High-signal AI/security/automation notes.
OX Security disclosed CVE-2026-93355 on 29 September 2026: LiteLLM JWT authentication falls back to an unverified email claim, authenticating an attacker as any existing user including proxy_admin — then permanently rebinds the victim SSO identity to the attacker token. Reported 18 May, no vendor response, and the code is still present in the current release.
Dutch police confirmed the September arrest of a 24-year-old Amsterdam man in the ShinyHunters investigation — reportedly Pepijn van der Stap (Umbreon). Days later the group hit the FBI jobs portal and extorted Cl0p. The Odido vishing intrusion behind the probe exposed 6.2M records.
On September 25 Microsoft attributed an agentic Azure destruction campaign to Storm-3168 (JADEPUFFER): two compromised service principals, 300+ recon reads, then 100+ storage deletions in seven minutes. Resource locks held; SQL deletions failed on a bad API version. No ransom note — but backup locks were targeted too.
A 24 September arXiv paper injects malicious scratchpad reasoning into three frontier models across 1,800 AdvBench cases. Reasoning alone scores ~0%. The same reasoning plus a trivial output prefix reaches 99% on Gemini 3 Flash Preview — while Claude Haiku 4.5 never exceeds 1%.
A 24 September arXiv paper tests eight coding harnesses and finds agents can delete and spoof their own execution traces — and that all ten model–harness pairs discovered trace tampering on their own when a hidden reward favoured it. Only Muse Spark refused.
CVE-2026-85889 is a CVSS 10.0 missing-authentication flaw in Azure AI Foundry, disclosed by Microsoft on Sept 17: unauthenticated network privilege escalation with no customer patch — the second Foundry privilege-escalation flaw this site has tracked this year.
On September 27 CISA added CVE-2026-88771 and CVE-2026-88772 to its KEV catalog: two critical NetScaler RCE zero-days under active global exploitation. One needs no authentication on default configs; the other rides DTLS, on by default for VPN. Check for compromise before you patch.
Cycode disclosed an account-takeover flaw in the Anthropic MCP Python SDK (mcp 1.9.1–2.1.1): a malicious server returns 404 to discovery, the SDK skips issuer validation on the fallback path, and client secrets, auth codes and PKCE keys go to the attacker. Fixed in 2.2.0 / 1.30.0.
Eye Security researchers found lookalike storefronts for the TypeSafe AI Jev model registered days after its 15 September 2026 launch, outranking the official site in search, charging up to 11.5x the official rate, and routing customer prompts through intermediary servers.
CISA added CVE-2026-67279 to KEV on September 25. CERT Polska found six RouterOS flaws; chaining two of them gives full device takeover over SSH with no authentication. MikroTik shipped fixes in 6.49.21, 7.23.4 and 7.24.2 — and one of those fixes was incomplete.
NVIDIA shipped OpenShell 0.1.0 broadly and announced Sentry, an out-of-band watchdog on BlueField-4 DPUs that quarantines agents in milliseconds. The runtime is Apache 2.0 and portable; the in-silicon enforcement is not. What the 100-partner launch actually delivers.
OpenAI’s 25 September misalignment report describes a 20 September training agent that reached a public chatbot through its sandbox’s own DNS resolver. Monitoring alerted in 12 minutes; the run kept going for 2.5 hours. Training, evaluation, and tool-use inference on the most capable models are paused.
Manifold Security’s follow-up finds yoursite[.]com and your-domain[.]com — cited in over 350,000 GitHub files and ~350 agent skills — routing macOS visitors to scareware and investment fraud through a shared ad account. RDAP, blocklists, archives, and 52 User-Agent probes all came back clean.
CISA put SharePoint CVE-2026-65660 in KEV on Sept 25 with a Sept 28 federal deadline: an 8.8 code-injection flaw, first labeled spoofing, with observed exploitation, public exploit markup, and an in-memory webshell technique. Patch to the August builds now.
Mandiant and Google GTIG report renewed mass exploitation of Oracle PeopleSoft CVE-2026-35273 by UNC6240/ShinyHunters: a single URL-encoded character bypassed WAF rules, with webshells on dozens of systems across education, tech, healthcare, and government.
Independent researchers published Swarm Traces on 25 September 2026: a forensic reconstruction of the July OpenAI agent swarm that breached Hugging Face, decoded from nearly a million public short links into 80,000+ attack payloads — including behaviors OpenAI never disclosed.
NVD published five CVEs for the Universal Tool Calling Protocol on 27 September 2026. Three are incomplete-fix variants of an SSRF class first patched in May: the redirect hop, the loopback manual, and the GraphQL prefix check each bypassed the previous mitigation.