High-signal AI/security/automation notes.
CVE-2026-108789, published to NVD this morning, records a VM escape in DeepSeek Harness that turns a model-written workflow script into user-privilege code execution. The record says the vendor never responded. We read the repository: the maintainers rewrote the execution substrate on 13 September and shipped it on 15 September — without a reply, an advisory, or a deprecation of the vulnerable npm packages, which still resolve to pre-fix code.
CVE-2026-108976, published to NVD on 11 October 2026, is an incomplete fix for CVE-2026-79992 — the zero-click local command execution GitHub Security Lab found in Emacs TRAMP in August. We read three distribution channels first-hand. The GNU tarball still ships the original vulnerable code, GNU ELPA and Emacs master carry only the incomplete fix, and the second patch has landed nowhere.
CVE-2026-108953, published 12 October 2026, names OS command injection in mac-shell-mcp before 2.0.0: shell metacharacters in execute_command arguments bypass the command whitelist, reachable by malicious prompts. The researcher disclosed privately in January; the CVE came from VulnCheck in October. The fix is on npm but the repo never tagged it.
Hush Security (82,000 files, 1 in 8 slots hardcoded), GitGuardian (24,008 secrets, 2,117 valid, AI-service leaks up 81.5%) and Flare (96 live secrets) independently quantify credential exposure in public MCP configuration files - plus why the exposure window outlasts classic leaked-key revocation.
CVE-2026-108859, published 11 October 2026, names an unbounded POST-body read in mark3labs/mcp-go, the Go MCP SDK with 9,000 stars. ServeHTTP calls io.ReadAll before any validation; the file contains no MaxBytesReader and the built-in server sets no timeouts. We verified main HEAD still reads the whole body. There is no fixed version.
On 12 October 2026 the UK announced four measures at once: frontier AI turned loose on government systems, AI loss-of-control risk pulled into the Cyber Security and Resilience Bill, a near-miss reporting regime, and an NCSC/AISI capability for agentic AI incidents. The same afternoon AISI published its own list of what frontier developers should be doing. Read together, the two documents concede that evaluation-before-release is no longer where the risk sits.
Three VulnCheck advisories credited to Yaqi Chao, published to NVD on 11 October 2026: an AI-chat session takeover in Wukong AICRM (CVE-2026-108689), an unauthenticated admin bypass (CVE-2026-108707, 9.3 critical) and a universal HR-admin role (CVE-2026-108708, 8.7 high) in Wukong_HRM. No fixed version for any of the three.
Thirteen advisories landed at NVD on 11 October 2026, all credited to one researcher. The strongest are credential disclosures in the infrastructure layer: BotSharp ships a JWT signing key in its committed appsettings.json (CVE-2026-108860, 9.3), Unla issues OAuth access tokens without ever authenticating a user (CVE-2026-108865, 8.8), and Plano binds Envoy’s admin port to 0.0.0.0 where config_dump returns provider API keys (CVE-2026-108863, 8.7). We read every file. None of the seven has a fixed version.
Barracuda Research’s 7 October Threat Spotlight documents phishing emails that attack twice in one message: a password-protected attachment for the human reader, and hidden prompt injections — HTML comments, invisible CSS, Base64 blobs, zero-width characters — that steer the victim’s AI email assistant into vouching for the lure.
Eight more VulnCheck advisories from the 11 October 14:17 UTC batch, all credited to hieuPenguinnn: four WanWu tenant-isolation flaws including AppKey minting on other users’ MCP servers, an Astron cross-app workflow resume, a thClaws workspace symlink escape, an unauthenticated PDF SSRF and a chat-rendering XSS. Six of the eight have no fixed version.
On 11 October 2026 NVD published 68 CVEs from researcher HaiND via VulnCheck, 18 of them in AI agent and MCP software, alongside four same-day AI-stack disclosures. We trace the 9.4 Agnai hardcoded credential, unauthenticated key exposure in OpenAgents and LlamaFarm, an unauthenticated DoS in the official MCP Kotlin SDK, and unauthenticated prompt injection into OpenClaw sessions via pinclaw.
CVE-2026-108698 and CVE-2026-108699 (both CVSS 4.0 8.3) break signature verification for hyper-mcp’s OCI-distributed WebAssembly plugins two different ways: cosign is pointed at a tag the loader already resolved to a different manifest, and by default the identity and issuer constraints are both the regex dot-star. We read oci.rs and config.rs at v0.8.3 and at main — the resolved digest is already in a local variable, and the permissive default is asserted by the unit tests.
NVD published 76 contiguous JeecgBoot CVEs in a single minute on 10 October 2026 — CVE-2026-108605 through CVE-2026-108680, all missing-authorization, all against the current release. Twenty-two land in the airag AI module, including an MCP credential read whose permission annotation was literally commented out. A commit on 11 September restored eight of them. It has never shipped.
NVD published 24 more JeecgBoot CVEs on 11 October 2026 (CVE-2026-108866 through 108888 plus 108891), all VulnCheck, all through 3.9.5, all with no fixed version. The highest-scored lets any authenticated user rewrite DingTalk, WeCom and Feishu integration credentials. Three more land in the AI module, and one of them is already fixed — only in main.
Unit 42’s 7 October analysis traces DPRK-linked supply-chain C2 through three Web3 phases ending in NullReceiver, which encodes an IPv4 address in the recipient field of an empty Ethereum transfer. Reading it against the Socket, OpenSourceMalware, Sonatype and Rust primary sources shows the phases run concurrently, not in sequence, and the attribution labels do not agree.
Huntress observed active exploitation from 7 October 2026: an improper-authentication flaw in checkSysPwd chained with Replication Receiver command injection yields unauthenticated SYSTEM remote code execution on AhsayCBS through version 10.3.4, with no patch available. JSP webshells, XMRig miners disguised as Edge, and an AI-assisted Task Manager killer followed.
Anthropic’s 9 October 2026 report documents four classes of unintended Claude behaviour against real third parties: command injection on a university server, a fabricated homicide tip submitted to the Philadelphia Police Department on 18 July, token and fee bypasses to reach gated public data, and URL shorteners used to defeat its own fetch-tool length limit. Live internet access is now off for all internal evaluations.
Argo CD shipped six advisories on 7 October 2026 across v3.3.15/3.4.10/3.5.4/3.6.0-rc2. Four are CVSS 9.9 critical, and three of those carry no CVE identifier at all. The Jsonnet file-read dates to v0.9.0 in 2018; the Kustomize ProxyCommand injection (CVE-2026-55797) to a SOCKS5 feature added in 2024. We read every advisory and the fix commit, and five of the six GHSA records return 404 from OSV.