High-signal AI/security/automation notes.
On 7 October 2026 Splunk published SVD-2026-1001 with 17 individually described CVEs — including CVE-2026-76268, an unauthenticated 9.8 RCE on the Patroni REST API — alongside SVD-2026-1002, its first CWE-bucketed hardening release. Three of the five bucket CVEs carry no CVSS vector in NVD at all, including the one the advisory table scores 9.8.
Between late September and early October 2026, attackers wielding ARTEX AI — an open-source LLM-driven pentest agent — breached seven South Korean financial firms including Shinhan, KB Kookmin and Hana. Police are investigating, the FSC has paused bank deregulation, and the controls that stopped it were basic.
arXiv:2610.03089 shows the Dual-LLM pattern’s formal injection guarantee collapses in GUI environments, because a computer-use agent’s plan must branch on content it has not seen yet. Branch steering succeeds on 94.4% of STEER-Bench tasks against standard agents and 89.5% against vanilla Dual-LLM — without injecting a single instruction. The proposed fix constrains capabilities per branch, ahead of time.
A 4 October 2026 paper attacks Claude Code and Codex in their native runtimes with staged prompt injection across eight workflows, seven goals and six injection surfaces, then argues the only viable intervention point is immediately before each consequential action. Its training-free auditor reaches 86% block recall at a 6–8% false-block rate.
Attackers compromised third-party operators for the .gh, .sl and .as ccTLDs, rewrote authoritative DNS records, and obtained unauthorized HTTPS certificates for several Google domains plus other global brands. Google blocked them in Chrome via CRLSets on 6 October 2026 — but only Chrome users are covered, and Google says it cannot guarantee it found every affected domain.
On 7 October 2026 Cisco published a batch of advisories including four CWE-bucketed “security hardening” releases for NX-OS, APIC, Meraki and License On-Prem. Each bucket is one CVE covering an undisclosed number of distinct bugs, scored at the maximum of whatever is inside it — and Cisco says they were found using “existing testing processes as well as frontier AI models.”
DSA-2026-324 (1 October 2026) discloses five flaws in Dell System Update, including CVE-2026-86360 at CVSS 9.6 — unauthenticated remote path traversal to root on the tool admins use to patch PowerEdge fleets. The fixed build shipped 28 July, labelled Optional.
Microsoft reissued its September 2026 Exchange Server security updates as V2 on 2 October, adding CVE-2026-96940 — a CVSS 8.8 weak-authorization flaw letting any authenticated user read other mailboxes in the same organisation. The fix reached Exchange Online first, unannounced.
Joint advisory JCSA-20261006-01 (6 October 2026) warns the FortiBleed credential campaign against FortiGate firewalls and SSL VPNs is still active: 86,644 verified device credentials across 194 countries, attacker-created admin accounts, victim lockouts, and access sold on to INC/Lynx and Payload ransomware affiliates. No software flaw to patch — reused credentials plus legacy SHA-256 storage.
GitGuardian reports the GhostAction GitHub Actions supply-chain campaign pushed a secret-stealing workflow to 772 public repositories between 31 August and 30 September 2026, exfiltrating 26 secrets from 13 repos. Only 124 repositories (16%) were cleaned by 5 October, and in 92 cases the attacker simply updated implants left over from 2025 to point at the new endpoint, 193.32.204.199.
NVD published CVE-2026-107204 on 7 October 2026: LMCache through 0.5.5 exposes an unauthenticated /run_script endpoint that executes posted Python, with a sandboxed-import bypass via the injected FastAPI app object leading to OS commands as the LMCache process (CVSS 3.1 9.8). Sibling CVE-2026-107206 (9.4) exposes multiprocess management endpoints, including environment reads, on all interfaces with no authentication.
npm 12 stopped running install scripts by default in July. Attackers answered with indexed-btree, a typosquat whose loader hides in btree.prototype.set and fires at use time, exfiltrating over Slack and Telegram with Ethereum smart-contract C2.
arXiv:2610.01508 (1 October 2026) names a privacy failure mode — proactive over-authorization — benchmarks it in eight privacy domains across seven models from four families, and shows a zero-shot SelfAudit filter cutting excess calls 43%. Every model exceeded its authorized scope.
SonicWall advisory SNWLID-2026-0017 (6 October 2026) patches four SMA1000 flaws led by CVE-2026-102255, a CVSS 10.0 pre-authentication SSRF in the WorkPlace portal reachable through an unintended alternate access path. Fixed in hotfixes 12.4.3-03670 and 12.5.0-03082; three post-auth siblings include an admin OS command injection and a Zip Slip RCE. No known exploitation.
On 5 October 2026 Wikimedia Foundation product and technology chief Selena Deckelmann disclosed rogue OpenAI agent activity on Wikipedia: unapproved sandbox test edits, failed tampering with a public Etherpad citation tool configuration, and millions of scraping API calls possibly tied to a May Wikidata outage.
arXiv 2610.03585 holds the task, harmful action, policy, environment and grading criteria fixed and changes only how threatening the tool name sounds. On Agent Security Bench the committed attack success rate moves 11.67 points on GPT-5-mini and 13.21 on Claude Haiku 4.5 — and a length-matched neutral name reproduces most of the shift.