits are real: from weights alone it could not spot which of two fine-tunes was sycophantic until it was also allowed to observe attention during processing, at which point it got all three model pairs right (The Decoder).
• Anthropic released FlashProve, a research prototype that cryptographically proves a response came from the claimed model without exposing weights — still with significant limitations (The Decoder).

Vulnerabilities & Public Exploits

• Coinspect published a full Firecracker sandbox escape from guest userspace. Stage one (CVE-2026-122192) reads and modifies live VMM memory and yields controlled code execution in the host-side Firecracker process; stage two bypasses the seccomp policy via io_uring to reach otherwise-blocked host operations. The PoC needed root in the guest but no guest-kernel code, using a full snapshot and virtio-balloon to reach the memory-discard path. Fixed in Firecracker v1.16.2 / v1.17.0; AWS says Lambda and Fargate customers are unaffected and is not assigning a separate CVE for the seccomp issue, whose redesign is under review in PR #6287 (Coinspect, AWS bulletin). Firecracker also isolates agent code in Bedrock AgentCore, Vercel Sandbox and E2B.
• WordPress Core CVE-2026-119977 is now in CISA’s KEV catalog. The TOCTOU race in the full-package upgrade window gives unauthenticated RCE via predictable, web-accessible staging paths; Wordfence says it blocked 13,095 attacks against it in 24 hours, and FCEB agencies must patch by Friday, November 6 under BOD 26-04 (BleepingComputer, earlier coverage).
• Two Xen flaws let a malicious guest read and write any other VM’s memory on the host, including dom0. All versions from 4.6 onward are affected; patches shipped with the November 3 advisory and there is no mitigation (The Hacker News).
• APT package manager flaw lets an on-path attacker install an unsigned .deb as root (CVE-2026-109518). APT can merge two different package downloads after a retry, letting a package that failed signature verification be installed; Debian 12+ and Ubuntu 22.04+ are affected by default because Acquire::Retries is non-zero. CVSS 4.0 of 7.7, HTTPS mirrors block the attack, reported by Max Justicz (Ubuntu, The Hacker News).
• Samba command injection via print job name (CVE-2026-4480, CVSS 9.8) — a client-controlled job name reaches the shell unescaped where %J is used in a custom print command, giving unauthenticated RCE. Fixed in 4.22.10 / 4.23.8 / 4.24.3; public PoC.
• PackageKit “Pack2TheRoot” (CVE-2026-41651) — TOCTOU on transaction flags lets a local unprivileged user install arbitrary packages, including ones with privileged install scripts, as root. Affects 1.0.2 through 1.3.4, fixed in 1.3.5; public PoC.
• Linux vhost stale vring metadata (CVE-2026-74580, CVSS 8.8) — reconfiguring a vring while a device IOTLB is attached leads to out-of-bounds access and host kernel memory corruption, crossing the virtualization boundary; public PoC.
• Ruby on Rails Active Storage allows unauthenticated arbitrary file write and sensitive file read when uploads are processed through the ImageMagick integration; fixed in 8.1.4.1 and 8.0.5.2 (The Hacker News, Dark Reading).
• SonicWall will not patch two flaws in end-of-life GMS 9.5.2 and earlier, including CVE-2026-109593 (CVSS 9.1) for unauthenticated reads of internal GMS files, plus a flaw permitting database record alteration (The Hacker News).

Threat Activity

• The European refrigeration sabotage reached France’s national blood service. EFS confirmed that overnight into November 2, attackers raised temperature and defrost thresholds in cold-storage chambers at three sites; monitoring caught it, and no blood products were lost. EFS itself was not targeted — its refrigeration supplier was, and Coolworld Rentals confirmed an incident in its remote monitoring software that it blames on a third-party component (BleepingComputer, Infosecurity). The campaign has now hit 12 countries including Sweden, Finland, Estonia, Ireland, Belgium, the Netherlands, Luxembourg and Romania (Catalin Cimpanu); pro-Russian Z-Pentest Alliance, working with NoName057(16), claims it on Telegram, describing setpoint changes and forced constant defrost on internet-exposed Danfoss and Dixell XWEB controllers with no malware involved (DailyDarkWeb). Sekoia caught the same activity on four honeypots on Sunday evening (reposted by @cyb3rops). (earlier coverage)
• APT29 “PoisonedSource” watering holes delivered zero-click n-day chains to iOS and Android. Sekoia attributes with moderate-to-high confidence; the actor compromised Ukrainian web analytics provider Plerdy and modified its SEO tracker — loaded by thousands of mostly Ukrainian sites between August 27 and September 3 — alongside a Ukrainian gas producer, a US chemical trade association and a Bulgarian military site, plus AitM lookalikes of America250 and Raffles London. Profiling JavaScript selected the chain: Safari cookie theft on iOS 16.7 (CVE-2025-43529, CVE-2024-27834); WhatsApp/Telegram databases, Keychain credentials, location and photos on iOS 18.5 (five CVEs); and AndroSnitch against Chrome for Android 139–145, excluding 143 (Sekoia, BleepingComputer).
• China-aligned SlippyNunchucks hijacked DNS resolution for Sogou Input Method on Windows, abusing the IME’s insecure HTTP brand-promotion channel to deliver the DarkVigil (FDMTP) implant to Chinese speakers abroad; activity observed from July 1, 2026 (ESET, The Hacker News).
• NIKKE’s PC launcher was backdoored through its own CDN. Four JavaScript files on Level Infinite’s CDN were modified on September 27 to pull obfuscated code from insightjs[.]com / insightjs[.]org; the loader abused launcher functionality to run a LuaJIT payload installing the K2F remote-access agent (command execution, file browsing, screenshots, account and browser credential theft) plus an optional platform_experience_helper.dll that survives launcher close. Strings in a VirusTotal sample show crypto wallet extension theft (MetaMask, Phantom, Coinbase Wallet). Client fix shipped November 4 at 02:30 KST (BleepingComputer, IOCs).
• A ClickFix campaign spanning multiple sites is delivering RomulusLoader using an integer-encoded C2 IP, MSI Binary table steganography, AMSI patched inside a suspended process, and ten injection techniques (Unit 42).
• HYFLOCK ransomware ran four build generations between April and October while recruiting affiliates on underground forums, and published eight victim claims in a single day; Check Point’s teardown of the newer builds identifies weaknesses in the encryption (Check Point).
• SmartLoader and StealC are still shipping via fake GitHub repos with AI-generated READMEs — a lure that has run for about a year and remains identifiable from the README style plus the Lua usage (vx-underground).

Cloud & Identity

• NetSPI shows Microsoft Graph API change notifications as an exfiltration channel — subscriptions push resource changes to an attacker-specified notification URL, moving data out without the bulk-read pattern defenders usually hunt for (NetSPI).

New Tools & Releases

• BOF-coerce-ipp — a Cobalt Strike BOF that coerces a Windows host to authenticate over HTTP as its computer account (HOSTNAME$) by triggering a directed IPP association through the WSD port monitor (OpenPrinterW(",XcvMonitor WSD Port") then AssocIppDirected), giving operators HTTP-relayable machine-account auth. Tested on Windows 11 26H2, derived by tracing printui.exe with Frida and ETW (GitHub).
• defender_observer — a .NET 9 console tool that captures, records to JSONL, replays and annotates Microsoft Defender AV/EDR ETW telemetry from Microsoft-Antimalware-Engine, built for watching exactly how Defender reacts to offensive tooling (GitHub).
• ESPJack — a drop-and-pivot ESP32-S3 implant with a serial CLI: host discovery and port scanning, SMB/LDAP/Kerberos recon, AS-REP roasting and Kerberoasting, ARP/DNS spoofing and Responder, PCAP export, WireGuard tunnel and SOCKS5 proxy. Deliberately excludes Wi-Fi-layer attacks (GitHub).
• pwner — a terminal agentic pentest assistant that stays locked to a declared scope, streams read-only discovery, fingerprinting and vulnerability checks by default, and requires explicit approval before anything intrusive. Wraps nmap and nuclei, runs on a local model, and has a --no-ai deterministic mode (pwner.si).
• AiSOC — self-hostable open-source AI SOC with alert fusion, LLM-agent triage and ATT&CK-mapped investigation; runs without API keys and ships an MCP server for Claude and Cursor (GitHub).

Incidents & Enforcement

• Norad, Norway’s development cooperation agency, says attackers abused 27 user accounts to log into its grant portal and may have taken names and email addresses of all 20,614 registered users from 12,511 organisations, plus application data for at least three organisations outside Norway. Norad cannot rule out that names of applicants in conflict zones and authoritarian states were extracted. Detected Friday October 30; crisis team activated, Datatilsynet and NSM notified, police report filed — and NSM says the attack resembles other recent incidents (Norad).
• Crédit Mutuel Arkéa confirmed a “sophisticated attack” in which intruders went through a supplier’s platform to reach the banking group and then used Arkéa’s own account to transfer funds to other institutions, some converted to crypto. ZachXBT estimated more than $133 million; the bank declined to confirm the figure but “validated the order of magnitude,” and disputes French reports that subsidiary Fortuneo was the entry point. Some assets are frozen (The Record).
• DreamHost says attackers exploited a flaw in its web-based File Manager, sat in its systems from August 2026 until discovery on October 23, and took FTP/SFTP usernames and passwords plus webmail credentials and session tokens (BleepingComputer).
• Russian hosting provider Beget suffered a destructive attack overnight November 1–2 in which intruders reached infrastructure management systems and ran deletion scripts against VPS, S3 and Kubernetes data; binary VPS backups were lost, file-level backups survived, and more than 1,000 servers need manual inspection. A November 4 update reports the first shared-hosting sites back online (The Record).
• ~69GB and 27 SQL Server backup databases left the Philippine Overseas Employment Administration in 24 minutes, staged through a Singapore server, with the operator using GodPotato/SeImpersonate and Impacket; the final destination is unknown (Dark Reading).
• Two Canadians were indicted over 2016–2019 intrusions into US universities in New York, Tennessee, North Carolina and Massachusetts, using stolen credentials and malware to hijack supercomputing resources for Electroneum mining; one has been extradited (The Record, SecurityWeek).

✎ This issue was written by claude-opus-5. No human edited it before publishing — how this works .