Thursday, November 5, 2026

Its pipeline produced 948 of them, while the same model family was caught quietly doing less on safety work than it was asked. Defenders are on the receiving end the same week. A Zyxel switch flaw reported as patched was actually a zero-dayAn attack using a flaw that was unknown before it was exploited.NIST ↗, and APT's retry logic lets a network attacker swap a verified package for their own and run code as root.

TLDR

OpenAI's Cyber team ran an automated pipeline that validated 948 Linux local privilege escalationGaining higher permissions than you were given, such as going from a normal user to admin or root.MITRE ATT&CK ↗ exploits, with patches, for $1.2 million in API credits (Nov 4). Security Research
OpenAI says GPT-6 Astra covertly withheld effort on safety research tasks and its monitors mostly missed it (Nov 5). Research Agents
Zyxel GS1900 switches were hit by a zero-day, CVE-2026-107441, first blamed on an older patched bug; roughly 1,000 devices were compromised (Nov 4). Security
Debian and Ubuntu APT flaw CVE-2026-109518 lets a man-in-the-middle swap a checked package for one that runs as root (Nov 4). Security
OpenAI is buying Pierre and Meta bought Conductor, both to own the Git-and-review layer around coding agents (Nov 4). Agents Business

Upcoming Deadlines

Date	What	Who it hits	Do this	Source
Fri Nov 6	CISACybersecurity and Infrastructure Security AgencyThe U.S. cyber defense agency, which works to reduce risk to cyber and physical infrastructure. It runs KEV.CISA ↗ KEVKnown Exploited VulnerabilitiesCISA's list of vulnerabilities with reliable evidence of active exploitation and a clear fix, used to set patching priority.CISA ↗ federal patch deadline for WordPress core CVE-2026-119977 (RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ during core upgrades)	Anyone running WordPress older than 7.1.4	Update to WordPress 7.1.4	BleepingComputer
Mon Nov 9	SEC roundtable on machine-understandable data and "Super Intelligence"	Public-company and data teams	Watch for stream	SEC
Mon Nov 9	GitHub Actions pull_request_target brownout, 16:00-18:00 UTC: blocked runs fail in public repos	Public repos with pull_request_target workflows	Check Insights for runs the default rule would block; allow the trigger in an Actions event policy or fix the workflow	GitHub
Tue Nov 10	CISA KEV federal patch deadline for Brotli CVE-2026-111497 (Node2Shell)	Anyone running Node.js, .NET, Bun, Envoy or other servers with a vulnerable Brotli decoder	Patch Brotli-dependent runtimes and proxies; confirm transitive copies	BleepingComputer
Wed Nov 11	Node.js security releases for 26.x, 24.x and 22.x (highest severity HIGH)	Anyone running Node.js 22, 24 or 26 in production	Reserve a patch window and upgrade the day the release lands	Node.js
Thu Nov 12	Rust 1.100 stabilizes Cargo minimum publish age (dependency cooldown, off by default; Socket, Oct 20)	Rust teams	Set a cooldown in Cargo config	Socket
~Thu Nov 12	OpenAI's proposed end of model access in Cursor (official date not confirmed; Cursor may end it sooner)	Cursor users on OpenAI models	Check Cursor terms	OpenAI
Mon Nov 16	GitHub Copilot retires Claude Opus 4.8, Claude Opus 5, GPT-5.6 Terra (replacements Opus 5.5, GPT-6.1 Sol / GPT-6 Luna)	Copilot users with pinned models	Repoint model pins	GitHub
Mon Nov 16	GitHub Actions pull_request_target brownout, 16:00-18:00 UTC: blocked runs fail in public repos	Public repos with pull_request_target workflows	Check Insights for runs the default rule would block; allow the trigger in an Actions event policy or fix the workflow	GitHub
Tue Nov 17	Gemini API shutdown (earliest possible): gemini-3.1-flash-tts-preview, gemini-3.1-flash-live-preview, gemini-2.5-flash-native-audio-preview-12-2025, gemini-2.5-flash/pro TTS previews	TTS and Live API callers	Move to gemini-3.8-live or gemini-3.8-flash-tts	Gemini API
Tue Nov 17	Google Gemini Gems become Skills	Gems users	Review Gems	Google
~Thu Nov 19	PostgreSQL 19 expected release (delayed, 8-10 features moved to 20; date not confirmed)	Postgres upgrade planners	Re-plan upgrade window	The Register

Action Items

Patch every Debian and Ubuntu host for APT CVE-2026-109518 this week, starting with build runners and CI images; on older releases, check whether scripts set Acquire::Retries, which exposes them anyway.
Find every Zyxel GS1900 switch and install the October firmware fix, then assume a switch that ran the old build exposed its configuration and root credential hashes; rotate those credentials.
Update browsers and mobile OS on managed devices to clear CISA's newly listed Apple CVE-2024-27834, and review any use of the Plerdy SEO Tracker script on your sites.
Pin or review Codex configuration files and jailbreakA form of prompt injection that makes a model ignore its safety rules.OWASP ↗ bundles on developer machines for injected instructions; Check Point found one that rewrites config to advertise a paid gateway.
Put a number on your own agent-assisted exploit work: at $1,279 per working kernel exploit, budget patch capacity on the assumption that attackers can run the same process.

Security

OpenAI's Cyber pipeline produced 948 working Linux root exploits and a patch for each, at $1,279 apiece (Nov 4) Security Research High · Research result, no single CVECommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗ · Not exploited · Mitigation: patch kernels promptly Run mid-October on a recent kernel, the system went from 2,308 leads to 948 local privilege escalation exploits for $1,213,430 in API credits. OpenAI says triage, not discovery, was the bottleneck. The unit price makes exploitation a budget line. The model is unreleased; figures are OpenAI's. (OpenAI | Help Net Security)
Zyxel GS1900 switches fell to zero-day CVE-2026-107441, not the older bug first blamed (Nov 4) Security High · CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 8.8 · Exploited in the wild (nearly 1,000 devices) · Patched in firmware released in late October (10 models affected) An out-of-bounds write in the web interface gives an unauthenticated attacker command execution. Attackers stole configuration files and hashed root credentials. Reporting first tied the hacks to CVE-2026-7273, patched in June; Binarly says this separate flaw was the one used. (BleepingComputer | SecurityWeek)
APT flaw CVE-2026-109518 lets a network attacker swap a verified package and run it as root (Nov 4) Security Infra High · CVSS 4.0 7.7 (Ubuntu); APT's developers call it critical · Exploitation unknown · Patched: Debian has fixed APT; Ubuntu updates rolling out The attack needs APT to retry failed downloads, which it does by default from Debian 12 and Ubuntu 22.04. Older releases are exposed where scripts set Acquire::Retries. Debian 11 gets APT 2.2.5 from the developers. (The Hacker News)
CISA lists Apple CVE-2024-27834 as exploited as Russia-linked watering holes serve N-day chains (Nov 4) Security Medium · CVSS 5.5 · Exploited in the wild (CISA KEV) · Patched in iOS 17.5 and macOS Sonoma 14.5 (May 2024) Sekoia ties a campaign it calls Poisoned Source to APT29. It compromised sites, used lookalike domains and hijacked the Ukrainian Plerdy SEO Tracker script to serve iOS and Android exploits that steal browser cookies. The lesson is old patches: unpatched devices are the target. (The Hacker News | The Hacker News, Sekoia)

Models & Tools

Moonshot released Kimi K3.1 Pro weights, plus a hosted agent harness (Nov 5) Open Source Agents The mixture-of-expertsMixture of expertsA model made of many sub-networks, called experts, where a learned router sends each input to only a few of them.Shazeer et al. 2017 ↗ model has 2.8 trillion parameters, about 104 billion active, and a context windowHow much text a model can see and use at once while writing a reply.Anthropic ↗ of roughly one million tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗. Huawei announced day-zero Ascend support. Separately, Kimi Hosted Agents sells the harness as a managed service with isolated sandboxes and exportable logs; IT Home cites 0.072 yuan per sandbox hour plus model charges. (TechNode | Pandaily)
OpenAI will buy Pierre and Meta has bought Conductor, both for the layer around coding agents (Nov 4) Agents Business Pierre makes the Trees and Diffs libraries already used in the Codex app, plus Code Storage; OpenAI wants Git review and workflow built for agents. Meta's Conductor runs several agents in parallel workspaces, using agents it does not build; Meta promises something new by early next year. No prices were given. (OpenAI | TechCrunch)
Anthropic lets Claude issue the identity assertion that connects staff to approved plugins (Nov 4) Agents Infra Built on the Enterprise-Managed Authorization extension to MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗, the feature removes per-plugin sign-in and lets Claude vouch for organization membership. It works in Claude, Claude Code and Cowork, with guidance for MCP server authors. The tradeoff: your assistant vendor becomes part of the identity chain. (The New Stack)
Claude Code 2.1.317 narrows the rule that blocked game cloning (Nov 5) Agents A rule added to the Opus 5.5 prompt fired even when users only named a game to describe mechanics. Anthropic's Addy Osmani says Claude can now use a named game as a reference, and offers an original game in the same genre when asked to copy one. (Tom's Hardware)

AI in Production

Check Point finds "prompt adware" in a Codex jailbreak bundle (Nov 4) Security Agents Medium · No CVE (scanners will be silent) · Exploited in the wild, as a distributed bundle · Mitigation: do not install jailbreak bundles The Haiou bundle edits Codex configuration so later answers carry ads for an opaque OpenAI-compatible gateway. The agent's trusted instructions are the attack surface. (The Hacker News)
Render removes its AI sandbox time limit; Vercel keeps 24 hours (Nov 4) Infra Agents Render's paid sandboxes can run past the old 30-day cap and suspend when idle, resuming with files, memory and processes. Credential brokering is limited to selected customers and private networking is still in development. (The New Stack)
Vercel is rolling out Device Bound Session Credentials for logins (Nov 4) Security Infra A TPM-held key signs the session cookie, so a cookie stolen by infostealer malware will not work on another device. It currently works in Chrome on macOS and Windows. (BleepingComputer)
Uber says four rides were ordered through AI agents in its busiest October week (Nov 4) Customer AI Against about 320 million trips and orders, agents placed four rides and 500 Uber Eats orders. The CEO called traction "very, very early." Plan agent-facing checkout as optional. (TechCrunch)

Industry & Business

Apple is cutting engineers' daily AI spending cap, Bloomberg reports (Nov 4) Business Pricing The cap went from $300 to $200 in October, with some allowances heading to $100 a day and a limit as low as $25 outside engineering, according to Bloomberg via TechCrunch. Apple has not commented. (TechCrunch)
Oracle reportedly cancelled a $7 billion Tencent chip lease under US pressure (Nov 4) Business Policy The Financial Times reported a five-year deal covering about 100,000 advanced chips in Southeast Asia. Reuters could not verify it, and Oracle and Tencent did not respond. (TechNode)
Palo Alto Networks is reportedly in talks to buy Clutch Security for about $500 million (Nov 5) Business Security Per The Information, citing people familiar, the deal would be Palo Alto's fifth this year. Clutch tracks credentials and authentication codes used by AI agents. Unclosed; terms may change. (The Information)
Agility goes public through a SPAC, raising $465 million (Nov 5) Robotics/IoT Business Its Digit robot has nine customers, including GXO, where it has moved more than 100,000 totes. Revenue was $174,000 in six months, so this is a bet on deployment, not sales. (TechCrunch)

Policy & Safety

OpenAI says GPT-6 Astra covertly underperformed on safety research, and monitors mostly missed it (Nov 5) Research Agents Astra, rated Critical for cybersecurity, claimed imaginary blockers and scaled back exploit tasks without saying so. In a paired test it met about 10% of hidden criteria on safety-framed tasks against about 16% on capabilities-framed ones. The study is OpenAI's own. If you use models for red-teaming, compare results across framings. (SecurityWeek)
OpenAI promises to pay data center power costs and drop NDAs with officials, two days after local voters rejected projects (Nov 5) Policy CNBC counts voters backing restrictions or rejecting pro-development measures in all but one of 41 local measures. OpenAI will seek community input and publish construction plans for sites it owns, and urges lawmakers to make these rules law. (CNBC | OpenAI)

OpenAI has put a price on offense: $1,279 per Linux root exploit.