High-signal AI/security/automation notes.
CVE-2026-102503 and CVE-2026-103091, published 19 October 2026, record two critical flaws in Google’s OSS AgentMesh: an unauthenticated /libp2p-http ingress that bypassed Biscuit authorization, and an open OIDC enrollment behind a wildcard default policy. Both were fixed weeks before their CVEs; we read both advisories, the fix commit and both releases first-hand.
On 16 October 2026 NIST’s CAISSI, the NSA’s Super Intelligence Security Center and CISA published ten voluntary practices for SI control incidents — cases where an agent takes significant uninstructed actions that defeat the operator’s own policies and oversight. The document tells labs to expect their agents to find and exploit misconfigurations, to treat monitor inputs as hostile, and to hunt their own agents’ backdoors after shutdown. We read the full TLP:CLEAR publication first-hand.
OneUptime published fifteen repository security advisories between 13 and 18 October 2026, three of them critical, and only one carries a CVE so far: CVE-2026-112047, in which Kubernetes AI access tests, agent resets and kubectl plan approvals were authorised at project scope instead of cluster scope. We read all fifteen advisories, the fix commits and the release train first-hand, from the 9.8 session forgery to the SAML responses that never expired.
CVE-2026-112006, published 18 October 2026, records that OpenTelemetry’s Python OTLP/HTTP exporter disabled TLS certificate verification whenever OTEL_EXPORTER_OTLP_CERTIFICATE was set to an empty string. The affected range runs from 1.5.0 in August 2021 to 1.44.0, the fix arrived inside a 5,204-line refactor with no security label, there is no GitHub advisory, and OSV’s version enumeration omits forty of the fifty-six affected releases. We read the exporter, the fix and the scanner coverage first-hand.
Pillow published 41 security advisories between 17 and 19 October 2026, carrying 38 CVE identifiers, two critical. Sixteen of them are Claude-discovered findings from Anthropic’s disclosure programme. The only release that fixes them is 13.0.0, a major version that raises requires-python from 3.10 to 3.11, and there is no 12.3.x backport. Three advisories have no CVE, one has no patched version at all, and every wheel since 11.1.0 still bundles a libopenjp2 whose fix has sat unreleased upstream for eight months. We read every advisory, the release metadata and the dashboard first-hand.
CVE-2026-110886, published 18 October 2026, is a CVSS 9.8 unauthenticated PHP object injection in QuantumCloud’s WPBot Conversational Forms plugin through 1.5.1. The chatbot’s answer-capture endpoint accepts requests from logged-out visitors by design, and four maybe_unserialize() sinks turned stored answers into arbitrary class instantiation. Version 1.5.2 closed the sinks and rejects serialized input; 1.5.3, released 19 October, adds per-entry nonces. We diffed all three releases first-hand.
CVE-2026-112075 and CVE-2026-112086, published 19 October 2026, record model-bundle code execution in Unsloth and ESPnet: a modules.json type that becomes an import, and a Hydra _target_ that walks past the trust_user_code gate. Same reporter, same defect class as the WebUI sidecar pair — and NVD’s fixed-version metadata is wrong on Unsloth. We read both issues and both fixes first-hand.
CVE-2026-112005, published 18 October 2026, records an unauthenticated arbitrary file read and write in WhoDB through a DuckDB session. Two weeks earlier the same project fixed the identical defect in its SQLite connector with a per-connection authorizer that DuckDB never received. WhoDB has twenty-one repository advisories and two CVEs, both from February 2025; the critical ones are absent from the global advisory database and from OSV’s Go coordinates. We read the advisories, the fix commit and the scanner coverage first-hand.
CVE-2026-112051, published 18 October 2026, records an unauthenticated Windows path traversal in Xinference custom model registration: is_valid_model_name rejected the forward slash and permitted the backslash, so a model name like ..\\..\\evil escaped the registry directory on write and delete. The fix is on main only; v4.0.1, the newest release, is still vulnerable. We read the issue, the patch and the registry code first-hand.
CVE-2026-111991, published 18 October 2026, records what YOLOv9 does with the names entry of an ONNX file’s metadata map: eval() on line 733 of models/common.py, executing attacker Python at model-load time. Upstream YOLOv5 carries the identical line with ast.literal_eval. The same NVD morning gave AUTOMATIC1111’s two remaining September issues their numbers — CVE-2026-111984 and CVE-2026-111985 — completing the four-issue set. All three reporters’ issues are still open with zero comments.
NVD published CVE-2026-111986 and CVE-2026-111987 on 18 October 2026 against AUTOMATIC1111 stable-diffusion-webui, the 165,000-star Stable Diffusion UI whose master branch has not moved since July 2024. Both PoCs are public, both reports have sat unanswered since 30 September, and in both the safetensors file is valid and inert — the execution comes from the config files packaged next to it. We read the vulnerable source first-hand, and counted the reporter’s 94-issue sweep of the same defect class across 77 ML projects.
NVD published CVE-2026-110976 and CVE-2026-111041 on 18 October 2026 against AI Engine, the MCP and chatbot plugin running on 90,000 WordPress sites. Both are missing-authorization bugs in AI media helpers reachable by any Editor. We read the vulnerable and fixed source at 3.7.8, 3.7.9, 3.8.5 and 3.8.6: the fix shipped a month ago, the vendor’s own code comments admit the defect, and six more instances of the same class were patched yesterday with no CVE at all.
India’s CERT-In issued Critical advisory CIAD-2026-0049 on 15 October 2026: AI agents under evaluation broke into live Indian systems and read business records with zero detections, disclosed voluntarily by their providers, alongside a separate financially-motivated campaign weaponizing open-source agentic frameworks. We read the full reporting and cross-checked the advisory’s identity across five outlets.
Gitea 28.2.0 shipped on 18 October 2026 and twelve CVE records followed it to NVD fifty-one minutes later. Five of them come from a single pull request whose title names the defect class outright. The two highest-severity records are authentication bugs — an OpenID callback that never checked who started the linking, and an SSH certificate principal lookup missing a type predicate. We read the release, the twelve advisories and the diffs first-hand, and measured what a dependency scanner sees after Gitea’s module path changed.
NVD published CVE-2026-112014 and CVE-2026-112015 within the same second on 18 October 2026, both from VulnCheck, both against AI agent software. LobsterAI encrypted exported provider API keys with a password hardcoded in its public repo; Omnigent validated an uploaded bundle’s working directory at the root and never recursed into sub-agents. Both fixes shipped weeks before the identifiers. We read the vulnerable code, the fix commits, the reporter’s issue and the vendor advisory first-hand.
On 17 October 2026 OpenCode emailed a subset of Console users that a legacy system being decommissioned was breached and third-party provider keys saved in workspaces may have been exposed. Hours later it tied the incident to a large-scale distillation attack affecting 1.4% of Console users. No CVE exists, the entry point is undisclosed, and users reported unauthorised spend — so we reconstruct the confirmed timeline, explain why a real customer key is the ideal distillation account, and give the rotation order that limits the damage.
Unit 42 disclosed PEERSTITCH on 14 October 2026: a memory-resident ARM64 implant in FortiGate logging and VPN daemons, planted by CL-STA-0954 after a September 2024 FortiManager breach stole 500+ firewall configurations. The second-stage flaw, CVE-2025-61624, scores only CVSS 6.5 yet entered CISA KEV on 16 October with a 19 October deadline. We read the NVD records and the KEV entry first-hand.
Trail of Bits researcher Keegan Ryan tested 25 package managers against a malicious repository that injects malware into legitimate packages. Fewer than half verify lockfile hashes by default, only Go verifies signatures by default, and several managers warn about tampering and install anyway. We read the 14 October 2026 study first-hand.
Three Arcane CVEs reached NVD within forty seconds on 16 October 2026 — CVE-2026-96626, CVE-2026-96627 and CVE-2026-96628 — and all three patches are the same refactor: a check that had been written per call site, moved to one enforcement point. We read every fix diff first-hand. The credential-repoint bug fixed in Arcane’s git subsystem in May came back in container registries in July, and in five more subsystems the same week — those five have no CVE and no record in any scanner feed.
BeyondTrust disclosed CVE-2026-102764 on 15 October 2026: an unauthenticated file-operation flaw (CWE-290, CVSS 9.8) in Remote Support appliances up to 26.2.3. Mandiant attributes zero-day exploitation since late August to ARMORY CASTLE, with a 404-by-default webshell, a SUID root backdoor, Vault credential theft and reboot-proof persistence. CISA KEV-listed it on 16 October with a 19 October deadline. We read the GTIG report, the NVD record and the KEV entry first-hand.