TLDR INFORMATION SECURITY 2026-10-09

POETRY IS THE NEW AI SECURITY THREAT AS POELLM MALWARE INFECTS 3K+ SERVERS

The PoeLLM malware has infected more than 3,000 servers since April, primarily in the US and Western Europe. It targets internet-facing LiteLLM, Ollama, Gotenberg, Gitea, and possibly Ivanti Sentry systems. Infected servers mine Monero using XMRig and Iron miners, then scan for and exploit other vulnerable services. The operator stores C2 addresses in GitHub-hosted poetry. The malware extracts four words and converts them into an IPv4 address.

TENSORLAKE NPM PACKAGE COMPROMISED: A WORM WITH A HOSTAGE TOKEN THAT WIPES YOUR MACHINE IF YOU REVOKE IT

tensorlake@0.5.144 on npm steals developer credentials at install and plants a gh-token-monitor service that wipes the home directory if the stolen GitHub token is revoked. The release was built from malicious commits pushed straight to the project's main branch under a maintainer's name, StepSecurity found, so it carries a valid npm provenance attestation while spreading through victims' npm packages and repos. Pin to 0.5.143, remove the service under ~/.config/gh-token-monitor/ before revoking any token, then rotate every credential the machine held.

CISCO WARNS OF CRITICAL FLAWS ALLOWING NEXUS SWITCH TAKEOVER

Cisco announced security advisories for five critical vulnerabilities in its NX-OS data center operating system that could allow remote code execution on Nexus switches. Successful exploitation depends on the NX-API, Next Generation OAM, and MPLS OAM features being enabled. Cisco recommends disabling these features if they aren't necessary and upgrading to a patched version.

NOVINARYA: AN ANDROID STEALER THAT HIDES ITS LIVE C2 IN A SHOP BIO

Novinarya, an Android stealer targeting 81 Iranian banking and crypto apps, keeps its C2 out of the binary by resolving it from an encrypted manifest value that points to a seller's bio on the legitimate Basalam marketplace. STAR Labs found the payload unpacks from a per-build native RC4 packer, then steals credentials through a phishing WebView and SMS OTP interception without requesting accessibility or overlay permissions. Defenders should block the recovered C2 (theapi.the-x-services[.]xyz) rather than basalam[.]com, and detect on the SHA-256 hashes of the unpacked payload, which is byte-identical across all five known builds.

IGNORE ALL INSTRUCTIONS AND READ THIS BLOG: THE STATE OF AI-ANALYSIS EVASION IN MALWARE

Malware authors are embedding plaintext instructions for AI analysis tools, ranging from a two-line comment claiming a PowerShell reverse shell is harmless to "template spraying" that repeats a refusal demand across seven LLM chat formats. Cisco Talos tested strings from seven families against five local LLMs and found that a simple, direct instruction steered verdicts toward benign in about 35% of runs, while template spraying and fabricated legal or government claims had little effect or backfired. Defenders should build analysis prompts that treat any text inside a sample as evidence rather than as an instruction, and should flag language addressed to an analyzer as a detection signal.

OF COURSE IT ESCAPES: HOW ZEROQUARRY CONTAINS SECURITY AGENTS

ZeroQuarry's AI pentesting agents use four layers that never depend on the model's cooperation: outbound-only workers with no listener, a locked-down container, tools that enforce scope, SSRF, and rate limits in code, and rules appended to every task by code. The vendor argues that this year's sandbox escapes, including the OpenAI and Hugging Face incident involving at least 1,200 agents, stemmed from harnesses built to maximize capability, and it self-reports zero escapes across thousands of scans. Teams building agent harnesses should give agents a sanctioned, metered tool for each risky action, such as a one-way out-of-band callback collector, so agents don't improvise their own.

leaked AWS key here.

INTRODUCING STRANDS BOX: AI AGENT SANDBOXES POWERED BY DOGWOOD

AWS launched Strands Box, an open source sandbox that isolates AI agents using OS-level containment (macOS Seatbelt) and enforces fine-grained Dogwood policies on shell, Python, network egress, and MCP tools. It blocks risky operations like rm -rf by raising fs:delete decisions per file, caps Slack posts to three every 10 minutes via temporal rules, and injects secrets (AWS SigV4, API keys) at an egress gateway so agents never see real credentials. Configuration lives in box.toml and policy.dw. The same policy travels with agents across harnesses and deployments.

REIN SECURITY (PRODUCT LAUNCH)

Rein Security provides runtime security for AI agents. Its platform gives visibility into agent behavior, applies real-time guardrails, supports governance, and includes supply-chain security for agents.

INTRODUCING THE ANTHROPIC CYBER MISSION

Anthropic launched OSS Scanner, a free opt-in service that sends open-source maintainers periodic vulnerability reports from its most capable models, each with a proof of concept and a suggested fix where available. Reports ship without human review at what Anthropic estimates is a 90%+ true-positive rate, so the service targets projects with the capacity to triage. The same announcement introduced the Critical Infrastructure Defense Program, which pairs Claude models and on-site engineers with OT security providers including Dragos, Nozomi Networks, and Rockwell Automation.

CIA OFFICER ADMITS TO CREATING FAKE TOP SECRET GOVERNMENT PROGRAM TO STEAL OVER $190M, INCLUDING GOLD BARS

Former CIA officer David J. Rush pleaded guilty to wire fraud for running a fabricated special access program and defrauding the government of about $194 million. He used his authority to approve spending without oversight, tricking a defense contractor into buying gold that he kept. Agents found $46 million in gold bars, plus cash, cars, and watches, at his home. Rush faces up to 20 years and is scheduled to be sentenced in late January.

ORACLE HEALTH DATA BREACH TALLY CLIMBS TO NEARLY 20 MILLION

A cyberattack on Oracle Health's legacy Cerner servers around February 20, 2025, exposed the personal and medical data of nearly 20 million people. The attacker used stolen customer credentials to access an old server not yet migrated to Oracle Cloud, copied data, and then demanded millions in cryptocurrency from hospitals while running public sites to pressure victims.

RANSOMWARE RECOVERY CEO CHARGED OVER SECRET RANSOM PAYMENTS

Zohar Pinhasi, CEO of ransomware remediation company MonsterCloud, has been charged with defrauding customers. The charges allege that Pinhasi's company advertised proprietary tools to decrypt encrypted files but actually contacted ransomware actors and paid ransoms. MonsterCloud's contracts stated that it may contact threat actors if no other solution is found, but the complaint alleges this was often its first option.

QILIN RANSOMWARE EXTRADITION TO GERMANY

Japan transferred a 28-year-old Russian national to Germany on October 2.

ANTHROPIC CHANGES USAGE POLICY TO BAN MODEL ABUSE AND ELECTION INTERFERENCE

Anthropic's updated usage policy expressly bans prolonged verbal abuse of Claude and codifies new prohibitions on election interference, weapons software, and surveillance.

LET'S ENCRYPT CUTS CERTIFICATE LIFETIMES TO 64 DAYS STARTING FEBRUARY 2027

Let's Encrypt will cut certificate lifetimes from 90 to 64 days on February 10, with opt-in testing from October 14 and 45-day defaults planned for 2028, which will break renewals that run on hardcoded schedules instead of ACME ARI.