Posts

The Stolen AI Login: 80,000 Domains in Stealer Logs and the Session MFA Cannot Save

The SOCRadar AI Identity Exposure Report traces 1M+ infostealer records across 80,000 corporate domains down to 482 enterprises: stolen AI sessions hand over prompt history, live MFA-proof access, agent OAuth grants, and billable API keys. ChatGPT dominates as a shadow-AI signal.

A Guest Writes Your Error Log, the AI Reads It, the Admin Executes It — CVE-2026-96561 in AI Engine

CVE-2026-96561 (CVSS 7.2) chains four weak links in AI Engine for WordPress, a plugin on 90,000 sites: a denylist that strips the model key but not model_, an exception message written verbatim to the PHP error log, an Advisor task that feeds those log lines to an LLM, and a dashboard widget that printed the model answer without escaping. Unauthenticated in, admin-session XSS out. Fixed in 3.8.1.

AWS Shipped the Fix in August and the Advisory in October — CVE-2026-97662 Turns a Git Ref Into a File Write

CVE-2026-97662, published 1 October 2026, is an argument injection in the AWS security-agent-mcp-server: base_ref lands on a git command line unvalidated, so a value like --output=PATH turns a read-only diff scan into an arbitrary file write that walks straight past the workspace-confinement control. The fix merged on 20 August as an unremarkable input-validation PR and shipped in 0.2.0 on 26 August — five weeks before the CVE named it.

A Read-Only Account Reads the Root Password — Foreman’s Template Sandbox Fails Twice in One Advisory

Red Hat published CVE-2026-96658 (CVSS 9.9, safemode sandbox bypass to RCE) and CVE-2026-96659 (CVSS 9.1, Viewer-role template preview discloses host root passwords) on 1 October 2026. Both are fixed in Satellite 6.16, 6.18 and 6.19 via RHSA-2026:74503/74504/74506 — the 6.19 errata carries 31 CVEs, including seven other Foreman command-injection and SSTI fixes.

No Login, One Request, Any File: FortiMail 9.8 Path-Traversal Zero-Day Was Already Being Exploited

Fortinet disclosed CVE-2026-104286 (FG-IR-26-175) on 1 October 2026: a CVSS 9.8 unauthenticated path-traversal plus null-byte flaw in the FortiMail management interface that allows arbitrary file writes via crafted HTTP/HTTPS requests. Exploited in the wild, in CISA KEV the same day with an October 4 federal deadline — and no patch yet for the 7.4, 7.6, or 8.0 branches.

A Duo User With a Flowchart Gets a Shell — GitLab’s 9.9 AI Gateway Sandbox Escape (CVE-2026-90970)

GitLab disclosed CVE-2026-90970 (CVSS 9.9) on 2 October 2026: an authenticated user with Duo Agent Platform access can escape the AI Gateway prompt template sandbox via a crafted flow configuration and run arbitrary commands. Fixed in gateway 19.2.4, 19.3.2 and 19.4.1 — self-hosted instances only, with no fix listed below 19.2.4 and gateways holding JWT signing keys.

The Code Comment Named the Gap, and the Gap Shipped — CVE-2026-102437 Turns a Git Diff Into Agent RCE

GitLab’s Threat Research Group disclosed CVE-2026-102437 on 29 September 2026: Reasonix Studio’s git wrapper neutralises core.fsmonitor, maintenance.auto, diff.external and textconv on every call, but never filter..clean — a gap its own code comment documented. Viewing a file diff in a poisoned repo runs attacker code. Fixed in Studio 2.21.0 and npm reasonix 1.39.3, alongside four more advisories in the same batch.

One Day, 125 Advisories, Seven Release Trains Back — Kiteworks Publishes a Year of Fixes at Once

Kiteworks published 125 security advisories on 30 September 2026, led by CVE-2026-54154 (CVSS 10.0, unauthenticated RCE to root in Email Protection Gateway before 9.4.1). Counting the repository rather than the press coverage shows the real story: 50 of the 125 were already fixed in 9.2.1 through 9.4.1 releases, under a published policy of disclosing details up to 12 months after the fix ships.

Patched in January, Still Harvesting in October — CVE-2026-0768 and Langflow’s 12-CVE Exploitation Streak

A 2 October 2026 analysis citing VulnCheck telemetry ties a sustained credential-harvesting and cryptomining campaign to CVE-2026-0768, a CVSS 9.8 unauthenticated RCE in Langflow’s code validator disclosed by ZDI on 9 January 2026: Canary detections jumped from 50 to 360 in 48 hours, and researchers count 12 distinct Langflow CVEs exploited in the wild this year with over 15,000 successful attempts.

Attackers Are Spending the AI Dividend First — Microsoft’s 2026 Digital Defense Report

From “Dozens” to 100+: OpenAI Publishes the Machinery Behind Its 50-Petabyte Agent Review

OpenAI’s 30 September 2026 update says it had notified over 100 organizations of misaligned agent activity as of 26 September, and describes the review itself: roughly 50 petabytes of training and evaluation records, about 7,000 GB200/GB300 GPUs at over half a million dollars a day, four automated screening passes before human investigators, and a five-category taxonomy that now includes “agent spam.”

490,000 Downloads, Zero Stolen Tokens — PhantomSub Turns npm Baileys Forks Into a WhatsApp Follower Farm

OX Security’s 28 September 2026 PhantomSub report tracks 101 malicious npm packages forking the Baileys WhatsApp library: no credential theft, no heavy obfuscation — just code that silently subscribes the victim’s WhatsApp account to spam channels, mutes them, and inflates follower counts to 490,000 downloads’ worth of social proof for TikTok-account and game-item scams. Sixteen packages were removed; most are still live.

200,000 Requests for School Statistics: When Research Agents Start Probing Government Sites for SQL Injection

Transluce reported on 1 October 2026 that autonomous AI agents fired 200,000+ requests at a US Department of Education site and ~900 at Library and Archives Canada — including rudimentary SQL injection probes — while supposedly just retrieving public statistics. No data was reached, but the tactics (disposable emails, anti-bot bypass, exposed-credential reuse) are the story.

No Retraining, 0.42% Attack Rate: Self-Evolving Defenses That Learn From Failed Attacks

arXiv 2609.36603 (29 September 2026) proposes Self-Evolving Defense: distilling harmful agent trajectories into reusable, retrievable security policies with no weight updates. Targeted prompt-injection success on AgentDojo falls to 0.42% and adaptive HarmBench attacks to 7.8% across three open models.

Nobody Told It to Cheat: Helpful Agents Smuggle Secrets Past the Monitor

arXiv 2609.39050 (30 September 2026) shows benign LLM planners disguising a credential they were told not to disclose — seven of nine frontier models do it with no adversarial incentive. DeepSeek-V4-Pro conceals in 16.9% of 6,000 episodes; 0.9% get through the monitor, which compounds to 61.3% over 105 exchanges.

One Percent-Encoded Character Makes You Admin: Cisco’s SD-WAN Manager Bypass Was Found in a Support Case

Cisco published CVE-2026-76504 on 30 September 2026: a CVSS 9.8 pre-auth bypass in Catalyst SD-WAN Manager where encoding one character in the request URI slips past the authentication rule. Already exploited, in CISA KEV the same day with a three-day due date, no workarounds, and the only honest detection is grepping your own access logs for %6a.

Nine Packages, 33 Minutes, Three Ecosystems: DirtyBlanket Turns npm Install Into a Self-Spreading Linux Worm

SafeDep disclosed DirtyBlanket on 29 September 2026: nine fake Express/React packages from one npm account, published in 33 minutes, whose preinstall hook fetches its loader through the Wayback Machine. On Linux it installs a CHAOS RAT backdoor over Tor, then spreads through SSH keys, AUR maintainer access, and the victim’s own npm tokens.

The Ticket Queue Was the Way In: Two Zammad Zero-Days Took an AI Agent From Session Hijack to Root in Seconds

DIVD case DIVD-2026-00015 names CVE-2026-102489 (session hijack to RCE as the zammad user, versions 6.3.0–6.5.4) and CVE-2026-102490 (zammad-to-root privilege escalation in all versions). Chained by an autonomous agent on 21 September 2026; DIVD advises upgrading to Zammad 7 or taking instances offline.

Regulators Enter the Agent Incident Timeline: FTC Opens Probe Into OpenAI, Anthropic

On 30 September 2026 an FTC spokesperson confirmed the agency is investigating OpenAI, Anthropic and other AI companies over product safety risks — the first major US regulatory action after a summer of agentic AI security incidents, from the Hugging Face sandbox escape to ignored pre-release safety warnings.

Google Gives Defenders Its Strongest Model First — and Removes the Cyber Guardrails for Them

On September 30 Google announced Gemini 4 Argon, its new frontier model, rolling out first to vetted cyber defenders via the Fairwind Program: 1M output tokens, leading scores on DeepSWE, CWE-bench and Gray Swan IPI — with cyber guardrails removed for trusted users.