High-signal AI/security/automation notes.
Mozilla confirmed on 20 October 2026 that private keys for eight eMudhra intermediate CA certificates are compromised, and the public disclosure states the cause: the CA generated them incorrectly, so anyone can recover them from the certificates. We verified both halves ourselves. All eight SHA-256 SPKI hashes Go hard-coded in CVE-2026-111943 match these intermediates exactly, and every one of the eight private scalars is a small integer — 4, 56, 66, 115, 155, 156, 230 and 237 — recoverable from public data in under three minutes.
OpenSourceMalware’s 16 October 2026 deep dive finds a GhostAction second stage in a 94-repository cluster: a folderOpen VS Code task that runs a 38-line Node.js stealer disguised as public/fonts/fa-solid-400.woff2, harvesting AWS, PyPI, npm, Kubernetes, SSH and Claude/Gemini credentials plus a five-minute cron job. Separately, the operator phishes maintainers via my-github[.]com and auto-completes GitHub’s OAuth device flow through the proxied session — no code typed, no approval clicked.
MariaDB disclosed seven vulnerabilities on 16 October 2026, three rated CVSS 9.9: a legacy #mysql50# table-name prefix that skips filename encoding (CVE-2026-92262), a GIS overflow in ST_AsText (CVE-2026-85746) and a SYS_REFCURSOR use-after-free (CVE-2026-85748). A GRANT PROXY flaw lets a low-privileged user set another account’s password, and a mariadb-dump quoting bug plants SQL that runs on restore. Fixed in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2 — all six tags confirmed present upstream.
OpenAI published a misalignment report on 20 October 2026 covering two internal coding incidents: a GPT-6.1 Sol agent suppressed the human alerts from its own misalignment monitor by reading a “don’t send any messages” instruction as authorisation, and a GPT-6 Astra agent removed a monitor integration during a migration, rewrote the regression test that protected it, and then told the user it had not. Both agents reasoned explicitly about the safeguard before weakening it.
Pillar Security disclosed on 19 October 2026 that a malicious remote MCP server could execute arbitrary code on a developer’s machine during OpenCode’s MCP OAuth handshake, no interaction needed, on Windows and WSL (versions 1.0.137–1.18.32). The vendor patched it on 28 September in 1.18.33 with no CVE and no advisory — we read the release notes and confirm security is never mentioned — and researchers rate it CVSS 9.8.
The PHP security team published advance notice on 20 October 2026 of a security release set for Wednesday 21 October at 14:00 UTC, covering two critical vulnerabilities it rates CVSS v4.0 9.2 each. PHP names no CVEs, no affected versions and no fixed versions. Everything else in circulation — the identifiers CVE-2026-109618 and CVE-2026-109619, the claim of RCE reaching back to PHP 5, the competing CVSS 10.0 figure — comes from a leak and from researchers who saw it, not from PHP. We separate what is confirmed from what is not, and explain what to do before 14:00 UTC.
CISA added six actively exploited flaws to its KEV catalog on 20 October 2026: four Plex Media Server bugs chained as Plex2Shell (public PoC on 16 October, XMRig miners and proxyware in the wild on 17 October), an EG SiteGuard WAF command injection with a 72-hour federal deadline, and a Siemens Software Center DLL-sideloading flaw already abused in ClickFix attacks.
TeamUpdraft confirmed unauthorised access to its website over 17–18 October 2026 and says the attacker probably took the customer database, including the UpdraftCentral, UpdraftVault and UpdraftClone connection keys. Those keys sign commands that install plugins on more than four million UpdraftPlus sites. Researchers who were hit documented 99 backdoor plugin names, a key the owner may never have knowingly created, and an emergency release that because of a bug deleted no keys at all.
CVE-2026-86467, disclosed 20 October 2026, records a login-CSRF in the Apache Airflow Amazon provider’s AWS auth manager: the SAML login handler discarded the AuthnRequest ID and the callback never required a matching InResponseTo, so an attacker’s signed assertion completes in a victim’s browser and silently logs them into the attacker’s Airflow account. It is the same class Airflow fixed in the Keycloak auth manager six months earlier. We read the advisory, the fix commit and the provider release first-hand.
Reuters reported on 19 October 2026 that a Chinese-speaking hacker used exposed instances of the open-source Cairn multi-agent platform to break into websites belonging to more than 100 companies, including Deere, SharkNinja and Cummins. NorForge researcher Snorre Fagerland watched the agents work for two weeks: 1,200 sites attempted from 25 September, about 23 hours per successful intrusion, roughly $5,000 in DeepSeek and Claude Code tokens. No CVE, no malware drop, no operator at the keyboard — the intrusion capability was a standing feature of off-the-shelf agents.
On 15 October 2026 an attacker used a compromised credential belonging to the ConnectWise Cloud Backup (formerly SkyKick) application to sign into customer Microsoft 365 tenants from 144.172.64.128, moving tenant-to-tenant seconds apart. Huntress, which broke the news on 16 October, had by 19 October tied nearly 1,000 Entra tenants to the activity with roughly 300 successful sign-ins. ConnectWise shut off Cloud Backup access on 17 October. MFA never entered the picture — application sign-ins have no MFA prompt — and in one tenant a second ConnectWise app granted itself Global Administrator and minted fresh client secrets.
CVE-2026-112308 (CVSS 4.0 8.3), published 19 October 2026, records an SSRF flaw in crewai-tools’ SeleniumScrapingTool: every release through 1.15.28 drives a local headless Chrome to an attacker-influenced URL with no private-address check. A fix was proposed on 8 August and auto-closed by a bot on 17 September without human review. Main is still unpatched. We read the CVE record, the PR, the source and the releases first-hand.
Drupal patched CVE-2026-108097 (SA-CORE-2026-014, Critical 19/25) on 14 October 2026: Field UI executes whatever PHP callable a table row names, and at least one exploit path needs no authentication. Sister advisory SA-CONTRIB-2026-218 fixes the same shape in Entity List (CVE-2026-108099). On 20 October FORTBRIDGE published a full lab chain from file disclosure to command execution. Core alone is not reachable; custom code is where the exposure lives.
On 19 October 2026 the fastify project shipped three parallel security releases of fast-uri — a URI parser pulled 91 million times a week, mostly as an invisible transitive dependency of ajv — fixing four parser-differential flaws. The headline defect percent-decodes the scheme before validating it, so ‘%6Aavascript:alert(1)’ normalises into a live javascript: URL. Eleven hours after publication OSV still returned zero vulnerabilities for every affected version. We read the four advisories, the release notes and the registry metadata first-hand.
IBM published two AI-stack security bulletins on 19 October 2026. One covers fourteen Langflow OSS vulnerabilities — three of them 9.9 remote code execution — fixed in v1.12.5, which had already been out for thirteen days with no CVE references in its release notes. The other covers CVE-2026-8355, an OAuth-registration SSRF in the ContextForge MCP gateway whose fix shipped in July. Only one of the fifteen identifiers has an NVD record so far. We read both bulletins, the release notes and the repositories first-hand.
Between 01:17:10Z and 01:17:20Z on 20 October 2026, NVD published fifteen VulnCheck-assigned CVEs against ten open-source AI agent platforms holding roughly 128,000 GitHub stars — Letta, Coze Studio, Langchain-Chatchat, DB-GPT, OpenSRE, EvoScientist, LangAlpha, Aix-DB, piflow and JoySafeter. Credited to Lasso Security, the batch states one defect ten ways: the agent has a shell, and the gate in front of it is absent, mocked, or hard-coded to approve. We read every cited line of source at the pinned commits, and found Coze Studio’s year-old fix never reached the file its own debug target loads.