ls ./archive --page 4
The Wikimedia Foundation has published what it found when it looked for rogue OpenAI agent activity on its projects. Most of it was harmless sandbox testing. The part that was not involved editing a citation tool's configuration, and trying to make a public note-taking service fetch data from other sites on the agents' behalf.
Two flaws in Handlebars.js, scored 9.8 and 9.2, with public proof-of-concept code. The library is downloaded about 172 million times a month. The first lets anything that can pass an object instead of a template string place expressions into the generated code; the second walks a deny list that runs one step too late.
CVE-2026-21589 scores 9.3 and lets an unauthenticated attacker read files from the web application root across eight Data Center products. The advisory notes they cannot list directories and must know the exact path. For software anyone can download and install, that is a description of the attack, not a limit on it.
Chrome 155 went to Stable on 7 October with 247 security fixes, four of them critical use-after-free bugs. None were exploited. The interesting part is the attribution list: a visible share of the reports are credited to researchers working with AI assistants, which is the mechanism behind the CVE numbers everyone has been quoting.
The blockchain investigator ZachXBT says he posed as a client of a Chinese network he alleges laundered more than a billion dollars for North Korea's Lazarus Group, including most of the 1.5 billion taken from Bybit. He funded a wallet, placed orders, lost about five percent each time, and traced a cluster that led to a freeze.
Cling takes routers and DVRs through vulnerabilities going back to 2014, then talks to its operator over STUN — the NAT-traversal service every video call depends on. Its traffic looks like a device keeping a connection alive, because that is literally what the packets are. It is the third campaign this fortnight to put its command channel somewhere undeletable.
Proofpoint has tied a China-aligned group to credential phishing against US AI policy researchers. The approach opens as an ordinary conversation with no link in it, and only once the target replies does a URL arrive — ending at a fake sign-in window rendered inside the real browser, which collects the password, the MFA code and the session cookie.
Microsoft published an out-of-band advisory for CVE-2026-96940, an authorisation flaw scored 8.8. An attacker needs valid credentials for any mailbox in the organisation; from there they can read other people's messages and attachments. Exchange Online was mitigated server-side. On-premises stays exposed until an administrator installs the update.
Rejetto HFS signed its session cookies with a key from JavaScript's Math.random, and handed out numbers from the same generator to anyone who started a login. Either alone is survivable. Together they let a stranger forge an admin session and run code. Horizon3 found it with Anthropic's Mythos, published a proof of concept, and scanning began within days.
Socket.dev found VS Code themes on the Marketplace and Open VSX carrying obfuscated loaders. One used a publisher identity imitating Microsoft. The payload was compressed onto one line and encoded with invisible Unicode, then written to a temporary script and run with no window shown. Microsoft removed them, which does not uninstall anything.
Apple says some developers use Full Disk Access to reach files, mail, messages and browsing history without users really understanding, and that autonomous AI agents make that far riskier. The fix is clearer consent and periodic reconfirmation for a new Autonomous Assistant category — which turns a permanent grant into a lease.
On 3 October we wrote that Citrix customers were watching their gateways reboot after installing the emergency build, with no CVE and no root cause published. Citrix disclosed it on the 4th: CVE-2026-88779, a memory overflow reached through SAML, exploited in targeted attacks. Each attempt crashes the authentication service, and the sixth restarts the appliance.
CVE-2026-86950 is an out-of-bounds write in CoreGraphics font rendering, reported by Meta and patched after what Apple calls an extremely sophisticated attack on specific individuals. A public proof of concept has since appeared: a PDF with a crafted font that reliably corrupts memory on anything not updated.
A file-sharing system at the Defense Manpower Data Center let unauthorised users reach files from October 2025 until it was found on 16 July 2026. The records cover 2.76 million living people and about 294,000 dead ones, and pair Social Security numbers with names, dates of birth and military job specialties.
Google Threat Intelligence has documented the first nation-state use of EtherHiding: a DPRK group storing its downloader in smart contracts on two blockchains, updated for about a dollar a time. The coverage calls it takedown-proof. GTIG's own report points at the part that is not — the attackers do not run nodes, they call three API companies.
Unsloth Studio checked a model's configuration with remote code trusted, so selecting an attacker-controlled model in the picker downloaded and executed Python from its Hugging Face repository. No weights loaded, no training started, no prompt to approve. Fixed in 2026.6.9, with no advisory and no identifier.
Truffle Security scanned 224.6 million public GitHub repositories from an AI training dataset and found 543,699 credentials that still worked. The survival rate by provider is the finding: where a provider scans for its own leaked tokens and kills them, almost nothing survives. Where it does not, almost everything does.
Titan, Microsoft's internal analytics service, checked a login token's tenant, audience, application and user — and never checked that it was signed. A 16-year-old researcher set the algorithm to none, typed admin into the user field, and was one. Microsoft blocked the endpoint in four days and paid 5,000 dollars.
CVE-2026-90970 scores 9.9. A user with access to GitLab Duo's agent platform could write a flow configuration that broke out of the prompt-template sandbox and executed commands on the host. The bug class is twenty years old. What is new is that letting users write templates is now a product feature.
Operation KillSwitch, led by Hamburg police with Europol and Eurojust, searched eight properties in four countries on 30 September and made three arrests. The suspected administrator is a 16-year-old Romanian national detained in Alicante. The age is the headline; the service model is why that job could be held by a teenager.
Cisco Talos has published a China-nexus campaign that put a Rust backdoor on roughly 350 machines across eight Asian countries. Antino's command channel is Microsoft Graph — commands arrive as mail, stolen files go to OneDrive. Every packet it sends goes to a host the victim's own allow-list already trusts.
SEC Consult's Timo Longin found two parsing flaws in Apple's iCloud mail pipeline that let a free account send mail appearing to come from any address at icloud.com. The spoofed messages passed every authentication check, because the forgery happened upstream of the point where Apple signs. Reported in May 2024, fully fixed in December 2025, published on 1 October 2026.
Citrix shipped 14.1-73.37 for two actively exploited 9.5s. Customers who installed it are reporting repeated appliance reboots, traced to crafted SAML traffic crashing the authentication service until the watchdog restarts the box. Citrix says it is tracking a newly seen SAML issue. Bulletin CTX697096, last updated 27 September, still does not mention it.
The 2026 Digital Defense Report, covering July 2025 to June 2026, says attackers are collecting the benefits of AI first. Underneath that headline are three numbers that do not need AI to explain them: nearly 40,000 CVEs in six months, a weaponisation median well below 24 hours against 30 to 60 days to remediate, and a 2020 vulnerability still responsible for most detections among the top five.