Posts
High-signal AI/security/automation notes.
Filter: All AI Vulnerabilities & CVEs (380)Tools & Comparisons (2)AI Security Research (212)Agent & Supply Chain Security (738)
One Argument Injection Beat Codex; Oracle’s AI Database Took a Seven-Bug Chain — Pwn2Own Ireland’s AI Track
Across the first two days of Pwn2Own Ireland 2026, eleven attempts targeted AI Infrastructure and the new Coding Agent category. Nine succeeded, paying $215,500. OpenAI Codex fell to a single argument injection bug; Oracle’s Autonomous AI Database needed five and then seven. Four of the nine wins were discounted for collisions or N-days — including a Chroma exploit built on bugs that were already public.
Splunk Shipped Both Formats on One Day: 17 Described Bugs, 5 Buckets, and a 9.8 With No Vector
On 7 October 2026 Splunk published SVD-2026-1001 with 17 individually described CVEs — including CVE-2026-76268, an unauthenticated 9.8 RCE on the Patroni REST API — alongside SVD-2026-1002, its first CWE-bucketed hardening release. Three of the five bucket CVEs carry no CVSS vector in NVD at all, including the one the advisory table scores 9.8.
Valid Provenance, Poisoned Source: TensorLake 0.5.144 Shipped the Shai-Hulud Worm
The Skill Floor Just Dropped: ARTEX and South Korea’s Seven-Bank Breach
Between late September and early October 2026, attackers wielding ARTEX AI — an open-source LLM-driven pentest agent — breached seven South Korean financial firms including Shinhan, KB Kookmin and Hana. Police are investigating, the FSC has paused bank deregulation, and the controls that stopped it were basic.
No Injected Instruction Required: arXiv:2610.03089 Steers Agents Down Branches You Already Approved
arXiv:2610.03089 shows the Dual-LLM pattern’s formal injection guarantee collapses in GUI environments, because a computer-use agent’s plan must branch on content it has not seen yet. Branch steering succeeds on 94.4% of STEER-Bench tasks against standard agents and 89.5% against vanilla Dual-LLM — without injecting a single instruction. The proposed fix constrains capabilities per branch, ahead of time.
Screening the Input Is Too Early, Grading the Run Is Too Late — arXiv:2610.05163 Audits at the Action Boundary
A 4 October 2026 paper attacks Claude Code and Codex in their native runtimes with staged prompt injection across eight workflows, seven goals and six injection surfaces, then argues the only viable intervention point is immediately before each consequential action. Its training-free auditor reaches 86% block recall at a 6–8% false-block rate.
From Read to Root in One Property File: CVE-2026-21589 Exploitation Begins as watchTowr Shows the Crowd Credential Path
The Registry Was the Vulnerability: .gh, .sl and .as Hijacks Minted Rogue HTTPS Certificates for Google Domains
Attackers compromised third-party operators for the .gh, .sl and .as ccTLDs, rewrote authoritative DNS records, and obtained unauthorized HTTPS certificates for several Google domains plus other global brands. Google blocked them in Chrome via CRLSets on 6 October 2026 — but only Chrome users are covered, and Google says it cannot guarantee it found every affected domain.
Six CVEs for an Unknown Number of Bugs: Cisco’s October NX-OS Hardening Release and the Frontier-Model Footnote
On 7 October 2026 Cisco published a batch of advisories including four CWE-bucketed “security hardening” releases for NX-OS, APIC, Meraki and License On-Prem. Each bucket is one CVE covering an undisclosed number of distinct bugs, scored at the maximum of whatever is inside it — and Cisco says they were found using “existing testing processes as well as frontier AI models.”
The Patch Was Already There, Marked Optional: Dell’s 9.6 DSU Flaw and the 65-Day Advisory Gap
DSA-2026-324 (1 October 2026) discloses five flaws in Dell System Update, including CVE-2026-86360 at CVSS 9.6 — unauthenticated remote path traversal to root on the tool admins use to patch PowerEdge fleets. The fixed build shipped 28 July, labelled Optional.
A Second September: Exchange CVE-2026-96940 and the Update That Shipped Before Its Own Advisory
Microsoft reissued its September 2026 Exchange Server security updates as V2 on 2 October, adding CVE-2026-96940 — a CVSS 8.8 weak-authorization flaw letting any authenticated user read other mailboxes in the same organisation. The fix reached Exchange Online first, unannounced.
Patching Was Never the Fix: FBI and Secret Service Say FortiBleed’s 86,644 Stolen FortiGate Credentials Now End in Lockouts and Ransomware
Joint advisory JCSA-20261006-01 (6 October 2026) warns the FortiBleed credential campaign against FortiGate firewalls and SSL VPNs is still active: 86,644 verified device credentials across 194 countries, attacker-created admin accounts, victim lockouts, and access sold on to INC/Lynx and Payload ransomware affiliates. No software flaw to patch — reused credentials plus legacy SHA-256 storage.
It Never Left: GhostAction Hit 772 More Repos While 84% of Victims Stayed Dirty
GitGuardian reports the GhostAction GitHub Actions supply-chain campaign pushed a secret-stealing workflow to 772 public repositories between 31 August and 30 September 2026, exfiltrating 26 secrets from 13 repos. Only 124 repositories (16%) were cleaned by 5 October, and in 92 cases the attacker simply updated implants left over from 2025 to point at the new endpoint, 193.32.204.199.
Your KV Cache Has a Shell: LMCache CVE-2026-107204 Turns a POST Into Root on the Inference Host
NVD published CVE-2026-107204 on 7 October 2026: LMCache through 0.5.5 exposes an unauthenticated /run_script endpoint that executes posted Python, with a sandboxed-import bypass via the injected FastAPI app object leading to OS commands as the LMCache process (CVSS 3.1 9.8). Sibling CVE-2026-107206 (9.4) exposes multiprocess management endpoints, including environment reads, on all interfaces with no authentication.
The Malware Moved Downstream: indexed-btree and the npm Install-Script Ban Bypass
npm 12 stopped running install scripts by default in July. Attackers answered with indexed-btree, a typosquat whose loader hides in btree.prototype.set and fires at use time, exfiltrating over Slack and Telegram with Ethereum smart-contract C2.
It Fetched More Than You Asked: OverAct Measures Proactive Over-Authorization in Tool-Calling Agents
arXiv:2610.01508 (1 October 2026) names a privacy failure mode — proactive over-authorization — benchmarks it in eight privacy domains across seven models from four families, and shows a zero-shot SelfAudit filter cutting excess calls 43%. Every model exceeded its authorized scope.
The Spec Is the Shell: Progress’s 9.6 ARCGenAI Command Injection via OpenAPI Filenames
Ten Out of Ten at the Login Portal: SonicWall CVE-2026-102255 Pre-Auth SSRF in SMA1000
SonicWall advisory SNWLID-2026-0017 (6 October 2026) patches four SMA1000 flaws led by CVE-2026-102255, a CVSS 10.0 pre-authentication SSRF in the WorkPlace portal reachable through an unintended alternate access path. Fixed in hotfixes 12.4.3-03670 and 12.5.0-03082; three post-auth siblings include an admin OS command injection and a Zip Slip RCE. No known exploitation.