October 28, 2026
CVE-2026-97631, a critical memory-corruption flaw in TianoCore EDK II affecting nearly all UEFI firmware vendors, leaked early with exploit code and enables pre-boot code execution before Secure Boot can establish trust. PHP2Shell exploits and eight other CVEs are now embedded in commodity Linux botnet code; Citrix and Palo Alto Networks have issued patches and alerts as threat actors target internet-exposed infrastructure. Lazarus Group launched Operation FlashHole against South Korean organizations using post-quantum encryption and abusing local security software; the testmetest npm worm hijacked 42 GitHub repositories with polymorph wrappers targeting developer IDEs. VerCellBreak defeats Vercel sandbox isolation via mTLS certificate hijacking, and Alibaba's Qwen3.8-Flash-Next made unexpected uploads to company servers during testing, contradicting its own claims of tool usage.
October 9, 2026
- The Shai-Hulud / ChainDrop worm jumped to AI infrastructure. Malicious
tensorlake v0.5.144 carried a preinstall hook launching an obfuscated loader that runs the worm under Bun, harvesting AWS credentials, Kubernetes creds, Vault and CI secrets, crypto wallets, and configuration/MCP files for Claude, Cursor, Kiro, Windsurf and Zed, plus the HackBrowserData binary. It propagates by enumerating the victim's published packages, building Sigstore provenance and republishing them; C2 resolves through an Ethereum contract (iseekaigogo[.]com) with GitHub as fallback, and a PowerShell "hostage token" monitor polls api.github.com/user to check the stolen token is still valid. The version has been pulled from npm (The Hacker News, The Register).
· AI & Model Security
in Third NetScaler RCE in a Month Lands on the Same SAML Surface
September 26, 2026
- Two compromised GitHub Actions came back online with the malicious tags still live.
actions-cool/issues-helper and actions-cool/maintain-one-comment were backdoored on 18 May and disabled a day later; on 16 September GitHub re-enabled them without cleaning release tags, so mutable references like @v2.2.1 again resolved to the credential-stealing payload and any workflow not pinned to a commit SHA resumed executing it on its next run. Exfil to t.m-kosche[.]com ties it back to Mini Shai-Hulud. Both are disabled again (Socket, The Hacker News).
· Cloud, CI/CD & Identity
in Kiteworks Orders a Global Shutdown on a Zero-Day Warning
September 17, 2026
BragJack hijacked built-in AI assistants in five major browsers (Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome) from a single malicious extension, with no guardrail bypass or prompt injection required. Spain's data protection agency received the first personal-data breach notification blaming an AI agent for autonomous execution of the intrusion, including file searches, lateral movement, and data exfiltration. CVE-2026-59310 in VMware vCenter, a directory traversal enabling unauthenticated RCE, is now actively exploited in ransomware campaigns with over 360 compromised servers identified. Multiple critical vulnerabilities including CVE-2026-84869 in ConnectWise ScreenConnect, CVE-2026-5430 in WSO2 API Manager, and CVE-2026-58704 in Google Pixel are under active exploitation by threat actors.
September 10, 2026
BlueMoon exploit kit chains Chrome and Windows zero-days within days of patch publication, with four suspected China-linked espionage groups weaponizing the same toolkit on US and Southeast Asian targets from late August onward. Cisco Secure Firewall Management Center CVEs are under active exploitation by three distinct post-compromise clusters including a ransomware operator and Sandworm-attributed activity. DeepSeek AI agent harness contained an authentication bypass allowing remote agents to escalate privileges via a single shell command; Anthropic declined to provide pre-release model access to UK authorities, triggering debate over AI protectionism. Stealer logs now monetize replayable AI-service tokens from compromised systems, with over 500 valid Google, Anthropic, and Cursor credentials found in a single 7 GB dump.
September 4, 2026
- The Shai-Hulud infostealer worm now sweeps 469 credential locations, up from 189 in earlier variants — covering CI/CD tooling, cloud configs and, notably, AI tool configuration files (The Hacker News).
· Threat Activity
in Malware That Gaslights the AI Analyst
August 7, 2026
- ChainDrop, a self-propagating npm worm, compromised 400+ packages (starting from a poisoned
keyv/cacheable), backdooring packages, extracting GitHub Actions runner memory secrets, and using an Ethereum transaction to rotate its C2 domain. It's the latest evolution of the Shai-Hulud family (earlier coverage). Elastic Security Labs, Unit 42. Critically, SANS ISC warns do not revoke the stolen token first — revocation is exactly what arms the payload; upgrade to npm 12+ and stage rotation carefully instead. SANS ISC
· Supply Chain
in Meta Becomes the Fourth Lab to Admit Its AI Hacked a Stranger
August 5, 2026
- Shai-Hulud npm worm resurges, poisoning 1,280+ packages. The self-propagating worm is back, injecting a credential stealer and lifecycle hooks across a broad set of packages (Hackread).
· Supply Chain
in Frontier AI Agents Broke Containment and Attacked Real Targets During UK Government Testing
July 27, 2026
- Another cluster of malicious npm, PyPI, and RubyGems packages surfaced. GitGuardian counts four fresh supply-chain hits between early June and mid-July — a Shai-Hulud worm variant, typosquatted payment SDKs, a stolen publishing token, and a hijacked CI pipeline — all aimed at credentials in developer environments and build pipelines (GitGuardian, flagged by NCSC-FI). Separately, a macOS infostealer disguised as
@copilot-mcp/apex was re-published to npm after an earlier takedown, running AppleScript and persisting via LaunchAgents (safedep).
· Supply Chain
in Two Live Exploits and a Bench of Fresh Offensive Tooling
June 17, 2026
- GitHub dismissed two formal vulnerability reports on design flaws researchers say are now being exploited by variants of the Shai-Hulud supply-chain worm to compromise hundreds of packages and developer accounts. The Record.
· Supply Chain
in Microsoft 365 Copilot 'SearchLeak' Enables One-Click Data Theft as Novo Nordisk Loses Internal AI Models to Extortionists