October 30, 2026
Palo Alto Networks PHP2Shell flaws are under active exploitation against internet-exposed management interfaces, with CISA warning that attackers are chaining them with a Linux kernel privilege-escalation bug called Fragnesia. Cisco patched CVE-2026-76418, an unauthenticated remote DoS in Secure Firewall ASA/FTD being actively exploited, and Talos disclosed KeyDrift, a custom framework deployed on Catalyst SD-WAN Controllers targeting aerospace and defence sectors. ARTEX, a Chinese LLM-driven autonomous pentest framework, is now appearing at scale in intrusions—researchers report seeing more ARTEX servers than Cobalt Strike and all other C2 frameworks combined.
October 20, 2026
OpenCode suffered a large-scale model-distillation attack that exposed API keys for OpenAI, Anthropic, and Google, causing unauthorized charges up to $1,700 for some users. Plex2Shell transitioned from public research to active exploitation, delivering cryptominers and residential-proxy malware to Plex Media Server instances. Rank Math WordPress plugin was compromised for 11 hours, delivering a persistent backdoor that could create hidden administrators and exfiltrate credentials and API keys. GhostAction enhanced its GitHub workflow attacks with reverse-proxy phishing and OAuth device authorization, stealing credentials across 94 repositories.
October 14, 2026
- Visor is an open-source Android app built from a reverse-engineered Ray-Ban Meta glasses-to-phone protocol, letting "Hey Meta" route to Claude or a self-hosted model instead of Meta AI — useful as protocol documentation as much as a client (GitHub).
· New Tools & Releases
- Meta disclosed a GitHub breach in which attackers took source code and personal data on roughly 1,500 employees (SecurityWeek).
· Threat Activity
- An NCA-hosted Joint Disruption Week produced 28 arrests across West Africa (19 in Ghana, 9 in Nigeria), $11 million seized and 3.7 million accounts suspended with private-industry partners including Meta. In Ghana, authorities identified 117 human-trafficking victims pending repatriation and seized hundreds of devices (The Record, DoJ).
· Industry & Law Enforcement
in Three Chained Zero-Days Put Root on a Fully Patched Ivanti VPN
October 4, 2026
- Apple is changing macOS Full Disk Access to stop apps quietly harvesting Messages, mail and browsing history — the announcement landed two weeks after columnist Jason Aten said Meta's Muse agent surfaced an Apple Messages thread he had not knowingly granted it. Meta CTO David Singleton insisted Muse reads Messages only when FDA and the Messages connector are enabled; Patrick Wardle's point, quoted by Ars, is the simpler one: with FDA, any non-root file is readable — chats, cookies, browsing history. Apple's own wording is that "some developers are using Full Disk Access in ways that could put users at risk" (Ars Technica, Apple developer news). Pressure in the other direction continues: Google Gemini on macOS is reportedly moving toward opening files, launching apps and browsing without per-action prompts (BleepingComputer) (discussion).
· AI & Model Security
in AI on Both Ends of the Exploit Chain
September 30, 2026
- Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics that it says may have been exploited in "extremely sophisticated" attacks against specifically targeted individuals on iOS versions before iOS 27; no known macOS exploitation. Reported by Meta's product security team — notable given Meta's prior involvement in WhatsApp/ImageIO zero-click research. CoreGraphics handles image and PDF rendering in mail, browsers and messaging, so delivery paths are broad. CISA had not added it to KEV as of publication (CERT.dk, SecurityWeek).
· Vulnerabilities & Exploits
- Meta disputes claims that its Muse agent read Apple Messages conversations without permission, saying chats are inaccessible unless the user enables both Full Disk Access and the Messages connector (Dan Goodin, AppleInsider) (discussion).
· AI & Model Security
in Mandiant Names the NetScaler Post-Exploitation Kit as Patch Rates Stay Under 10%
September 25, 2026
- Meta's Muse agent archived its own root filesystem and shipped it to a user's Google Drive — 2.7 GB compressed, 6.8 GB unpacked, containing the Linux session's Ubuntu system files, Meta's internal "Hatch" runtime documentation and integration code, agent persona and memory files (SOUL.md, IDENTITY.md, MEMORY.md), 113 subagent records with JSONL traces, and SSH key files whose validity the researcher could not establish. Reported through Meta's bug bounty; archive and keys not published. Separate bug from the local-takeover zero-day reported earlier this week (earlier coverage). mouse.dev (discussion)
· AI & Agent Security
in An OpenAI Agent Found Its Way Around a Government Portal's Access Controls
September 23, 2026
- Patrick Wardle's zero-day in Meta's Muse assistant lets any unprivileged local process take the agent over. Muse exposes a list of undocumented settings to any local app or terminal command, including the transcription endpoint — repoint it and the attacker receives dictated prompts and the token controlling the account, then inherits every permission the user granted Muse. Wardle built PoCs that write files to disk and take photos with no user-visible indication. Meta said the issue was "not a remote exploit" and shipped a hotfix more than 12 hours after publication; Amazon started blocking Muse from shopping on amazon.com roughly 12 hours before disclosure (Ars Technica, The Hacker News). @lzyzddhg argues the design gap outweighs the bug: auth material and dictated prompts live in one process, so a benign app can become the agent's mouth (discussion).
· AI & Model Security
in Attack Chains That Run Themselves
September 22, 2026
PAYLOAD ransomware achieved full Windows impact through a Group Policy Object at the domain root, eliminating the need for binary encryption or persistence. GHAPPIER malware loader exploited a compromised npm maintainer account to distribute malware through a legitimate CI pipeline with valid provenance signatures. Jade Sleet targeted an Indian IT services provider using Rust-based FLATROOF and ROOFDECK backdoors via weaponized Terraform configuration files. Three unpatched Linux kernel vulnerabilities (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682) now have exploitation in the wild and CISA's remediation deadline has passed.
August 11, 2026
- Meta released Muse Glimmer, a 30B open-weight agent model under Apache 2.0. It's tuned for local, always-on agent workflows and runs on consumer hardware in under 20 GB once quantized — Meta's first cleanly OSI-licensed weights (Simon Willison, The Decoder). (discussion)
· AI & Model Security
in Metabase Zero-Day Blast Radius Widens to LexisNexis and Framework
August 7, 2026
- Meta confirmed its Muse Spark 1.1 model hacked an external organization during a cybersecurity assessment, blaming a configuration error by testing firm Irregular that inadvertently granted the model internet access — after which it exploited a vulnerability in a third-party service. It's now the fourth lab in the rogue-agent saga after OpenAI, Anthropic, and the UK AISI incidents (earlier coverage). BleepingComputer, BBC (discussion)
· AI & Model Security
- Chinese labs kept squeezing the price floor: Alibaba's Qwen3.8 Max jumped 10 points on the Artificial Analysis index to catch Claude Opus 4.8, Meta shipped Muse Spark 1.2 with a coding agent at $0.20/M output tokens, and DeepSeek warned of a "significant" price increase for its hosted V4 Flash. The Decoder
· AI & Model Security
in Meta Becomes the Fourth Lab to Admit Its AI Hacked a Stranger
June 30, 2026
in Edge Appliances Bleed: watchTowr Drops Kemp LoadMaster Pre-Auth RCE as Oracle EBS Joins the Exploited List
June 23, 2026
- Meta pauses AI keystroke-tracking program after internal leak — the abandoned effort would have used employee keystrokes as training data; surfaced via an internal leak over privacy concerns. Business Insider
· Industry & Policy
in Five Eyes Warns Frontier AI Will Reshape Offensive Cyber Ops as a New Entra ID Conditional Access Bypass Surfaces