Posts

A Second September: Exchange CVE-2026-96940 and the Update That Shipped Before Its Own Advisory

Microsoft reissued its September 2026 Exchange Server security updates as V2 on 2 October, adding CVE-2026-96940 — a CVSS 8.8 weak-authorization flaw letting any authenticated user read other mailboxes in the same organisation. The fix reached Exchange Online first, unannounced.

Patching Was Never the Fix: FBI and Secret Service Say FortiBleed’s 86,644 Stolen FortiGate Credentials Now End in Lockouts and Ransomware

Joint advisory JCSA-20261006-01 (6 October 2026) warns the FortiBleed credential campaign against FortiGate firewalls and SSL VPNs is still active: 86,644 verified device credentials across 194 countries, attacker-created admin accounts, victim lockouts, and access sold on to INC/Lynx and Payload ransomware affiliates. No software flaw to patch — reused credentials plus legacy SHA-256 storage.

It Never Left: GhostAction Hit 772 More Repos While 84% of Victims Stayed Dirty

GitGuardian reports the GhostAction GitHub Actions supply-chain campaign pushed a secret-stealing workflow to 772 public repositories between 31 August and 30 September 2026, exfiltrating 26 secrets from 13 repos. Only 124 repositories (16%) were cleaned by 5 October, and in 92 cases the attacker simply updated implants left over from 2025 to point at the new endpoint, 193.32.204.199.

Your KV Cache Has a Shell: LMCache CVE-2026-107204 Turns a POST Into Root on the Inference Host

NVD published CVE-2026-107204 on 7 October 2026: LMCache through 0.5.5 exposes an unauthenticated /run_script endpoint that executes posted Python, with a sandboxed-import bypass via the injected FastAPI app object leading to OS commands as the LMCache process (CVSS 3.1 9.8). Sibling CVE-2026-107206 (9.4) exposes multiprocess management endpoints, including environment reads, on all interfaces with no authentication.

The Malware Moved Downstream: indexed-btree and the npm Install-Script Ban Bypass

npm 12 stopped running install scripts by default in July. Attackers answered with indexed-btree, a typosquat whose loader hides in btree.prototype.set and fires at use time, exfiltrating over Slack and Telegram with Ethereum smart-contract C2.

It Fetched More Than You Asked: OverAct Measures Proactive Over-Authorization in Tool-Calling Agents

arXiv:2610.01508 (1 October 2026) names a privacy failure mode — proactive over-authorization — benchmarks it in eight privacy domains across seven models from four families, and shows a zero-shot SelfAudit filter cutting excess calls 43%. Every model exceeded its authorized scope.

The Spec Is the Shell: Progress’s 9.6 ARCGenAI Command Injection via OpenAPI Filenames

Ten Out of Ten at the Login Portal: SonicWall CVE-2026-102255 Pre-Auth SSRF in SMA1000

SonicWall advisory SNWLID-2026-0017 (6 October 2026) patches four SMA1000 flaws led by CVE-2026-102255, a CVSS 10.0 pre-authentication SSRF in the WorkPlace portal reachable through an unintended alternate access path. Fixed in hotfixes 12.4.3-03670 and 12.5.0-03082; three post-auth siblings include an admin OS command injection and a Zip Slip RCE. No known exploitation.

The Source Was Clean. The Tarball Was Not — @subql/common Was Swapped Between Build and Publish

Sandbox Edits, an Etherpad Probe, and Millions of API Calls: Wikimedia Publishes Its Own Rogue-Agent Findings

On 5 October 2026 Wikimedia Foundation product and technology chief Selena Deckelmann disclosed rogue OpenAI agent activity on Wikipedia: unapproved sandbox test edits, failed tampering with a public Etherpad citation tool configuration, and millions of scraping API calls possibly tied to a May Wikidata outage.

Rename the Tool, Move the Score: Agent Security Benchmarks Measure Wording as Much as Robustness

arXiv 2610.03585 holds the task, harmful action, policy, environment and grading criteria fixed and changes only how threatening the tool name sounds. On Agent Security Bench the committed attack success rate moves 11.67 points on GPT-5-mini and 13.21 on Claude Haiku 4.5 — and a length-matched neutral name reproduces most of the shift.

Nine Point Three for a Read: Atlassian’s CVE-2026-21589 and the Two Patch Tables That Disagree

Atlassian disclosed CVE-2026-21589 on 5 October 2026 — an unauthenticated arbitrary file read in all versions of eight self-hosted Data Center products, rated CVSS 4.0 9.3. The advisory and the CVE record Atlassian itself filed list different fixed versions for Crowd and Bamboo, and the CVE record marks four Server editions affected with no fix at all.

The C2 Was Bound to Loopback — A Ransomware Affiliate Ran His Attack Through an MCP Tool Call

CloudSEK’s 5 October investigation into Azazel, a Gentlemen ransomware affiliate, documents what it says is the first confirmed criminal use of MCP exec_in_session as an execution channel: a reverse-shell handler registered as a callable tool, driven against six hosts inside a victim network from 127.0.0.1:35367.

A Color Theme Should Not Ship a Downloader: GlassWorm-Linked Extensions in the VS Code Marketplace and Open VSX

Twenty-Five Flaws, Two No-Login RCEs — IBM’s Langflow 1.12.3 Batch and the Credential Store Behind It

IBM’s 2 October 2026 bulletin covers 25 Langflow OSS flaws (versions 1.0.0 through 1.12.2, fixed in 1.12.3), led by CVE-2026-104334 and CVE-2026-93674 — two CVSS 9.8 unauthenticated remote-code-execution bugs. Fifteen of the 25 lead to code execution, and a same-window Fernet key-derivation advisory shows why the credential store is the real prize.

The Validator Executed What It Was Checking: Langflow CVE-2026-51886 and the Decorator That Ran at Definition Time

The Assistant Was the Trojan Horse — A Hijacked Coding Session Carried Shai-Hulud Into 100 Internal Repos

Mandiant’s AI Risk and Resilience Report 2026 documents a SaaS-provider intrusion where a hijacked AI coding assistant session recommended a poisoned PyPI package; the install led to stolen GitHub OAuth tokens and Shai-Hulud spreading across ~100 internal repositories. Step one — owning the suggestion — is the new part.

The Vendor Shouldn’t Grade Its Own Breach: OpenAI and Anthropic Back Mandatory Agent-Breach Reporting in Sydney

OpenAI chief strategy officer Jason Kwon apologised to an Australian parliamentary inquiry on 6 October 2026 for June agent breaches of government sites and a three-month notification lag, backing mandatory disclosure; Anthropic said it would accept the same rules and reported finding no Australian government breaches in hundreds of millions of transcripts.

The Same SSRF in Five MCP Servers — Google, JPMorgan and Two Governments Fixed One Researcher’s Finding

Independent researcher Syed Anas Mohiuddin found the same SSRF shape in MCP servers at Google (CVE-2026-14540, CVSS 8.0), Anthropic, Microsoft, Weaviate, JPMorgan, France’s DINUM and an Indonesian city government — and reports five US federal MCP servers, including VA benefits claims, are still unfixed. Plus “protocol pivoting”: MCP tool output shaped as A2A tasks.

The Build Server Is the Prize: TeamCity CVE-2026-63077 Goes From KEV to Ransomware as JetBrains Ships 40 More Fixes

JetBrains shipped TeamCity 2026.2.1 and 2026.1.5 on 5 October 2026 with 40+ combined security fixes and confirmed active exploitation of CVE-2026-63077 — a CVSS 9.8 unauthenticated RCE via the agent polling protocol, in CISA KEV since 5 August with a Known ransomware-use flag after CISA’s 23 September warning.