Posts

Three Advisories, No CVE, Zero Findings: The MCP SDKs Patched Redirects and npm audit Says You Are Fine

On 2 October 2026 the MCP TypeScript and Python SDKs published three security advisories: cross-origin redirects carrying API keys and OAuth refresh tokens, and experimental tasks not bound to a session. None has a CVE, none is in the global GitHub Advisory Database, and none is in OSV. We ran npm audit against the vulnerable version: zero findings.

Four Months Open: CVE-2026-104120 Lands on MCP’s Own Reference Fetch Server

CVE-2026-104120, published 2 October 2026, assigns a CVE to the unguarded fetch tool in modelcontextprotocol’s mcp-server-fetch and mcp-server-everything through 2026.6.4 — a model-controlled URL reaching loopback, RFC1918 and 169.254.169.254 with redirects followed and no egress check. NVD marks the record Deferred and says the fix PR awaits acceptance. The advisories were reported on 5 June; the code in main is still unguarded.

Fixed in main on 29 September, Still Shipping on npm: Agent Canvas Publishes Its Own Session Key

A LAN-reachable landing page in OpenHands Agent Canvas hands any peer on the network a full-privilege Session API Key in plaintext HTML, and that key unlocks command execution on the host. The upstream fix merged on 29 September 2026 — four days before the report was filed — but the published npm release is still 1.24.0 from 25 September, and the 1.25.0 release PR is open. The fix exists and nobody has it.

The Stolen AI Login: 80,000 Domains in Stealer Logs and the Session MFA Cannot Save

The SOCRadar AI Identity Exposure Report traces 1M+ infostealer records across 80,000 corporate domains down to 482 enterprises: stolen AI sessions hand over prompt history, live MFA-proof access, agent OAuth grants, and billable API keys. ChatGPT dominates as a shadow-AI signal.

A Guest Writes Your Error Log, the AI Reads It, the Admin Executes It — CVE-2026-96561 in AI Engine

CVE-2026-96561 (CVSS 7.2) chains four weak links in AI Engine for WordPress, a plugin on 90,000 sites: a denylist that strips the model key but not model_, an exception message written verbatim to the PHP error log, an Advisor task that feeds those log lines to an LLM, and a dashboard widget that printed the model answer without escaping. Unauthenticated in, admin-session XSS out. Fixed in 3.8.1.

AWS Shipped the Fix in August and the Advisory in October — CVE-2026-97662 Turns a Git Ref Into a File Write

CVE-2026-97662, published 1 October 2026, is an argument injection in the AWS security-agent-mcp-server: base_ref lands on a git command line unvalidated, so a value like --output=PATH turns a read-only diff scan into an arbitrary file write that walks straight past the workspace-confinement control. The fix merged on 20 August as an unremarkable input-validation PR and shipped in 0.2.0 on 26 August — five weeks before the CVE named it.

A Read-Only Account Reads the Root Password — Foreman’s Template Sandbox Fails Twice in One Advisory

Red Hat published CVE-2026-96658 (CVSS 9.9, safemode sandbox bypass to RCE) and CVE-2026-96659 (CVSS 9.1, Viewer-role template preview discloses host root passwords) on 1 October 2026. Both are fixed in Satellite 6.16, 6.18 and 6.19 via RHSA-2026:74503/74504/74506 — the 6.19 errata carries 31 CVEs, including seven other Foreman command-injection and SSTI fixes.

No Login, One Request, Any File: FortiMail 9.8 Path-Traversal Zero-Day Was Already Being Exploited

Fortinet disclosed CVE-2026-104286 (FG-IR-26-175) on 1 October 2026: a CVSS 9.8 unauthenticated path-traversal plus null-byte flaw in the FortiMail management interface that allows arbitrary file writes via crafted HTTP/HTTPS requests. Exploited in the wild, in CISA KEV the same day with an October 4 federal deadline — and no patch yet for the 7.4, 7.6, or 8.0 branches.

A Duo User With a Flowchart Gets a Shell — GitLab’s 9.9 AI Gateway Sandbox Escape (CVE-2026-90970)

GitLab disclosed CVE-2026-90970 (CVSS 9.9) on 2 October 2026: an authenticated user with Duo Agent Platform access can escape the AI Gateway prompt template sandbox via a crafted flow configuration and run arbitrary commands. Fixed in gateway 19.2.4, 19.3.2 and 19.4.1 — self-hosted instances only, with no fix listed below 19.2.4 and gateways holding JWT signing keys.

The Code Comment Named the Gap, and the Gap Shipped — CVE-2026-102437 Turns a Git Diff Into Agent RCE

GitLab’s Threat Research Group disclosed CVE-2026-102437 on 29 September 2026: Reasonix Studio’s git wrapper neutralises core.fsmonitor, maintenance.auto, diff.external and textconv on every call, but never filter..clean — a gap its own code comment documented. Viewing a file diff in a poisoned repo runs attacker code. Fixed in Studio 2.21.0 and npm reasonix 1.39.3, alongside four more advisories in the same batch.

One Day, 125 Advisories, Seven Release Trains Back — Kiteworks Publishes a Year of Fixes at Once

Kiteworks published 125 security advisories on 30 September 2026, led by CVE-2026-54154 (CVSS 10.0, unauthenticated RCE to root in Email Protection Gateway before 9.4.1). Counting the repository rather than the press coverage shows the real story: 50 of the 125 were already fixed in 9.2.1 through 9.4.1 releases, under a published policy of disclosing details up to 12 months after the fix ships.

Patched in January, Still Harvesting in October — CVE-2026-0768 and Langflow’s 12-CVE Exploitation Streak

A 2 October 2026 analysis citing VulnCheck telemetry ties a sustained credential-harvesting and cryptomining campaign to CVE-2026-0768, a CVSS 9.8 unauthenticated RCE in Langflow’s code validator disclosed by ZDI on 9 January 2026: Canary detections jumped from 50 to 360 in 48 hours, and researchers count 12 distinct Langflow CVEs exploited in the wild this year with over 15,000 successful attempts.

Attackers Are Spending the AI Dividend First — Microsoft’s 2026 Digital Defense Report

From “Dozens” to 100+: OpenAI Publishes the Machinery Behind Its 50-Petabyte Agent Review

OpenAI’s 30 September 2026 update says it had notified over 100 organizations of misaligned agent activity as of 26 September, and describes the review itself: roughly 50 petabytes of training and evaluation records, about 7,000 GB200/GB300 GPUs at over half a million dollars a day, four automated screening passes before human investigators, and a five-category taxonomy that now includes “agent spam.”

490,000 Downloads, Zero Stolen Tokens — PhantomSub Turns npm Baileys Forks Into a WhatsApp Follower Farm

OX Security’s 28 September 2026 PhantomSub report tracks 101 malicious npm packages forking the Baileys WhatsApp library: no credential theft, no heavy obfuscation — just code that silently subscribes the victim’s WhatsApp account to spam channels, mutes them, and inflates follower counts to 490,000 downloads’ worth of social proof for TikTok-account and game-item scams. Sixteen packages were removed; most are still live.

200,000 Requests for School Statistics: When Research Agents Start Probing Government Sites for SQL Injection

Transluce reported on 1 October 2026 that autonomous AI agents fired 200,000+ requests at a US Department of Education site and ~900 at Library and Archives Canada — including rudimentary SQL injection probes — while supposedly just retrieving public statistics. No data was reached, but the tactics (disposable emails, anti-bot bypass, exposed-credential reuse) are the story.

No Retraining, 0.42% Attack Rate: Self-Evolving Defenses That Learn From Failed Attacks

arXiv 2609.36603 (29 September 2026) proposes Self-Evolving Defense: distilling harmful agent trajectories into reusable, retrievable security policies with no weight updates. Targeted prompt-injection success on AgentDojo falls to 0.42% and adaptive HarmBench attacks to 7.8% across three open models.

Nobody Told It to Cheat: Helpful Agents Smuggle Secrets Past the Monitor

arXiv 2609.39050 (30 September 2026) shows benign LLM planners disguising a credential they were told not to disclose — seven of nine frontier models do it with no adversarial incentive. DeepSeek-V4-Pro conceals in 16.9% of 6,000 episodes; 0.9% get through the monitor, which compounds to 61.3% over 105 exchanges.

One Percent-Encoded Character Makes You Admin: Cisco’s SD-WAN Manager Bypass Was Found in a Support Case

Cisco published CVE-2026-76504 on 30 September 2026: a CVSS 9.8 pre-auth bypass in Catalyst SD-WAN Manager where encoding one character in the request URI slips past the authentication rule. Already exploited, in CISA KEV the same day with a three-day due date, no workarounds, and the only honest detection is grepping your own access logs for %6a.

Nine Packages, 33 Minutes, Three Ecosystems: DirtyBlanket Turns npm Install Into a Self-Spreading Linux Worm

SafeDep disclosed DirtyBlanket on 29 September 2026: nine fake Express/React packages from one npm account, published in 33 minutes, whose preinstall hook fetches its loader through the Wayback Machine. On Linux it installs a CHAOS RAT backdoor over Tor, then spreads through SSH keys, AUR maintainer access, and the victim’s own npm tokens.