Lead intelligence
Argo CD shipped six advisories on 7 October 2026 across v3.3.15/3.4.10/3.5.4/3.6.0-rc2. Four are CVSS 9.9 critical, and three of those carry no CVE identifier at all. The Jsonnet file-read dates to v0.9.0 in 2018; the Kustomize ProxyCommand injection (CVE-2026-55797) to a SOCKS5 feature added in 2024. We read every advisory and the fix commit, and five of the six GHSA records return 404 from OSV.
Read the briefing →
CVE-2026-108263 (CVSS 9.9, CWE-95/306/653) in iFlytek’s Astron Agent: the default workflow code-node path ran tenant-supplied Python through an unsandboxed local executor, letting a low-privilege tenant execute code as root and cross tenant boundaries. Fixed in 1.1.2 on 7 September; the CVE published 9 October.
On 9 October 2026, ten advisories landed against nginx-ui (11,500+ stars) — one critical RCE, eight high, one moderate, from nine separate reporters. Every fix shipped in July or September. Not one advisory names a release tag: all ten point at Go pseudo-versions. We mapped each fix commit to the release that actually contains it — and found the remediation release introduced CVE-2026-107805.
ICSA-26-281-02 names five CVEs in Grid Protection Alliance’s openPDC and openHistorian, including a 9.8 unauthenticated deserialization RCE and a 9.8 hard-coded Docker credential marked “No fix planned”. The fixed versions — openPDC 2.9.482, openHistorian 2.8.585 — are version-bump commits from 18 July with no GitHub release and no tag. The last tagged openPDC release was 2024.
CVE-2026-108265 through CVE-2026-108269 (CVSS 4.0 9.1, CWE-346) landed at NVD on 9 October 2026 against five Privasys confidential-computing repositories — for a channel-binding gap the vendor itself fixed on 10 July. The same flaw class, CVE-2026-33697, still has no patch in CoCoS. We read the advisories, the commits and the release tags first-hand.
Splunk MCP Server below 1.2.1 carried two bugs, not one: alongside the 5.3 SSRF (CVE-2026-76286) briefed on 8 October, the same 1.2.1 release closed CVE-2026-76404, a CVSS 9.1 CWE-502 deserialization flaw letting an admin-role user run OS commands via the credential store. Same batch, same fix — plus an 8.8 pickle RCE in the AI Toolkit. Neither is in KEV.
CVE-2026-107824 (CVSS 9.3) left x64dbg-MCP Server’s full debugger toolset — arbitrary commands, process attach, memory read/write, arbitrary file write — open to any unauthenticated network client on 0.0.0.0:9094. CVE-2026-107820 (5.3) adds a pre-auth Content-Length integer overflow that kills the debugging session. Fixed in 1.1 and 1.2; both CVEs published 9 October 2026.
A ten-nation joint advisory published 8 October 2026 attributes Flax Typhoon-linked intrusions to Integrity Technology Group, documenting 1,300+ scanning scripts, SoftEther VPN persistence and Exchange password spraying. Five of the eight exploited CVEs — the oldest from 2015 — were added to CISA KEV the same day.
Anthropic launched the Cyber Mission on 8 October 2026: a Critical Infrastructure Defense Program pairing Claude models and on-site engineers with eleven OT security partners, and a free OSS Scanner that sends model-generated vulnerability reports with proof of concept and no human review, targeting above 90% true positives.
Skill Constellations reconstructs the first dated copy network of agent skills from git history — 2,193,119 adoptions across GitHub. Only 20.9% of copies follow a later edit of their source, 11.1% of clone-group changes are consistent, and auditing the 100 repositories its model ranks highest prevents 14.9% of later high-risk adoptions against 0.5% for the 100 most starred.
CrowdStrike’s 7 October intel blog reconstructs the ARTEX bank campaign from the operator’s own exposed session logs: a two-server setup, DeepSeek, GLM and Grok backends, nine proxy IPs, and a résumé prompt naming the suspect. A day later, the developer took ARTEX closed-source.
Socket reported 9 October 2026 that a new GhostAction burst on 8 October pushed security-audit.yml into 346 repositories via two compromised maintainer accounts, keeping the old GitHub Actions secret theft and adding a full-history sweep — fetch-depth: 0 plus git log -p --all — for AWS, Anthropic, OpenAI, OpenRouter, GitHub, GitLab, Google, Slack and SendGrid credentials, exfiltrated to the same 193.32.204.199 endpoint. An update counts 500+ accounts and tens of thousands of repos since 7 October.
On 8 October 2026 Microsoft published seven cloud-service CVEs — Partner Center at 10.0, Bookings 9.9, Dataverse 9.8, Azure App Service 9.8, Azure SRE Agent 9.6, Azure API Center 8.7, Event Grid 7.7 — all already mitigated, all with no customer action. The SRE Agent record is the one worth reading twice: CWE-918 under a title that says missing authorization, on an AI agent given production remediation rights, and its second critical CVE this year.
Citrix bulletin CTX697191 (8 October 2026) discloses CVE-2026-107406, a CVSS 4.0 9.5 memory overflow in NetScaler ADC and Gateway SAML handling that can lead to RCE or DoS. The twist: 14.1-73.41 and 13.1-64.28 — the builds that fixed CVE-2026-88779 five days earlier — are themselves affected when the appliance is a SAML IdP. Third upgrade in eleven days, no workaround.
CVE-2026-103663, published 8 October 2026 (CVSS 4.0 9.4), is a relative path traversal in Ollama’s /api/pull endpoint: the digestToPath function trusts attacker-supplied layer digests, letting an unauthenticated remote attacker write outside the model store — and in default Docker deployments, into /usr/lib/ollama, where the file executes as root on restart. Fixed in 0.35.0; reported by Bartłomiej Dmitruk via CERT Polska.
OWASP’s GenAI exploit roundup for Q3 2026 (8 October 2026) consolidates the quarter’s agent failures: OpenAI evaluation agents breaking containment into Hugging Face production, Claude eval runs attacking a real company and publishing malware to PyPI, Varonis’s CoSnitch Copilot chain (CVE-2026-24301), the Mini Shai-Hulud/Miasma worms, and the Deadbugz MCP campaign.
Between 7 and 8 October 2026, 24 GitHub advisories covering 25 CVEs landed against PraisonAI. Every one names a fixed version — 4.6.78 — that exists as a git tag but was never published to PyPI, so pip cannot install the remediation the advisories prescribe.
CVE-2026-107728 (CVSS 7.5, CWE-863) lets a synchronous Strawberry GraphQL permission grant access it should deny: an unawaited coroutine is always truthy, so the check passes even when it resolves to False. We verified the fix landed in 0.326.1 on 31 August 2026 — the GitHub advisory published 9 October, 39 days later.