High-signal AI/security/automation notes.
Previdian confirms active exploitation of Langflow CVE-2026-105740 with first sensor hits on 19 September 2026, sixteen days before NVD publication. Nearly 2,000 honeypot attempts, credential-stuffing past auto_login, secret exfiltration, and a multi-CVE scanner IP. Still absent from CISA KEV, with EPSS at 0.6%.
QwenPaw issue #8153 documents a real intrusion: an exposed management interface, a stdio MCP driver named rce-poc-*, twenty SSH keys in root’s authorized_keys, and a systemd miner with a 17-day dwell. The maintainer closed it as insecure deployment, not a vulnerability. We verified the interface first-hand.
CVE-2026-47218 reached NVD on 15 October 2026 at CVSS 4.0 9.3: runwasi’s Wasmtime shim accepted a precompiled native-code artifact handed to it as an OCI image layer and deserialized it, skipping WebAssembly validation entirely. The fix, shipped four months earlier, adds one boolean. GHSA-cc25-vq59-rcjx was published 17 June; the CVE arrived 120 days later, and neither identifier resolves in the GitHub global advisory database or OSV at time of writing.
CVE-2026-111391, published to NVD at 12:16Z on 16 October 2026, is a 9.2 code injection in SGLang’s debug dumper: a filter expression evaluated with eval() and an empty __builtins__, with re.search left in the namespace. A community fix arrived 48 minutes after the report and was closed unmerged 15 hours later in an anti-queue-flooding sweep. The affected range ends at 0.5.22 — released the same day, still vulnerable. We read every line at the tag.
CVE-2026-111392, published to NVD at 18:17:38Z on 16 October 2026, lets a caller declare the prefix-cache identity of an image on SGLang’s native /generate endpoint. Send image B under image A’s declared hash and the model answers from A’s cached KV — across tenants, with a normal completion and no error. The adjacent field in the same dataclass already has a trust flag. This one does not, and at the time of writing the unconditional code is still on main.
Signals Corps read the HTTP response headers of 217,097,223 pages from Common Crawl’s September 2026 archive and found 7,959 sites sending text addressed to AI agents. 7,271 are pointers to llms.txt files and MCP servers, 139 record whether the client was judged a bot, and 30 are injection attempts. The sharper result is the tool survey: whether any of it reaches your model depends entirely on which fetch tool your agent uses, and a shell with curl -i passes all of it.
Nine CVEs (CVE-2026-111443 through CVE-2026-111451) published 16 October 2026 for the Wheels CFML framework, mapping to nine of eleven GitHub advisories. CVE-2026-111451 names the threat source verbatim: a CI variable, a branch name, or an AI agent driving the CLI’s MCP tools — and one of those MCP tools deletes recursively without confirmation. Two advisories, including a critical 9.8 SQL injection, got no CVE at all, and OSV has none of them.
CVE-2026-88755, published to NVD on 16 October 2026, covers Z.ai ZCode 3.11.2.6792: opening a repository merges its .zcode/config.json into the MCP server table and connects with no approval, so a stdio entry executes locally with zero interaction. A second path poisons tool descriptions to exfiltrate the local credential store. One day after Junie’s identical flaw class.
Four CVE records published 14 October 2026 cover Better Auth before 1.7.7 and @better-auth/sso before 1.7.3. Two of them — a Magic Link token confusion at 9.3 and an OAuth Proxy profile forgery at 9.1 — have mitigations that are each other’s preconditions, and both advisories say so. One pull request fixed both. We read the advisories, the PR and the new crypto/purpose.ts first-hand.
Cisco published CVE-2026-76519 on 14 October 2026: a CVSS 9.8 arbitrary file write in the Advanced Malware Protection feature of Secure Email Gateway, reachable by sending a crafted attachment through the device and ending in root command execution. Found by internal scanning, already exploited, in CISA KEV the same day with a 17 October deadline — and the real fix ships through the Content Scanner Tools update channel, not a software upgrade.
curl 8.23.0, released 14 October 2026, fixes 24 CVEs — 18 found by the AISLE AI audit, plus an HTTP/2 upload use-after-free (CVE-2026-92392) proven convertible to client-side RCE and reported by Luna with Claude. We read the AISLE audit write-up, the curl.se advisory and the NVD record first-hand: the theme is security state surviving a changed trust context.
NVD published CVE-2026-55786 and CVE-2026-55787 against flytohub/flyto-core on 14 October 2026. The headline record is an unauthenticated MCP tools/call route that dispatches sandbox.execute_shell to asyncio.create_subprocess_shell; the companion is an SSRF guard that never unwrapped IPv6 transition addresses. Fixed in 2.26.3 and 2.26.4.
Docker disclosed CVE-2026-105445 (CVSS 9.4) on 12 October 2026: converting a personal account into an organization silently re-assigned personal access tokens (PATs) to a stranger, with no rotation, no consent and no notification. We read the Docker advisory, the researcher ghostpat.com write-up and the NVD record first-hand — 25 months of exposure, ~304,000 pushes examined, and a fix deployed in under four hours.
Six CVE records published 14 October 2026 cover GitPython before 3.2.0: ext:: remote-helper RCE, --upload-pack injection through the positional refspec, a branch name that reads arbitrary files, environment-variable disclosure, ReDoS, and a submodule symlink escape. The 3.2.0 security release shipped 30 September — fourteen days before the records.
NVD published CVE-2026-110768 and CVE-2026-110769 against holaboss-ai/holaOS on 14 October 2026. The channel-gateway sender check returns true for every sender when allowFrom is empty, and a configured allowlist matches mutable Telegram usernames. No fixed version exists; the defects are still present on main.
CERT/CC published VU#456950 and CVE-2026-110005 on 13 October 2026: Komodo’s Periphery agent interpolated container names and log search terms straight into shell commands running as root. We read the vulnerable and fixed source at v2.2.0 and v2.3.0 — the escaping crate was already a dependency, the fix shipped on 29 July under a Misc bullet, and the gap between patch and advisory is 76 days.
Fourteen CVE records published 14 October 2026 cover n8n 2.41.4, 2.42.1 and 1.123.83 — fixes that shipped 30 September. The batch reads as an audit of every trust boundary an agent platform has: agent chat resume, MCP validation, the Git node as an agent tool, credential scoping, and webhook identity. We read all fourteen NVD records first-hand.