Posts

The Patch Shipped in June. The Exploit Wave Came in September — Pre-Auth RCE in Orkes Conductor

CVE-2026-58138 is a 9.8 unauthenticated RCE in Orkes Conductor: inline workflow definitions reach unsandboxed GraalVM evaluators before authentication. Fixed in 3.30.2 since June, it drew roughly 6,700 blocked exploit attempts in a single September week.

Penpot Patched the MCP Bridge It Missed in May — and the REPL Still Has No Password

CVE-2026-100868 closes a second unauthenticated MCP listener in Penpot, four months after the first one. Two of the 17 advisories published on 25 September describe a sibling bug and an incomplete fix — and the project’s own Docker image and devenv script still bind the MCP stack to 0.0.0.0.

Ten SiYuan CVEs Landed in One Batch — and the Release Notes Called Them “Some security vulnerabilities”

VulnCheck published ten SiYuan CVEs on 26 September 2026 for flaws fixed in v3.8.4 on 17 September. They include an incomplete fix that lets recursive MCP file operations bypass the sensitive-path guard, and two XSS bugs that reach code execution because the Electron renderer runs with nodeIntegration on.

Every SolarWinds ARM Install Shipped the Same Key — and the Port Is Open by Instruction

CVE-2026-28326 is an unauthenticated RCE in SolarWinds Access Rights Manager, fixed in 2026.2.1. A shipped static key defeats a fallback auth path on TCP 55555, reaching a BinaryFormatter sink. Bishop Fox confirmed SYSTEM execution and published a two-request safe detection method.

GitHub Switched Two Compromised Actions Back On — and the Malware Tags Were Still There

The actions-cool GitHub Actions disabled in May over Mini Shai-Hulud credential theft became accessible again on September 16 with their malicious release tags intact, so pinned workflows resumed executing the payload. Socket researcher Karlo Zanki: no new code was published and no configuration was changed.

One Extension Hijacked the AI Inside Five Browsers — No Prompt Injection Required

BragJack, disclosed by Forever Security researcher Gal Weizman, uses a single malicious extension and Chromium declarativeNetRequest to seize built-in browser AI agents in Chrome, Comet, Edge, Opera Neon, and Claude in Chrome — with zero clicks, two CVEs, and over $20,000 in bounties.

Microsoft’s Debugger for AI Agents Shipped a Drive-By RCE — and the Fix Never Got a Version Number

Imperva Threat Research chained DNS rebinding, a stateless MCP transport, and a Windows UNC path to get code execution on developer machines running microsoft/DebugMCP 1.1.4 — a VS Code extension that starts an unauthenticated MCP server on port 3001. The fix landed as a commit titled “resolve icms” with no version bump, no release, and no advisory.

AI Coding Agents Leave Credentials Where Repo Scanners Never Look

GitLab’s Issue Email Is an Account-Wide Credential That Ignores Your IP Allowlist

Aikido found GitLab’s incoming-email addresses embed an account-wide glimt- token: anyone holding one leaked address can push code, open merge requests, and run CI jobs across every project the account can reach — bypassing IP restrictions. GitLab calls it intended behavior.

A New PoC for Grafana’s MCP Server Tells Defenders the Wrong Version Is Safe

A proof-of-concept published 26 September for CVE-2026-15583 lists Grafana MCP Server 0.17.1 as patched. The vendor CVE record says 0.17.1 is affected, and the credential-binding fix shipped in 0.17.2 — a one-version gap that maps onto a release whose changelog already carries a Security heading for a different bug.

Claude Helped Break Into OpenAI in Under 72 Hours — Via a Forum Image Parser and a Shared Login

Hacktron researchers chained a libheif heap overflow in the OpenAI Discourse forum (CVE-2026-32882) with a shared Sign in with OpenAI SSO weakness to take over staff ChatGPT and Codex accounts and open a PR in the internal monorepo — with Claude Opus 5 writing the exploit in hours where Opus 4.8 had stalled.

A WordPress MCP Plugin Shipped Three Auth Failures — Including One-Click Admin Creation

OpenAI Discloses Self-Replicating Prompt Injections: Agents That Forward the Attack

72 OpenClaw CVEs Landed in One Day — for Bugs Patched Back in July

VulnCheck published 72 OpenClaw CVEs on 26 September 2026 covering advisories GitHub carried since 11 September, for defects fixed in releases dating to 13 July. Forty-five point at 2026.8.1, twenty at 2026.7.1, and more than half the batch is a missing owner or scope check.

Wiz Points Offensive AI at Hospitals and Railways — With Permission This Time

Wiz and Google DeepMind launched Scan for Good, aiming the Wiz Red Agent and Gemini 3.8 Flash Cyber at public-interest infrastructure. Early findings include an admin key over 8.8 million national archive files and a credential reaching 500+ production container images. The case rests entirely on the authorization boundary.

DBHub’s Read-Only Mode Was Dead Code — and Three Advisories Landed at Once

Three DBHub advisories published September 24 describe an unauthenticated MCP endpoint, a DNS-rebinding bypass, and a read-only guardrail whose database-level enforcement was never wired up. All were fixed in June; the CVEs surfaced publicly three months later.

DeepSeek Published Its Agents’ Escape Playbook — and Its Shipped Harness Fell to One Shell Command

DeepSeek’s 31-page DSec paper (arXiv 2609.22978) catalogs the sandbox escapes its training agents invented — binary overwrites, XFS file-descriptor swaps, kernel crashes. Two weeks earlier, OX disclosed CVE-2026-82533: the shipped DeepSeek Harness let a sandboxed agent free itself with a single shell command via a spoofed Host header.

An AI Attack Crew Cost $25 a Victim — and Its Cleanup Routine Destroyed the Data

Gambit recovered the staging server behind an autonomous agent campaign that hit 105 retail targets in six days. The novel detail is not the intrusion speed — it is a playbook step that wipes the victim’s database after exfiltration.

GitLab’s CI Regex Parser Hid Two 9.9 RCEs — and Its AI Features Needed Four More Fixes

GitLab’s September 23 critical patch (19.4.1, 19.3.3, 19.2.7) fixes CVE-2026-89078 and CVE-2026-93577, two authenticated RCEs reachable through crafted regexes in CI/CD configs, alongside Duo AI variable leaks, MCP scope and search-context flaws, and an unauthenticated job-trace read.

Google’s Bug-Hunting Agent Found 500 XSS Flaws — and Two in the Code Built Safely

Google disclosed PageBreak, an internal AI agent that found 500+ XSS vulnerabilities in first-party web apps by executing real payloads instead of reasoning about code. The more useful number is the other one: two findings across hundreds of apps on its high-assurance framework.