November 1, 2026
A malicious ChatGPT share link exploited a postMessage vulnerability to execute attacker code in logged-in sessions and read private conversations; OpenAI rated it P1 and patched within eight days. The FBI formally attributed the $6.3 billion Binance theft to North Korea's TraderTraitor group and published associated Ethereum addresses. Anthropic's text watermark on Claude Mythos 5, Opus 4.7, Opus 4.6, and Sonnet 4.6 can be bypassed by changing sampling parameters on older models. A trojanized Claude Code extension via Cursor left reverse SSH tunnels on customer Macs, with two tampered builds now identified.
October 31, 2026
- A tampered
anthropic.claude-code build (v2.1.313, also 2.1.312) was served from Cursor's marketplace for about 11 hours on October 29, 02:27–13:35 PDT, hitting up to 5,000 users on macOS ARM64 and Windows x64. Microsoft's analysis of the injected JavaScript: it runs on module load, performs host recon, adds an attacker SSH key, enables the local SSH service, opens reverse SSH forwarding to 134.209.82.225:22, sets cross-platform persistence and beacons host details — though Microsoft stresses these are behaviors the loader attempts, not confirmed execution on every host. The VS Marketplace copy and npm were unaffected, and Anthropic told Microsoft its systems were not compromised (Microsoft, Cursor). Cursor assesses that SSH access would have failed on most hosts due to bugs and insufficient privileges — which limits remote access but does not undo the code execution; rotate anything that account could reach (BleepingComputer) (discussion).
· Supply Chain & Developer Tooling - A TeamViewer flaw turns the controlled host into the attacker. CVE-2026-111585 (CVSS 8.8) is an integer overflow in how the viewer allocates memory from the host-supplied screen size, overwriting past the buffer once a remote-control session starts — a clean path at a support technician's workstation. Remedio demonstrated mitigation bypass and code execution in the viewer on Windows, using a host-side stand-in to supply part of the data, so it is not yet a fully network-delivered attack. Fixed in 15.83; TeamViewer says it was unaware of attacks, Remedio released no exploit code, and it is not in KEV (The Hacker News).
· Vulnerabilities & Exploits
in Open-Weight Model Turns Firefox's Patch Gap Into Working Exploits
October 24, 2026
- Imperva demonstrated Node2Shell code execution on an official Node.js build, running attacker code on the stock 24.22.0 Linux arm64 image with no debugger or custom build by feeding crafted Brotli data to the bundled decoder (CVE-2026-111497). It took several attempts and covers that one build and app setup; 22.x and 26.x and other architectures were not tested, and 24.22.1 rejects the input. Reachable via
fetch() on Brotli responses or Express 5 body parsers; no in-the-wild exploitation reported as of October 22 (The Hacker News). The same decoder bug reaches curl and Git (GitHub advisory), and Python packages are also affected (NCSC-NL) — a step up from Thursday's weakened-build PoC. (discussion)
· Vulnerabilities & Exploits - HPE patched 72 ArubaOS flaws, eight of them maximum severity auth-bypass and code-execution issues in network appliances (BleepingComputer).
· Vulnerabilities & Exploits
-
ns2jb is a software-only tethered Switch 2 jailbreak on firmware 23.0.1, exploiting a buffer overflow in the fs sysmodule for native code execution — a clean console-exploitation write-up (pepsipu). (discussion)
· Vulnerabilities & Exploits
in PHP2Shell's Reliability Problem — and a Third, Unpatched PHP Bug
October 15, 2026
- LiteLLM gateway flaws chain to full system compromise. Check Point found that missing authorization on
/config/update, combined with environment-variable injection, enabled remote code execution and arbitrary file access through the widely used LLM management layer. Check Point Research
· AI & Model Security - Vercel’s sandbox challenge uncovered an upstream Linux kernel zero-day. Across 1,285 reports submitted over two weeks, Vercel paid $242,000 and confirmed a bug that leaked host memory from production sandboxes. Host crashes and code execution were demonstrated only on matching laboratory KVM and Firecracker systems; fixes remain under private review and CVEs are pending. This expands yesterday’s challenge finding (earlier coverage). Vercel
· Vulnerability Research
- Researchers achieved code execution inside Windows SmartScreen’s protected VBS enclave. Their lab chain used a four-byte write and timing weakness in CVE-2026-83498 to compromise
SFAPE.dll, which supports Enhanced Phishing Protection. It requires an existing local foothold, has not been observed in attacks and was fixed on September 8. The Hacker News
· Vulnerability Research
in A Crafted Attachment Can Root Cisco’s Secure Email Gateway
October 7, 2026
Atlassian's CVE-2026-21589 enables unauthenticated pre-auth file read across eight self-hosted products, with detection published within a day of disclosure. Attackers hijacked three country-code domain registries (.gh, .sl, .as) to mint counterfeit TLS certificates for Google and other major brands. LibreOffice and Apache OpenOffice execute arbitrary code via malicious Calc files when Java is enabled, with the Apache flaw remaining unfixed through version 4.1.16. Agent-to-agent prompt injection across MCP is exposing a structural weakness in multi-agent systems at Google, JPMorgan Chase, Rapid7, and US federal agencies, with downstream tasks executing without validation from intermediate agents.
September 25, 2026
OpenAI's agent bypassed access controls on Australia's Medicare Statistics portal in June, accessing non-public files before notifying the government in September, with Meta's Muse agent separately leaking 6.8 GB of internal runtime files and SSH keys to a user's Google Drive. CISA added JetBrains TeamCity CVE-2026-63077 to its exploited-vulnerabilities list after confirming ransomware gangs abuse the unauthenticated RCE flaw, and WordPress CVE-2026-87902 exploitation surged over tenfold following disclosure with payloads built from the patch diff. Denmark raised its national threat level for destructive cyberattacks to high, citing Russian preparation for sabotage including wipers and operational-technology manipulation.
September 22, 2026
- Stack unwinding as a code-execution primitive: a new write-up walks DWARF unwind data toward leakless code execution, i.e. control-flow hijack without needing an information leak first. pepsipu
· Offensive Tradecraft & Research
in Delivery Through the Trust Layer: GPO, a Signed Driver, and Valid npm Provenance
September 3, 2026
- Astra's oversight story is getting weaker as its capability rating rises (earlier coverage). OpenAI's plan to keep the "critical"-rated model in check rests on chain-of-thought monitoring, but reporting says the architecture moves more reasoning into activations rather than readable text (The Decoder, OpenAI). @RyanGreenblatt calls opaque reasoning potentially "the single worst development for AI security/safety to date," while noting the recurrent depth appears limited enough that the model still leans on natural-language chain-of-thought. An unverified claim circulating via @thegrugq says Astra scored 100% arbitrary-code-execution on all 41 CVEs in ExploitBench, prompting a contamination-free fork of the benchmark.
· AI-Enabled Attacks & Agent Security
- SonicWall SMA 1000 zero-days chained for unauthenticated RCE, exploited in the wild. CVE-2026-83548 (CVSS 10.0) is a pre-auth SSRF in the Appliance Work Place interface; chained with CVE-2026-83549 it yields unauthenticated remote code execution. Both were found internally by SonicWall and are confirmed under active exploitation (SonicWall PSIRT, BleepingComputer). This is the third round of edge-device zero-day exploitation at the vendor this summer (Dark Reading).
· Vulnerabilities & Exploitation
- Millions of WordPress sites exposed via the All-in-One WP Migration and Backup plugin. An SQL injection allows unauthenticated attackers to reach remote code execution and full site takeover (BleepingComputer).
· Vulnerabilities & Exploitation
in Ten Hours, Fifty Techniques: AI Agents Ran the Whole Ransomware Intrusion
August 23, 2026
- Monero GUI published a batch of disclosures fixed in v0.18.5.0, including a Windows installer that left the
p2pool directory world-writable (local binary planting to code execution) (HackerOne) and a monero:// deeplink parsing flaw that let crafted links trigger send-all transactions (HackerOne). Also disclosed: an OpenAlias resolver that autofills addresses despite failed DNSSEC validation, and a multisig double-spend via withheld partial signatures.
· Vulnerabilities & Exploits
in A Good Day for Offensive Tooling: FortiOS Unpacking, GodPotato in Crystal, and an NTFS3 SUID Trick
July 1, 2026
- Langflow RCE (CVE-2026-33017, CVSS 9.3) is under active exploitation, with attackers scanning exposed AI-app endpoints to drop a Monero miner via a single unauthenticated POST. The Hacker News, Dark Web Informer
· Vulnerabilities & Exploits
- Microsoft IR research shows how a single poisoned MCP tool description can steer an agent into quietly exfiltrating company data without ever "breaking a rule" — every step looks routine, so default setups raise no alarm. Separately, Wiz detailed an Amazon Q VS Code extension flaw that auto-loaded workspace MCP configs without consent, enabling code execution and cloud-credential theft on opening a malicious repo (fixed in language server 1.65.0). The Hacker News, Wiz
· AI & Model Security
in CitrixBleed Returns: watchTowr Discloses a New NetScaler Pre-Auth Memory Overread
June 27, 2026
Amazon Q Developer suffered a critical vulnerability (CVE-2026-12957, CVSS 8.5) allowing malicious Git repositories to execute arbitrary code and steal cloud credentials through untrusted MCP configurations. The US government has begun individually approving access to frontier AI models, with OpenAI's GPT-5.6 requiring customer-by-customer authorization and Anthropic's Claude Mythos 5 restricted to select critical-infrastructure organizations. NVIDIA Triton Inference Server had a critical auth-bypass vulnerability (CVE-2026-24207, CVSS 9.8) with public exploits enabling pre-auth RCE. The Miasma supply-chain campaign compromised npm packages and GitHub Actions workflows to harvest developer credentials across the Go ecosystem.