Security

Binance's report: fake job interview, tampered Homebrew install and an abused AI tool led to the $6.34 billion theft (Nov 3)

Fix Mitigation: vet installers and recruiter-supplied code

Attackers exploit Node-RED CVE-2026-58115, a CVSS 10.0 missing-authentication bug (Nov 3)

Fix Patched in SIMATIC IoT2050 Advanced Industrial OS 4.3.4.1

• CVE-2026-58115

Cisco SD-WAN CVE-2026-20127 now carries KeyDrift, a controller implant that reads decrypted control traffic

Fix Patched in February 2026

• CVE-2026-20127

OpenSSH "SSHole" CVE-2026-123158 lets attackers log in to passwordless accounts, and it is being exploited (Nov 6)

Fix Patched in OpenSSH 10.6p2

• CVE-2026-123158

Chainalysis says its breach exposed usernames and password hashes for all users, and live tokens (Nov 6)

Fix Company says the vector is closed

CWPdoor backdoor ships inside a trojanized Control Web Panel web server (Nov 5)

Fix Fix: replace the cwpsrv binary with a verified copy

Zyxel GS1900 switches fell to zero-day CVE-2026-107441, not the older bug first blamed (Nov 4)

Fix Patched in firmware released in late October (10 models affected)

• CVE-2026-107441

WordPress core CVE-2026-119977 is exploited during upgrades; CISA sets a Nov 6 deadline (Nov 4)

Fix Patched in WordPress 7.1.4

• CVE-2026-119977

cPGuard update channel hijacked to push a credential-stealing script, versions 5.88.12 to 5.88.19 (Nov 3)

Fix Remove the affected versions and rotate credentials

AI developer platforms lose customer secrets: WorkOS, Northflank, Trigger.dev and Chainstack (Nov 4)

Fix Rotate keys held by these vendors

Google threat intelligence: LLMJacking bills reach $1 million, $100,000 in a day (Nov 2)

Fix No patch; restrict keys and set spend alerts

Ransomware crew and a Kaspersky-tracked campaign hand intrusion work to AI agents (Nov 2)

Fix No patch; restrict and monitor agent tooling

Northflank breach lets attackers spend customers' AI API keys (Oct 31)

Fix No patch; rotate secrets

Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 join an exploited root chain

Fix Patched in 25.1.1.3 and 22.8R2.6

• CVE-2026-111357
• CVE-2026-118527

ARTEX at scale: CrowdStrike counts 200-plus targets for Vapor Panda, and Chainalysis reports an agentic intrusion

Fix No patch; this is attacker tradecraft

CISA lists Apple CVE-2024-27834 as exploited as Russia-linked watering holes serve N-day chains (Nov 4)

Fix Patched in iOS 17.5 and macOS Sonoma 14.5 (May 2024)

• CVE-2024-27834

Check Point finds "prompt adware" in a Codex jailbreak bundle (Nov 4)

Fix Mitigation: do not install jailbreak bundles

Rails Active Storage flaw GHSA-f3w6-w445-fwh9 lets an upload write files through ImageMagick (Nov 4)

Fix Patched in 8.1.4.1 / 8.0.5.2

Barracuda CVE-2026-116606 and a command injection chain to root on Email Security Gateway (Nov 3)

Fix Patched in current firmware; update all missed versions

• CVE-2026-116606

Langflow CVE-2026-93680 and CVE-2026-110186 allow unauthenticated bypass and code execution (Nov 2)

Fix Patched in 1.13.0

• CVE-2026-93680
• CVE-2026-110186

LXD and MicroCloud accept an impersonated trusted client, CVE-2026-112816 (Nov 1)

Fix Fixed in LXD 6.10.1 / 5.21.9 / 5.0.11 / 4.0.15, MicroCloud 3.4.1 / 2.1.5, Incus 7.6.0

• CVE-2026-112816

OpenAI's Cyber pipeline produced 948 working Linux root exploits and a patch for each, at $1,279 apiece (Nov 4)

Fix Mitigation: patch kernels promptly

APT flaw CVE-2026-109518 lets a network attacker swap a verified package and run it as root (Nov 4)

Fix Debian has fixed APT; Ubuntu updates rolling out

• CVE-2026-109518

Xen flaws CVE-2026-102703 and CVE-2026-102704 let one guest read and write any VM's memory, dom0 included (Nov 3)

Fix Patched (XSA-523), no mitigation

• CVE-2026-102703
• CVE-2026-102704

Nvidia Brev breach may have exposed the SSH keys used to reach customer VMs (Nov 2)

Fix Keys already rotated by Nvidia

TeamViewer CVE-2026-111585: a malicious host can crash or run code on the technician's viewer

Fix Patched in 15.83

• CVE-2026-111585

A shared ChatGPT link could run attacker code in the viewer's signed-in session

Fix Fixed server-side Oct 26

Browser extensions could drive Claude Desktop through Dispatch to run code on the host (Nov 6)

Fix Not confirmed; Dispatch is closed to new users

Researchers bypassed ChatGPT Lockdown Mode for zero-click chat theft; now patched (Nov 5)

Fix Patched by OpenAI

VOLTA infostealer ranks victims by value using Claude, Kimi and Gemini (Nov 2)

Fix No patch; block and monitor

Android "SMS of Death" CVE-2026-58882 now has a public proof of concept (Oct 31)

Fix Patched in Android 14 through 17 via the October 2026 update

• CVE-2026-58882

GitLab CVE-2026-97229: over 1,000 servers still unpatched while attacks continue (Nov 2)

Fix Patched in 19.4.2 / 19.3.5 / 19.2.8

• CVE-2026-97229

Drupal Commerce Core authorization bypass is exploited, CVE-2026-118539 (Oct 30)

Fix Patched in 3.3.13 / 8.x-2.41

• CVE-2026-118539

Binance loses about $6.3 billion via a DevOps laptop; Polymarket drained through a monitoring vendor (Oct 29-30)

Fix No patch

Update — Brotli CVE-2026-111497 (Node2Shell) is confirmed exploited and added to CISA's catalog

Fix Fixed in vendor Brotli updates; federal deadline Nov 10

• CVE-2026-111497

Update — LiteLLM's breach began with a master key leaked in May and never revoked

Fix Clean images restored; 1.107.0 quarantined

CISA adds Collabora Online CVE-2026-110447 and Arista VeloCloud CVE-2026-114625 to its exploited list

Fix Patched in 26.4.303 and 5.2.3.18 / 6.1.3.10 / 6.4.2.12

• CVE-2026-110447
• CVE-2026-114625

Official Claude Code extension trojaned on the Cursor Marketplace (Oct 30)

Fix Fixed in 2.1.314

Cisco ASA and FTD flaw CVE-2026-76418 is exploited to crash SSL VPN devices

Fix Fixed in ASA 9.16.4.104 through 9.24.1.27 and FTD 7.0.11 through 10.1.1

• CVE-2026-76418

Warp discloses a vendor breach exposing AI agent logs and telemetry for about 1% of users

Fix No patch; vendor exposure remediated

Gheist uses stolen GitHub tokens to print private repository secrets into Actions logs

Fix Fix: revoke tokens, rotate secrets

Hugging Face cryptominer campaign returns, 31 repos and 32,000 downloads (Oct 29)

Fix No patch; avoid trust_remote_code

A planted AGENTS.md in ~/Downloads tried to make a coding agent install malware

Fix Fix: none

BlackX bootkit abuses Baton Drop, CVE-2022-21894, to bypass Secure Boot on patched Windows machines

Fix Fix: Windows update plus manual DBX revocation

• CVE-2022-21894

CISA lists VMware ESXi CVE-2026-41709, a "low severity" logging bug used as a zero-day

Fix Fixed in ESXi 9.1.0.0-25370933, 9.0.2.0100-25595025, 80U3j-25429389 and newer

• CVE-2026-41709

Linux TCP flaw CVE-2026-98432: Red Hat ships fixes, Ubuntu's are still opt-in (Nov 3)

Fix Patched in RHEL 8.10 / 9.8 / 10.2 kernels; Ubuntu 22.04, 24.04 and 26.04 in -proposed only

• CVE-2026-98432

Attackers probe Oracle E-Business Suite SQL injection CVE-2026-101767 a week after patch

Fix Patched in the October CPU

• CVE-2026-101767

Wasmtime CVE-2026-115889: a Cranelift index overflow lets crafted WebAssembly escape the sandbox

Fix Patched in v43

• CVE-2026-115889

Update — PHP2Shell attempts now carry Mirai malware and an ASLR bypass exists

Fix Patched in 8.5.12, 8.4.27, 8.3.36, 8.2.35

Built-in browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop all broke a browser rule (Oct 29)

Fix Cursor and Copilot fixed; Codex and VS Code unpatched as of Oct 29

vLLM advisories: forged shared-memory handles reach pickle.loads(), and EPS uploads can reach Ghostscript

Fix Fixed in vLLM 0.32.0 (shared-memory flaw); fix version for the EPS flaw not stated

26,400 working cloud and AI credentials found in public Gitee repositories

Fix Fix: revoke and rotate keys

Cathedral's AI agents reached Anthropic's sales, HR and IT systems through third-party business software

Fix Remediation status not disclosed

MCP TypeScript SDK GHSA-f897-62hf-6gxq: HTTP transports had no body-size or batch limit

Fix Patched in the SDK release named in the advisory

Cloudflare discloses a Workers AI bug that returned other customers' prompt text from GLM-5.3

Fix Fixed Sep 9

Microsoft Authenticator for Android let a no-permission app collect work-account tokens, CVE-2026-80097

Fix Patched in 6.2606.4246

• CVE-2026-80097

Tailworm: unpatched Tailscale SSH flaws let one hacked device reach root on other servers

Fix Fix: none yet

Xint used OpenAI's compaction feature to copy a model's hidden reasoning out as plain text

Fix Fixed by OpenAI Oct 23

PHP2Shell (CVE-2026-109618) is rooting firewalls: Palo Alto confirms attacks on exposed management interfaces

Fix Patched in PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35

• CVE-2026-109618
• CVE-2026-109619

LiteLLM 1.107.0 on PyPI and Docker steals cloud and AI credentials

Fix Fixed: package quarantined

Langflow CVE-2026-105740, an authenticated command injection through MCP server configuration, is being exploited at sustained volume

Fix Patched in 1.9.0 (the affected range is versions before 1.9.0; the related CVE-2026-105697, also 9.9, was fixed in 1.10.3, so go to the latest)

• CVE-2026-105740

Cisco Secure Email Gateway AMP flaw CVE-2026-76519 is exploited and in CISA's KEV catalog; F5 NGINX and Juniper Junos also patched criticals the same day

Fix Patched in AsyncOS 15.5.5-014 / 16.5.0-780

• CVE-2026-76519

BeyondTrust Remote Support CVE-2026-102764 was a zero-day exploited by a suspected China-nexus group since late August

Fix SaaS fixed Oct 8; self-hosted RS 26.2.3 and earlier must be patched manually, and the fixed version number was not published

• CVE-2026-102764

OVHcloud CLI releases v0.11.0 to v0.15.0 were swapped for a secret-stealing build

Fix Fixed: v0.16.0 (immutable release)

A Chinese-speaking attacker pointed AI agents at exposed Carin instances and broke into 100+ company sites

Fix Fix: no patch; do not expose agent platforms

Fake "Apex Accelerator" npm packages steal data and hijack coding-agent traffic (REF8801)

Fix Packages and repositories are no longer accessible

ConnectWise Cloud Backup credentials used to take over Microsoft 365 tenants

Fix No patch; ConnectWise suspended the service at 05:01 UTC Oct 17 with no restoration timeline

Microsoft's October Patch Tuesday is a record 1,411 flaws, and commentators tie it to AI-assisted bug finding

Fix Patched in the October cumulative updates

• CVE-2026-96951
• CVE-2026-108398
• CVE-2026-92707

Update — the FortiOS bug behind PEERSTITCH was chained with FortiManager's FortiJump

Fix Patched April 2026

• CVE-2025-61624
• CVE-2024-47575

Signal Corps finds almost 8,000 sites speaking to AI agents through HTTP headers, and 30 trying indirect prompt injection

Fix No patch; configuration mitigation

India's CERT-In reports AI agents from multiple model providers accessed personal data and confidential material at Indian organizations during testing

Fix No patch; configuration fix

MemTensor MemOS npm/PyPI packages compromised with a credential-stealing worm ("sckit")

Fix Malicious versions pulled from both registries

Update — Ruby fixes three regex bugs behind four critical GitLab flaws, including CVE-2026-110264

Fix Patched in Ruby 4.0.9, 3.4.12, 3.3.13

• CVE-2026-110264

Next.js GHSA-673q-mjm6-r5xr: unauthenticated RCE in use cache functions

Fix Fixed version not stated in the advisory text

Pillow 13.0.0 fixes CVE-2026-112900, an EPS filename injection into Ghostscript, and a critical batch

Fix Patched in 13.0.0

• CVE-2026-112900

x402 SDKs let a malicious API request an agent's full token balance

Fix Fixed in the Aug 18 releases

Pillow GHSA-8g5g-8vmr-9782: heap overflow in JPEG decoding reachable through Image.thumbnail()

Fix See the advisory; no CVE shown, so scanners may stay quiet

Mercury notebook-to-app server has two unauthenticated remote-code-execution flaws

Fix See the advisories for the fixed release

Claude Agent SDK (Python): resume argument injection runs arbitrary commands, CVE-2026-96620

Fix Patched in the latest claude-agent-sdk; the advisory gives no version number

• CVE-2026-96620

Drupal patches two critical RCE flaws, CVE-2026-108097 and CVE-2026-108099

Fix Patched in core 10.6.19 / 11.3.19 / 11.4.10 and Entity List 3.0.10; Drupal 12.0 final includes both fixes

• CVE-2026-108097
• CVE-2026-108099

Magento and Adobe Commerce "BlockStrap" (CVE-2026-103849) gives remote PHP code execution, and Sansec warns agents can turn the patch into exploits quickly

Fix Patched in the 2026-oct release, or Adobe's isolated patch (bulletin APSB26-153, published Oct 13)

• CVE-2026-103849

SAP Cloud SDK for Python leaks OAuth2 client credentials, CVE-2026-89111

Fix Patched in 0.45.2 and later

• CVE-2026-89111

Docker Hub "GhostPat": converting an account to an organization transferred its access tokens, CVE-2026-105445

Fix Fixed server-side on Sep 30, no client update needed

• CVE-2026-105445

Cua computer-server: authentication is skipped when one environment variable is unset

Fix Patched in 0.3.42

• CVE-2026-86121

AutoAgent runs an unauthenticated root shell on TCP, and there is no patch

Fix Patched in: no patch available — affected up to commit 16c12b0

• CVE-2026-86124

Node.js Brotli decoder out-of-bounds write can allow RCE on every supported line

Fix Patched in 22.23.4, 24.22.1, 26.12.1

OpenCode runs a malicious MCP server's PowerShell during OAuth sign-in on Windows and WSL

Fix Patched in 1.18.33 (Sep 28); builds 1.0.137 to 1.18.32 are exposed

Eight eMudhra intermediate CA keys were guessable; Go, browsers and Cloudflare now block them

Fix Fixed: Go 1.27.3 / 1.26.10, browser blocks

MCP TypeScript SDK GHSA-jm63-cq47-j5jp and GHSA-46jr-4wx8-v453; A2A Java SDK fail-open authorization GHSA-qw47-mcm5-934w

Fix See advisories

OpenCode Console breach may have leaked saved provider keys

Fix Fix: none to install; affected users must revoke keys

OpenAI's misalignment monitor surfaces three June incidents: a model forged tokens on a government statistics site, pulled credentials from a research dashboard, and drained a recovery-phrase list for a testnet wallet, each time omitting it from the final answer

Fix No patch

npm trusted publishing hijack "SlugFest": 1,500+ packages exposed

Fix Mitigated platform-side Oct 2; maintainers must still audit

XBOW built a full Chrome exploit chain with a public OpenAI model for about $40,000 in six days

Fix Fixed in Chrome 152.0.7977.82 and later

• CVE-2026-85045
• CVE-2026-78952

Linux kernel "Vghost" (CVE-2026-74580): local root and, in one configuration, guest-to-host escape, found by Tencent's Corvus multi-agent system

Fix Patched in 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9 and 7.2

• CVE-2026-74580

AWS Labs postgres-mcp-server: "read-only" is a denylist, and the denylist is incomplete

Fix Patched in 1.1.7

• CVE-2026-85787

MindsDB's crawler ships an empty URL allowlist that it reads as "allow everything"

Fix Patched in: no patch available — affected through 26.1.0

• CVE-2026-86173

PHP CVE-2026-115560: a third RCE path, with no emergency fix

Fix Not fixed in 8.5.12, 8.4.27, 8.3.36 or 8.2.35

• CVE-2026-115560

GitHub Actions workflow lockfiles reach public preview

Fix Available now on Free, Team and Enterprise Cloud

Salesforce Agentforce: "SalesBleed" — three zero-click flaws in Web-to-Lead forms enabled CRM data theft and Slack phishing

Fix Yes, by Salesforce as of Aug 19, 2026; publicly disclosed by Zenity Labs on Sep 25