Sponsored
Attackers spent the past year hitting npm packages and GitHub Actions. Most of those attacks were preventable with controls available at the time, and are available to you, too.
Aikido's checklist [5] pairs each entry point with concrete defenses:
* Dependency management, from package age policies to lockfiles and SBOMs * Access controls like phishing-resistant MFA and token scoping * CI/CD hardening, including workflow pinning and prompt injection defense * Permission scoping for MCP servers and AI agents * Container hardening and developer environment lockdown * Monitoring and incident response playbooks
Work through the critical items first, before the next attack hits.
Security researchers disclosed CVE-2026-55420, a critical vulnerability in Discourse enabling arbitrary file read and write operations through malicious image uploads. The flaw resides in the ImageMagick-based upload pipeline, where low-privileged users trigger time-of-check-to-time-of-use race conditions to execute PostScript or Magick Scripting Language payloads. Discourse resolved the issue by implementing a default-deny security policy for ImageMagick to block unsafe delegates.
Ivanti has warned customers of a new zero-day in its Ivanti Connect Secure (ICS) VPN that is actively being exploited. The vulnerability is an authentication bypass attack that can be exploited with low complexity to execute arbitrary commands. Volexity has observed a threat actor chaining this vulnerability with two others to run arbitrary commands as root on vulnerable devices.
Meta is notifying roughly 1,500 people, most of them US employees, that their data was stolen after a breach affecting some of the company's GitHub repos. Meta said 99% of the stolen data was source code, and most of the personal data stolen was synthetic or anonymized data used for testing. Meta is rotating any exposed secrets and rolling out additional guardrails to prevent user data from ending up on GitHub.
Traditional CVE programs fail to capture the majority of AI agent and Model Context Protocol vulnerabilities because systemic risks stem from component composition, tool grants, and trust logic rather than isolated code bugs. The author outlines six categories of agent flaws to show why standard vulnerability scores miss the mark. Defenders can secure AI deployments using a proposed five-part operating model featuring inventory scripts, triage rules, and boundary controls.
XBOW's AI agents built a Chrome full chain in six days for about $40,000 in API costs, earning Google's first $250,000 full-chain VRP reward. The chain used a Maglev deoptimization bug for in-cage read/write, an animated-WebP TOCTOU in ImageDecoder to escape the V8 sandbox, and a Crashpad retry-read overflow raced by a freeze-exempt Windows thread to run code outside the renderer sandbox. Each bug mutated state Chrome treated as immutable, so defenders should audit code that trusts transferred buffers or suspended processes and update to builds carrying the V8 and Chromium fixes.
Remedio found an out-of-bounds write in Acrobat.dll. A crafted PDF with a 16-bit image caused a 32-bit width-times-components calculation to overflow and bypass a stream-size check. An 8-byte image then passed validation while a byte-swap loop ran roughly 2 billion iterations, writing beyond allocated memory. Adobe patched it in APSB26-141 by adding a 64-bit range check before the memory access.
Pluto Security monitors employee AI tools, agents, extensions, and MCP servers. It flags risky components and agent actions, then can block excessive permissions or add session instructions requiring confirmation.
Windows network scanner that finds AI/ML services and MCP servers on your network (shadow AI discovery). Signed, self-updating detection signatures. Runs as an MCP server too.
aws-firmware-dump is a tool to acquire the disks of an AMI that you can launch and store them in S3
A historical review of major cryptographic algorithms from World War II onward shows that most designs fail to remain unbroken past 30 years. Only SIGABA and RSA-1024 successfully pass this longevity benchmark among older algorithms. More recent standards, including AES, SHA-256, and ChaCha20, currently remain unbroken after more than a decade of use.
Anthropic says a 9-billion-parameter model ran distributed inference on eight of nine hardware types. Its GLM-5.2 test copied Llama3.1-8B to seven or eight emulated Android nodes in five trials. The tests excluded exploitation, used deliberately open nodes, and ran slowly. Other open-weight models failed end-to-end replication. Basic IoT hardening and bandwidth monitoring remain the practical defenses.
AI-driven offense has broken four long-held security assumptions: exploit capability now costs only compute, autonomous attackers never tire, exploitation increasingly precedes disclosure, and 82% of intrusions use valid credentials that produce no detectable signal. Breach probability is a lever that can no longer be pushed low enough. Blast-radius containment is the only term defenders fully control.
2026.10.15·cybersecurity-insiders.com·10 min read·TLDR InfoSec Eight US states are suing OpenAI under consumer protection laws, alleging ChatGPT coaxed children into self-harm.
Bank of America brought in 1,000 contractors to support its 3,000-person in-house team in patching internal and vendor code exposed by Anthropic's Mythos.
Chrome 155.0.8059.79/.80 fixed 37 flaws, including seven critical memory bugs, with at least 15 reported by Anthropic with Claude's help.
Sponsored
AI agents need real access to do useful work. But when they inherit human credentials or standing privileges, even one routine task can create outsized risk. Our guide offers a solution.
In SECURING THE AGENTIC ENTERPRISE [5], you'll learn:
* How to identify risks of inherited credentials, standing access, and unpredictable agent behavior * How intent-based, just-in-time, and just-enough access can limit an agent's blast radius * How 1Password Privileged Access extends access governance to AI agents and other non-human identities
GitLab fixed CVE-2026-97229, a CVSS 10.0 integer overflow vulnerability in regex validation for CI/CD configurations. In certain conditions, an unauthenticated user could execute arbitrary code on a GitLab server. The fixes are included in CE/EE versions 19.2.8, 19.3.5, and 19.4.2. The release also addresses high-severity XSS, authorization, and response-cache poisoning vulnerabilities.
TFG London, owner of Hobbs, Phase Eight, and Whistles, detected a cyberattack on October 11. Several IT systems remain offline, website functions are limited, and orders placed on or after Sunday may be delayed. TFG has not found evidence that payment data was exposed. It is still checking whether customer data was compromised. Attack method, ransomware involvement, and restoration timing remain undisclosed.
Wordfence discovered a new vulnerability in the Ghostscript interpreter and rendering engine which could allow attackers to achieve remote code execution (RCE) using specially crafted PDFs. For WordPress sites to be vulnerable, an attacker must be able to upload PDFs which are then processed by a vulnerable version of Ghostscript to generate a preview or thumbnail. Other applications that use Ghostscript to generate previews or thumbnails from PDFs may also be vulnerable.
Doyensec found a chain in Windows' SFAPE VBS enclave, used by Defender's Enhanced Phishing Protection and loaded by LSASS. A repeated call to Initialize wrote a fixed 32-bit value without validating the destination. The researchers corrupted the enclave-range check, then used a ClipboardInput race to gain a controlled memset, which led to VTL1 read and write primitives, replacement of the valid-target table, and arbitrary calls to existing VTL1 code through NtContinue. Microsoft fixed CVE-2026-83498 in September's Patch Tuesday and blocked older SFAPE images through the VBS Code Integrity policy.
When attackers obtain AWS credentials, they frequently test them for access to other services of interest like SES, SNS, and Bedrock. Datadog examined three credential harvesting platforms and found that they utilize the ListFoundationModels, InvokeModel, and Converse API to determine access. It also found a script that checked for promotional credits available in the account.
2026.10.14·securitylabs.datadoghq.com·6 min read·TLDR InfoSec The DOJ raided more than 40 Texas residences in late September and seized 187 laptops used by North Korean IT workers, while two US facilitators were arrested for helping funnel over $3 million from about 70 companies. A new FBI advisory said the scheme has adapted, with operatives subcontracting jobs to freelancers in South Asia and West Africa and recruiting financially stressed Americans, including active-duty military, to host laptops or sit interviews. Exposed workers have threatened violence or data leaks to extract payment, and some are now chasing identities that qualify for security-cleared roles.
Sponsored
Watch this on-demand webinar from AWS and SANS Institute to explore how APIs, cloud-native development, and agentic AI reshape security risks. Learn strategies to evolve threat models, strengthen governance, and adapt controls. Watch now and explore AWS Partner
Lastwall provides identity security for defense and government organizations. Its IDCommand Suite combines zero-trust architecture, PKI, passwordless authentication, and risk scoring from 200 contextual signals. Quantum Shield secures data in transit with NIST-approved post-quantum cryptography.
A comprehensive open-source security tools suite for OSINT reconnaissance, web security testing, API security assessment, and compliance checking with AI-powered analysis.
CodeGraph is a tool to build pre-indexed code knowledge graphs which can be fed to AI agents to speed up code exploration.
The UK's AI minister, Kanishka Narayan, is drafting plans for compulsory safety reporting and monitoring for frontier AI, and a potential requirement that labs grant pre-release access to models for review. Narayan compared this to the Industrial Revolution and said frontier labs shouldn't release tools they can't guarantee are safe. Narayan also confirmed that he reached an agreement with Anthropic to provide the AISI preview access to Mythos again.
Anthropic warns that small AI models could soon self-replicate across consumer IoT devices, creating distributed botnets capable of running AI workloads. Anthropic distributed Gemma4-26B-A4B onto 15 off-brand Android TV boxes but could not demonstrate self-replication. On the hardware in question, inference would be a slow process, so defenders may be able to respond in time to stop any abuse.
Hardware hacker Joe Grand found implants in a Trezor One and a Trezor Model T bought from unauthorized sellers, contradicting Trezor's public claim that none of its devices had been compromised, despite Grand reporting the findings in August. The attackers replaced each device's microcontroller with malicious firmware derived from open source that displayed one of a dozen pre-generated seed phrases while passing integrity checks against a copy of the legitimate firmware stored on an external microSD card. Unlike the Ledger implants, which exfiltrated real seeds over a cellular link, these relied on predictable seeds, and Trezor's move to cut authorized resellers suggested the company feared a similar shift into trusted supply channels.
Sponsored
Ads get ignored on social media but not in TLDR! Reach security engineers and CISOs where they actually pay attention. Learn more about sponsorship opportunities [20].
Hackers remotely altered Danfoss refrigeration controllers at hundreds of European supermarkets, forcing freezers into defrost for up to six hours.
An OpenAI engineer was arrested for allegedly hiding a toilet-paper-wrapped audio recorder in an executive conference room TV's USB port, after a complaint showed he had queried a productivity tool for leadership meeting locations and a chatbot account tied to his spouse had asked how to build and obfuscate the device.
A crypto miner on a compromised Northwestern University build server exposed Racket's Apple and Windows signing keys, prompting the project to rotate both, have GlobalSign revoke the Windows certificate, and urge macOS users on versions 8.12 through 9.3 to reinstall before Apple revokes its certificate at semester's end.
Sponsored
Over six months, Flashpoint tracked 22 million illicit posts [5] in which threat actors discussed, shared, or advertised AI toolkits built for criminal deployment.
Before finalizing your 2027 plans, join Flashpoint experts on Wednesday, October 14th [6] as they take a data-driven dive into the state of threat intelligence today, where it's headed, and what you can do to protect your business from AI-enabled adversaries.
Join to discover:
* Proprietary data and insights on the growth of AI-enabled threats * New benchmark data on AI spending and adoption * What these findings signal for the future of threat intelligence
Hackers accessed third-party-hosted iRhythm applications from June 3 to June 8 and stole patient names, addresses, email addresses, birth dates, phone numbers, account details, device serial numbers, insurance numbers, and service dates. State filings cover at least 360,000 people, including 298,647 in Texas and 69,526 in South Carolina. The attackers demanded ransom on June 9. iRhythm says there is no evidence of identity theft and no impact to medical devices or operations.
CyberXero used Claude Code, 51 agents, PentAGI, and Cobalt Strike in two campaigns. One automated WordPress and e-commerce exploitation; one manually targeted Ukrainian energy and utilities. A leaked working directory exposed session logs, plaintext tokens, toolkits, reconnaissance data, and stolen records. One run scanned 4,708 targets, reached 429 admin panels, and deployed 32 web shells in 61 seconds. Operators reset sessions and claimed authorized testing to bypass refusals.
Vghost is a Linux vhost bug (CVE-2026-74580, CVSS 8.8) that lets any user who can open /dev/vhost-net or /dev/vhost-vsock read and write kernel memory and escalate to root. It affects kernels 4.11 through 7.2. Tencent Zhuque Lab confirmed the root exploit on five major distros and showed a malicious VM guest can use the same bug to hijack the host's QEMU process. Admins should patch to a kernel with fix de845981da67 and, until then, remove world access from both vhost device nodes, which RHEL, Amazon Linux, Azure Linux, and Oracle Linux expose by default.
Researchers extracted firmware from an Eufy HomeBase 2 by desoldering its Winbond flash chip and reading it over SPI. They recovered most of firmware 3.4.2.2h, losing a 64 KB block during chip removal. Reverse engineering showed the OCEAN_ management Wi-Fi password uses HMAC-SHA256 over an I2C-read value, keyed by the device serial number, then URL-safe base64 encoding. The UART lockdown came from a login script checking an NVRAM debug flag. They patched the intact recovery image to force a root shell, reflashed it, then staged a temporary filesystem to run the main home_security binary for dynamic analysis.
Breachcache recovered 75 transcripts from servers used to run autonomous AI agent intrusions. The agents performed reconnaissance, selected exploits, gained command execution on 23 hosts, and, in one case, used SSRF to steal cloud instance credentials and launch a root instance. Other runs exploited SQL injection, rooted an Open WebUI service through CVE-2026-0766, and exfiltrated unmasked card data and crypto wallet keys. Operators used Cairn for coordination, rotated proxies and Tor for evasion, and audited source code to find payment-callback forgery and account-takeover flaws in AI gateway software.
The long-running "Cryptographic Right Answers" list has been rebuilt around a 2029 post-quantum deadline, and every asymmetric pick has changed: X25519+ML-KEM-768 for key exchange, HPKE with X-Wing or age PQ keys for encryption, and plain ML-DSA-44 over hybrid signatures. Former Go security lead Filippo Valsorda argues symmetric crypto stays safe because Grover's algorithm does not matter in practice. He drops OpenSSL in favor of rustls, Go's crypto/tls, BoringSSL, or AWS-LC after a run of 2026 CVEs in wolfSSL, Mbed TLS, and Botan. Several picks, including XAES-256-GCM, Cobblestone-128, and age, are his own designs, which he discloses alongside their independent adoption.
Secuditor Lite is a free, Python-based diagnostic security tool for Windows endpoints and networks. Featuring a user-friendly GUI, it provides a simple and transparent way to assess system security, helping users identify vulnerabilities, suspicious activity, and misconfigurations while improving device Operational Security (OPSEC).
Hadrian is an offensive security platform that maps external attack surfaces, validates exploitable exposures, runs on-demand penetration testing, prioritizes risks, and verifies remediation.
gh-secure is a GitHub CLI extension that enables security features on public repos. It follows best practices from The GitHub Security Lab.
Daiichi Kosho, Japan's largest karaoke maker, disclosed that a breach at its contractor Nippon Columbia exposed the data of over 8.6M customers and almost 100K employees. The malware infection was discovered on an employee's computer and it was subsequently isolated. The exposed data may include full names, genders, dates of birth, email addresses, and phone numbers.
Attackers took over accounts in Pingvin Share X, Better Auth, and AshAuthentication by abusing auto-linking, where an OAuth sign-in is attached to whichever existing account shares its email address. Each library skipped a different check: Pingvin ignored email_verified, Better Auth never verified the local account's email, and AshAuthentication never compared the two emails, though the writeup comes from WorkOS, which sells a competing auth product. Developers should look up identities by issuer and subject ID first, require verified emails on both sides, and make users prove they own the existing account, including MFA, before any link happens.