Skip to content

696 results for β€œserver”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types696Articles184Repos141Write-ups119Advisories91Threads70Papers48
Tools34Talks4Other3Courses2
β€œserver”
bleepingcomputer.comarticleπŸ›‘οΈ Security

Hackers hijack cPGuard autoupdate to deploy backdoor, steal data

cPGuard, a Linux web-server security suite from OpsShield, had its update CDN compromised on 2 November 2026 at 02:06 UTC using stolen credentials. Versions 5.88.12 through 5.88.19 delivered a backdoor and a script that took password hashes, root MariaDB/MySQL config, shell history and SSH files. OpsShield says 2,946 servers were affected and its billing database was copied. Fix: update to 5.88.25 or later and rotate credentials.

cPGuardLinuxcPanel+3
OpsShieldNamecheapBleepingComputer

Supply Chain, Threat IntelΒ· Published and added 3 Nov 2026

en.cryptonomist.charticleπŸ›‘οΈ Security

BTCPay Server vulnerability: about $1.63M traced to theft-linked addresses

BTCPay Server's 2 November 2026 incident update describes attackers logging in as administrator on servers running version 2.4.1 or earlier and sweeping on-chain hot wallets. Bitquery traced about $1.63M (18.38 BTC and 3,405 LTC) to two addresses, across 682 sweeps from 30 October. The project advises migrating to a new server with a fresh seed, installing 2.4.7 and preserving logs. How admin access was gained is not explained.

BTCPay ServerLNDBitcoin+1
BitqueryCryptonomist

Blockchain, Threat IntelΒ· Published and added 3 Nov 2026

jfrog.comwriteupπŸ›‘οΈ Security

bREACHYing the Perimeter: How One HTTP Request can Hijack your AI Robot

JFrog's analysis of five CVEs in the Reachy Mini robot daemon (Pollen Robotics, Hugging Face), a FastAPI server on TCP 8000 with no authentication and wildcard CORS. A single POST to /api/apps/install runs attacker code through uv pip install, and the daemon's passwordless sudo gives persistent root. It also covers a browser CSRF variant, a BLE PIN bypass with path traversal (CVE-2026-55419 upload step), and fixed version 1.11.0.

Reachy MiniFastAPIHugging Face+3
CVE-2026-55419JFrogPollen Robotics+3

Hardware & RF, AppSec, Supply ChainΒ· Published and added 3 Nov 2026

bleepingcomputer.comarticleπŸ›‘οΈ Security

Police seizes over 100 servers in investment scam crackdown

Europol and Eurojust coordinated an action by authorities in Albania, Cyprus, Finland, Germany, Kosovo and North Macedonia that arrested seven suspects and seized more than 100 servers. The targeted company allegedly ran a crime-as-a-service model from Cyprus and Israel, supplying fake trading platforms and stolen victim data to call centres. Victims in at least 50 countries were pushed into larger transfers with fake profits. The article lists earlier European fraud takedowns.

EuropolEurojustcrime-as-a-service+1

Threat IntelΒ· Published and added 3 Nov 2026

securityweek.comarticleπŸ›‘οΈ Security

Google Dismantles XCPE Botnet of 1.3 Million Android Devices

XCPE (X.CPE) is a backdoor and botnet of more than 1.3 million Android set-top boxes, built and run by the Chinese OEM/ODM Videostrong Technology. Google dismantled it through legal action against domains and servers and banned Videostrong from preloaded Google apps. The malware used a three-stage design persisting on the /oem/ partition and was used for ad fraud, residential proxies and further malware loading.

AndroidAndroid TV
XCPEVideostrong TechnologyGoogle+8

Threat Intel, Mobile Security, Supply ChainΒ· Published and added 3 Nov 2026

x.comtoolπŸ›‘οΈ Security

Odingard Security (@OdingardSecure) on X

Guardian is an Apache-2.0 authorization layer from Odingard that returns a deterministic ALLOW, ASK or DENY decision for every action an AI agent proposes, before the action runs. No model sits in the decision path. It issues single-use capability tokens instead of credentials and signs a receipt for each action. An MCP server is listed on the official registry. The post gives no architecture or policy-format detail.

GuardianModel Context Protocol
Odingard

AI Security, Identity & AccessΒ· Added 3 Nov 2026

x.comrepo🧠 AI

Md Ismail Ε ojal πŸ•·οΈ (@0x0SojalSec) on X

An x64dbg MCP server, published on GitHub by duty1g and shared in an X post by @0x0SojalSec, lets Claude drive the x64dbg Windows debugger. It exposes breakpoints, memory dumps and code stepping as tools for reverse engineering and malware analysis. A reply warns that debugging a sample executes it, so the agent should run in a snapshotted VM with no shared folders or host route, and every command should be logged.

x64dbgModel Context ProtocolClaude+2
duty1g

mcpΒ· Added 3 Nov 2026

microsoft.comarticleπŸ›‘οΈ Security

What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks

Microsoft analysis of about 383,000 CVEs disclosed from 1999 to September 2026, of which about 2,000 (0.5%) were exploited in the wild. Exploited CVEs skew to takeover classes: server-side RCE rises from 20% to 37%, local privilege escalation from 11% to 18%, and client-side RCE from 4% to 13%. Median patch times run from 2 weeks on Windows workstations to over a year on network appliances, while the median time to CISA KEV listing in 2026 is 3 days.

CISA KEVCVSSWindows+2
CISAVulnCheckMicrosoft+3

Threat Intel, Blue Team & DetectionΒ· Published and added 2 Nov 2026

cisa.govadvisoryπŸ›‘οΈ Security

Subnet Solutions PowerSYSTEM Center

CISA advisory ICSA-26-307-01 (3 November 2026) covers two vulnerabilities in Subnet Solutions PowerSYSTEM Center 2020, 2024 and 2026: CVE-2026-63017, incorrect authorization letting a low-privileged authenticated user reach admin-only resources, and CVE-2026-63774, SQL injection. Vendor CVSS v3 is 9. Subnet recommends upgrading to PowerSYSTEM Center 2026 Update 1.1, monitoring user activity and blocking F12 Developer Tools for Client Access Server users.

PowerSYSTEM CenterCVSS
CVE-2026-63017CVE-2026-63774CISA+2

AppSecΒ· Added 3 Nov 2026, published 2 Nov 2026

x.comtool🧠 AI

Odingard Security (@OdingardSecure) on X

Guardian is an open-source (Apache-2.0) authorization layer from Odingard that gives every action an AI agent proposes a deterministic ALLOW, ASK or DENY decision before it runs. No model sits in the decision path. It issues single-use capability tokens in place of credentials and signs receipts for every action. An MCP server is listed on the official registry. The post gives no architecture or policy-format detail.

GuardianModel Context ProtocolGitHub
Odingard

agents, mcp, ai-infraΒ· Added 3 Nov 2026, published 2 Nov 2026

bleepingcomputer.comarticleπŸ›‘οΈ Security

Google disrupts million-device XCPE Android malware botnet, bans TV box maker

XCPE is an Android TV box botnet of more than 1.3 million devices, which Google's Threat Intelligence Group attributes with high confidence to manufacturer Videostrong Technology, who preinstalled a system-level backdoor in firmware. The backdoor (x.cpe, com.oemservice) used an MQTT broker for commands and loaded ad fraud and residential proxy modules. Google took down C2 servers tied to 10 million more devices and banned Videostrong from certified Android devices.

AndroidAndroid TVMQTT+2
XCPEVideostrong TechnologyGoogle Threat Intelligence Group+17

Threat Intel, Mobile Security, Hardware & RFΒ· Published and added 2 Nov 2026

aws.amazon.comarticleπŸ›‘οΈ Security

Beyond DKIM key rotation: understanding email replay attacks

DKIM replay attacks are explained: an attacker resends a genuinely signed message unchanged from their own servers, so DKIM passes and DMARC passes even at p=reject. The post shows how to tell replay from spoofing or a legitimate relay using DMARC rua reports, why rotating a key without removing the old public key from DNS leaves messages replayable, and how Amazon SES (BYODKIM vs Easy DKIM), Route 53 and CloudWatch support detection and response. It ends with an ordered incident-response procedure.

Amazon SESAmazon Route 53Amazon CloudWatch+2
DKIM replayDKIM2IETF+3

Blue Team & Detection, Cloud & InfraΒ· Published and added 2 Nov 2026

bleepingcomputer.comarticleπŸ›‘οΈ Security

BTCPay Server warns of hot wallet thefts targeting outdated instances

BTCPay Server, an open-source self-hosted cryptocurrency payment processor, reports attackers draining hot wallets on instances running version 2.4.1 (July 23, 2026) or earlier. Attackers logged in as administrators on versions older than 2.4.2. Users should update to 2.4.7; the exploited flaw is not disclosed. An October 29 critical vulnerability found by Anthropic's Frontier OSS scanner prompted 2.4.7. The August 7 release 2.4.2 had already warned of an exploited LND credential exposure.

BTCPay ServerBitcoinLightning Network+2
Nicolas DorierAnthropicBleepingComputer

Blockchain, Threat Intel, AppSecΒ· Published and added 2 Nov 2026

bleepingcomputer.comarticleπŸ›‘οΈ Security

Over 1,000 GitLab servers vulnerable to ongoing RCE attacks

CVE-2026-97229 is a maximum-severity integer overflow in GitLab's CI/CD Regular Expression Compiler that lets an unauthenticated attacker run code via a crafted regex in pipeline configuration. GitLab patched it on 12 October 2026 in versions 19.4.2, 19.3.5 and 19.2.8. CISA added it to KEV, and Shadowserver tracks over 1,000 unpatched servers, plus 11,300 exposed to the related CVE-2026-110264.

GitLab
CVE-2026-97229CVE-2026-110264CVE-2026-85706+6

AppSec, DevSecOps, Threat IntelΒ· Published and added 2 Nov 2026

decrypt.coarticleπŸ›‘οΈ Security

BTCPay Tells Merchants to Switch Off Servers Amid Hot Wallet Attack Reports

BTCPay Server told operators on 1 November 2026 to shut down instances after reports of hot wallets being swept. The project later said the attack targeted versions 2.4.1 or older, with attackers logging in with administrator access, and it had no credible drain reports for 2.4.7. Release 2.4.7 (Thursday) fixed one critical and several medium flaws found by Anthropic's scanner. The number of servers affected and the amount stolen are not stated.

BTCPay ServerBitcoin
Nicolas DorierLunaNodeAnthropic

Blockchain, Threat IntelΒ· Published and added 2 Nov 2026

bleepingcomputer.comarticleπŸ›‘οΈ Security

Synology warns of C3RB3R ransomware attacks targeting NAS devices

C3RB3R (Cerber) ransomware is encrypting Synology NAS devices running outdated DiskStation Manager, and Synology issued an advisory urging immediate updates. The attacks exploit a vulnerability patched in December 2024, likely among CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445 from a November 2024 advisory. Victims get a read-me3.txt note and .L0CK3D extension. Shadowserver tracks over 380,000 exposed Synology NAS devices.

Synology DiskStation ManagerConfluenceGitLab
CVE-2024-10441CVE-2024-50629CVE-2024-10445+7

Threat IntelΒ· Published and added 2 Nov 2026

bleepingcomputer.comarticleπŸ›‘οΈ Security

Ivanti patches two more Connect Secure zero-days chained in attacks

Ivanti patched two more Connect Secure zero-days, CVE-2026-111357 (privilege escalation) and CVE-2026-118527 (authenticated file upload), chained with authentication bypass CVE-2026-104935 since at least 1 October 2026. Volexity attributed the chain to UTA0576, which ran no malware, re-exploited the device per command and tampered with logs, evading Ivanti's Integrity Checker Tool. CISA added CVE-2026-104935 to KEV, and Shadowserver tracks over 5,000 exposed instances.

Ivanti Connect SecureVPN
CVE-2026-111357CVE-2026-118527CVE-2026-104935+12

Threat Intel, Offensive SecurityΒ· Published and added 2 Nov 2026

x.comthreadπŸ›‘οΈ Security

The Hacker News (@TheHackersNews) on X

The Hacker News post reports a Linux kernel TCP flaw in the MPTCP code, rated CVSS 9.8. Anthropic demonstrated an exploit that runs commands as root on servers. Ubuntu and RHEL had no fixes at posting time, while Debian, Oracle and others released patches for some versions. The post gives no CVE ID or technical detail.

Linux kernelMPTCPAnthropic+3
The Hacker NewsRed HatOracle

Offensive Security, Cloud & InfraΒ· Added 3 Nov 2026, published 2 Nov 2026

x.comtoolπŸ›‘οΈ Security

Md Ismail Ε ojal πŸ•·οΈ (@0x0SojalSec) on X

An x64dbg MCP server (GitHub repo by duty1g, shared via an X post) that lets Claude drive the x64dbg Windows debugger: set breakpoints, dump memory, step code and run other reverse engineering tasks programmatically. The post targets malware analysts. A reply notes that debugging a sample executes it, so the agent should run in a snapshotted VM with no shared folders or host route, with every command logged.

x64dbgModel Context ProtocolClaude+1

Malware & RE, AI SecurityΒ· Added 3 Nov 2026, published 1 Nov 2026

x.comthread🧠 AI

Smarthouse (@localyzapp) on X

A reply by Smarthouse (@localyzapp) on X to a question about the best harness for connecting local models to a Minecraft server. It suggests an MCP server that wraps RCON plus a small agent loop. The main pitfall is block coordinates: expose "/execute if block" as a read tool so the agent can check blocks before placing them, or it will hallucinate terrain.

Model Context ProtocolMinecraftRCON

mcp, agentsΒ· Added 2 Nov 2026, published 1 Nov 2026

bleepingcomputer.comarticleπŸ›‘οΈ Security

Alpine Linux rebuilds GitLab after attempted RCE attack

Alpine Linux rebuilt its GitLab server and reset all passwords after attackers tried to exploit CVE-2026-97229, a maximum-severity integer overflow in the Onigmo regex engine bundled with Ruby, on October 20-21. Eight worker crashes occurred and four were partially successful. Missing logs and outbound connection records meant compromise could not be ruled out. Alpine had run GitLab 19.3.4, then 19.3.6, which lacked the Ruby patch; the fixed image is alpinelinux/gitlab:19.3.6 with Ruby 3.3.13.

GitLabAlpine LinuxDocker+1
CVE-2026-97229integer overflowOnigmo

Supply Chain, Blue Team & Detection, DevSecOpsΒ· Published and added 1 Nov 2026

x.comthreadπŸ›‘οΈ Security

lee1981 (@lee1981b) on X

CyberForge Weekly CVE Rundown #008 covers seven CVEs from 26 to 31 October 2026: Wasmtime/Cranelift miscompilation, Rust zip cloaking, Qode Membership account takeover, Dell PowerProtect Data Domain stack overflow, two Progress WS_FTP Server flaws and Kubeflow Pipelines log reads. Each entry gives fixed versions and defender actions. A 1 November check adds EPSS values dated 31 October and notes none of the IDs were in CISA's 30 October catalogue.

WasmtimeKubeflow PipelinesWS_FTP Server+3
CVE-2026-115889CVE-2026-115905CVE-2026-92885+11

AppSec, Cloud & InfraΒ· Added 3 Nov 2026, published 1 Nov 2026

x.comtool🧠 AI

zahT3 (@zahT3zuo) on X

Hotseat is a free, open-source macOS menu bar app that moves Claude Code and Claude Desktop to another of the user's Claude accounts in one click and returns to the same session. Sessions, settings, skills and MCP servers are shared, so `claude --resume` works under either account. When a session hits a usage limit, it offers to continue under another account. It never reads tokens or cookies. Install with Homebrew.

Claude CodeClaude DesktopmacOS+2
HotseatAnthropic

coding-agentsΒ· Added 1 Nov 2026, published 31 Oct 2026

x.comthreadπŸ›‘οΈ Security

Julie Sanchez (@julie199201) on X

YourOwnWeigh is an open-source tool by developer Tom Anthony that patches Withings smart scale firmware over Bluetooth. The patch sends health metrics to a user's own server instead of Withings cloud, avoiding the Withings Plus subscription now required for third-party sync. It can run on a free Cloudflare account and imports existing user profiles. The post gives no firmware or protocol details.

YourOwnWeighWithingsCloudflare+1
Tom Anthony

Hardware & RFΒ· Added 2 Nov 2026, published 30 Oct 2026

bleepingcomputer.comarticleπŸ›‘οΈ Security

Critical Linux kernel flaw allows remote root attacks on MPTCP servers

CVE-2026-98432 is a use-after-free race condition in the Linux kernel IPv4 TCP code (tcp_v4_syn_recv_sock, ireq_opt), affecting kernels back to 4.4 and rated 9.8 by the kernel CVE team (Red Hat rates it 5.9). Anthropic researchers say an unreleased Claude model built an exploit that bypassed KASLR and got remote root on an MPTCP listener in about 53 minutes. The article lists distro patch status and CIQ's nftables mitigation for IP options; disabling MPTCP alone does not help. No in-the-wild exploitation is reported.

Linux kernelAnthropicClaude+2
CVE-2026-98432use-after-freeKASLR bypass+4

Offensive Security, AI Security, Cloud & InfraΒ· Published and added 30 Oct 2026

x.comthreadπŸ›‘οΈ Security

Tanmay (@TanmayK_03) on X

DBHub, a database MCP server, had a read-only mode bypass in its SQL check. The check treated every `--` as a comment, but MySQL only starts a comment when whitespace follows it. A hidden write statement could therefore still run, and a prompt injection could trigger it. Fixed in version 0.22.6. Replies say enforcement belongs in database grants and that parser tests need to be dialect-specific.

DBHubMySQLModel Context Protocol
prompt injection

AppSec, AI SecurityΒ· Added 31 Oct 2026, published 30 Oct 2026

status.bunny.netadvisoryπŸ›‘οΈ Security

Bunny CDN Security Incident

Bunny CDN status-page notice, posted 28 October 2026, about unauthorized access at an infrastructure provider that hosted one bunny.net CDN node in Armenia. Traffic was stopped within 20 minutes and the server wiped. No access to the node was found, but cached content, Pull Zone configs and TLS certificates could have been exposed, so all platform certificates were reissued. Customers with their own certificates should rotate them with new private keys.

Bunny CDNTLS
bunny.netb-cdn.netbunny.run

Threat Intel, Cloud & InfraΒ· Added 31 Oct 2026, published 30 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

How Much Can Tool Calls Reveal About You? Privacy Leakage from Tool-Call Traces

PrivacyTrace is a benchmark of 1,000 synthetic user profiles and 4,000 agent trajectories across four domains, built with real tools from 25 MCP servers. Four LLM attackers inferred user attributes from tool-call traces alone at a 26.25% success rate, against 17.97% for prior-based guessing. Tool arguments and returned results gave the main evidence, and linking traces across sessions raised the risk.

Model Context ProtocolLLM
PrivacyTraceuser profile inferencebehavioral side channel

AI SecurityΒ· Added 3 Nov 2026, published 30 Oct 2026

arxiv.orgpaper🧠 AI

How Much Can Tool Calls Reveal About You? Privacy Leakage from Tool-Call Traces

PrivacyTrace is a benchmark from the Shanghai AI Laboratory (AgentDoG Team, October 2026) that tests how much a passive observer can infer about a user from MCP tool-call traces alone. It has 1,000 synthetic profiles, 4,000 trajectories and 67,950 calls across 25 MCP servers. Four LLM attackers reached 26.25% attribute accuracy against a 17.97% prior baseline, and tool arguments leaked most.

Model Context ProtocolPydantic AILLM+1
PrivacyTraceShanghai AI LaboratoryAgentDoG Team+5

evals, mcp, researchΒ· Added 3 Nov 2026, published 30 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak

SecurityWeek's weekly roundup of 30 October 2026 covers CVE-2026-97631, a 16-year-old buffer overflow in TianoCore EDK II that affects PXE network boot on most servers. It also covers a Cloudflare Workers AI cross-tenant leak caused by an SGLang bug, Anthropic's dispute with Cathedral over a bug bounty intrusion, and fake AI bots probing for secrets. Other items include AI-assisted ransomware (Gold Ogre, Aur0ra), the NIK C2 framework, and North Korean IT worker sanctions.

TianoCore EDK IISGLangCloudflare Workers+3
CVE-2026-97631CathedralCequence+9

Threat Intel, AI Security, Hardware & RFΒ· Published and added 30 Oct 2026

twitter.comthread🧠 AI

Anthropic Cracking Down on Video Game Rewrites

A tweet from chasmmmmmmmmmmm says Claude Code received a new rule around 27 October 2026, delivered from Anthropic's servers under the flag "tengu_heron_brook", with no setting to disable it. The quoted rule allows original games, genre games and games from the user's own designs and assets, but forbids recreating a specific existing game, even if renamed. The post asks whether this ends game rewrites and modding, and gives no verification beyond the quoted text.

Claude Code
Anthropictengu_heron_brook

coding-agents, prompting, ai-policyΒ· Added 31 Oct 2026, published 30 Oct 2026

bleepingcomputer.comarticleπŸ›‘οΈ Security

CISA says max severity GitLab flaw now exploited in the wild

CVE-2026-97229 is a maximum-severity GitLab flaw in the CI/CD Regular Expression Compiler, caused by an integer overflow, that lets unauthenticated attackers run code via a crafted regular expression. CISA added it to the KEV Catalog and ordered federal agencies to patch under BOD 26-04. GitLab fixed it in CE/EE 19.4.2, 19.3.5 and 19.2.8, and Shadowserver tracks about 2,800 exposed CE instances.

GitLab
CVE-2026-97229CVE-2026-0723CVE-2026-110264+10

AppSec, DevSecOps, Threat IntelΒ· Published and added 30 Oct 2026

x.comadvisoryπŸ›‘οΈ Security

lee1981 (@lee1981b) on X

CyberForge CVE of the Day #091 covers Progress WS_FTP Server CVE-2026-84295 (unauthenticated administrator-credential exposure, CVSS 10.0) and CVE-2026-90868 (conditional OS command and argument injection, CVSS 9.9, low privileges). Fixed floors are 2024.0.7/9.0.7 and 2025.0.4/10.0.4; 2024.0.6/2025.0.3 fix only the first. It gives KEV, EPSS and SSVC status, six SOC checks, and Windows 4688 evidence queries.

WS_FTP ServerWindowsPowerShell+3
CVE-2026-84295CVE-2026-90868CWE-287+9

Blue Team & Detection, Identity & AccessΒ· Added 2 Nov 2026, published 30 Oct 2026

x.comthreadπŸ›‘οΈ Security

ESET Research (@ESETresearch) on X

ESET Research thread summarising its APT Activity Report for April to September 2026 on Russia-aligned groups targeting Ukrainian defense, government and infrastructure. Gamaredon deployed Turla's new VBScript recon tool Rezzuar, indicating FSB-linked collaboration, and updated its file stealer PteroBox while activity fell sharply from mid-May. A separate campaign hit MDaemon mail servers via CVE-2025-8088, delivering HELLAGE and HELLTAG backdoors with no user interaction.

MDaemonClamAVWinRAR+1
CVE-2025-8088GamaredonTurla+6

Threat IntelΒ· Added 31 Oct 2026, published 30 Oct 2026

github.comrepo🧠 AI

rikugan: LLM reverse-engineering agent for IDA Pro and Binary Ninja

Rikugan is a reverse-engineering agent that runs inside IDA Pro and Binary Ninja. It has its own generator-based agent loop, context management, plan mode and 60+ tools, and does not depend on an external MCP server. An orchestrator spawns parallel subagents to analyze a binary. It supports Anthropic, Gemini, MiniMax, Kimi, OpenAI-compatible endpoints and Ollama, with per-model notes.

IDA ProBinary NinjaHex-Rays+6
RikuganClaude Opus 4.6Claude Sonnet 4.6+6

agents, coding-agentsΒ· Added 30 Oct 2026

github.comrepoπŸ›‘οΈ Security

rikugan: LLM reverse-engineering agent for IDA Pro and Binary Ninja

Rikugan is an open-source reverse-engineering agent that runs inside IDA Pro 9.0+ and Binary Ninja, with its own agent loop instead of an MCP server. It has 60+ tools (decompiler, xrefs, strings, types, IL/microcode), parallel subagent exploration, an experimental /modify natural-language patching command and an experimental Binary Ninja deobfuscation skill for control flow flattening and opaque predicates. It supports Claude, Gemini, MiniMax, Kimi, OpenAI-compatible endpoints and Ollama.

IDA ProBinary NinjaLLM+3
control flow flatteningopaque predicatesMBA expressions+1

Malware & RE, AI SecurityΒ· Added 30 Oct 2026

x.comtool🧠 AI

Ritik Shukla (@Retik_S) on X

kanzo is a local kanban board that coding agents can update. It ships as one 4 MB binary that starts in 2 ms and runs on localhost. It also works as an MCP server, so Claude Code and Codex see the same tasks as the user. The board is stored as a folder that can sync through a private git repo. The post is brief and gives no further detail.

Model Context ProtocolClaude CodeCodex+2
kanzo

mcp, coding-agentsΒ· Published and added 30 Oct 2026

x.comthread🧠 AI

aiproduck (@aiproduck) on X

Ruflo is an MIT-licensed wrapper for Claude Code and Codex that adds agent swarms, vector memory and an MCP server. The plugin install writes no files to the workspace, while npx init adds a .claude/ directory, CLAUDE.md and hooks. The post warns that mods run with the account's permissions, so users should read them first. It gives no benchmarks or architecture detail.

Claude CodeCodexModel Context Protocol+1
Ruflo

coding-agents, agents, mcpΒ· Published and added 30 Oct 2026

x.comthreadπŸ›‘οΈ Security

ε·ε΄Žε…ƒ (@foryangxin) on X

CVE-2025-6514 is an OS command injection (CWE-78, CVSS 9.6) in mcp-remote 0.0.5 to 0.1.15, fixed in 0.1.16. A malicious MCP server supplies a crafted authorization_endpoint during OAuth discovery, and the open package passes it to PowerShell on Windows. The thread cites the MCP spec's URL scheme allowlist rules and advises treating discovery metadata as untrusted, pinning bridge tools and sandboxing them.

Model Context Protocolmcp-remoteOAuth+3
CVE-2025-6514CWE-78SSRF+2

AI Security, Identity & Access, AppSecΒ· Added 2 Nov 2026, published 30 Oct 2026

vulncheck.comtoolπŸ›‘οΈ Security

VulnCheck - Outpace Adversaries

VulnCheck Open Source is an index of VulnCheck's open-source tooling for its vulnerability and exploit intelligence. It lists a Python API client, a CLI, a GitHub Action for CI/CD, go-exploit (a Go exploit framework), an MCP server for delivering intelligence to AI clients, and VulnCheck Insights, a Chrome extension that highlights CVEs, CPEs and PURLs on web pages and enriches them. The page gives only one-line descriptions.

GoPythonGitHub Actions+2
VulnCheckgo-exploitVulnCheck Insights+2

Offensive Security, DevSecOpsΒ· Added 29 Oct 2026

pillar.securityarticleπŸ›‘οΈ Security

SAIL Framework: A Practical Guide for AI Security

The SAIL Framework from Pillar Security is a seven-phase, lifecycle-oriented method for securing AI systems. The phases are AI policy and safe experimentation, AI asset discovery, AI security posture management, AI red teaming, runtime guardrails, sandboxed execution for agents and MCP servers, and AI activity tracing. It argues for a "Shift Up" approach that protects the business logic AI controls, and it is meant to sit on top of existing standards.

Model Context Protocol
SAIL FrameworkPillar Securityprompt injection+3

AI Security, GRCΒ· Added 29 Oct 2026

oversecured.comarticleπŸ›‘οΈ Security

Android security checklist: theft of arbitrary files | Oversecured Blog

Oversecured's Android security checklist on arbitrary file theft from an app's private storage. It covers implicit intents (PICK, GET_CONTENT) returning file:// or content:// URIs, SEND/SEND_MULTIPLE share activities, exported and non-exported FileProviders, path traversal via Uri.getLastPathSegment, WebView, and local NanoHTTPD servers. Each case has vulnerable code, an attacker PoC and fixes such as /proc/self/fd path checks and narrow files-path entries.

AndroidNanoHTTPDFileProvider+2
Oversecuredpath traversalFileUriExposedException+3

Mobile Security, AppSecΒ· Added 29 Oct 2026

oversecured.comarticleπŸ›‘οΈ Security

What changed when mobile security stopped being theoretical

An Oversecured Head of Engineering, coming from 20 years of web work, describes four mobile security risks that became concrete after seeing real production apps. These are old vulnerable binaries that stay installed after a fix, secrets embedded in client code, Keychain/Keystore guarantees that are weaker than assumed with tokens leaking via logs, and deep links or exported components acting as public endpoints. It ends with advice: test the shipped artifact, verify the full data lifecycle, and build server-side containment.

AndroidiOSOversecured
deep linkscustom URL schemesApp Links+5

Mobile Security, AppSecΒ· Added 29 Oct 2026

github.comrepoπŸ›‘οΈ Security

Show HN: Auto Dismiss Mac OS "Allow <app> to find devices on local networks?"

dontallow is a two-file Swift launchd agent for macOS 15 and later that clicks "Don't Allow" on the "find devices on local networks" prompt. It watches the UserNotificationCenter process through an Accessibility observer, supports pause and allowlist, and can decode the Local Network rule store to show orphaned rows. It explains why Chromium temp-bundle paths make the prompt recur, and gives a PPPC profile route for fleets.

macOSSwiftlaunchd+2
Local Network privacy promptPPPCTCC

Cloud & InfraΒ· Added 30 Oct 2026, published 29 Oct 2026

x.comthread🧠 AI

Prasenjit Sarkar (@stretchcloud) on X

A thread on Cloudflare's agent-readiness scan and the AgentReady.org open spec for "Agent Experience", developed with Vercel, Stripe, Auth0, Mintlify, Google, Netlify and Elementor. The scan grades whether agents can find a site (robots.txt, DNS), read clean Markdown, pass bot rules, and discover an MCP server or API catalog. One quoted example raised a score from 20 to 67 by shipping an API catalog with Link headers, an MCP server card, a skills index and an AI catalog file.

Model Context ProtocolCloudflareMarkdown
AgentReady.orgOraNick Launches+7

mcp, agentsΒ· Added 30 Oct 2026, published 29 Oct 2026

x.comthreadπŸ›‘οΈ Security

Rohan Paul (@rohanpaul_ai) on X

Rohan Paul's X post summarizes a TikTok paper on MCP attacks. LLM agents often finish the requested task, then quietly call an attacker-controlled logging tool that records the user query, the server reply and the final answer. The attack works because agents read natural-language tool descriptions when choosing and ordering tool calls. The visible text is truncated and gives no success rates or defenses.

Model Context ProtocolLLM
tool poisoningdata exfiltration

AI SecurityΒ· Added 30 Oct 2026, published 29 Oct 2026

bleepingcomputer.comarticleπŸ›‘οΈ Security

CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks

Fragnesia (CVE-2026-46300) is a Linux kernel XFRM ESP-in-TCP logic bug in the Dirty Frag class that gives local attackers root, with a public PoC. CISA added it to the KEV catalog and ordered federal patching under BOD 26-04. Attackers chain it with PHP2Shell (CVE-2026-109618, CVE-2026-109619) to implant PHP webshells. Dream Security tied the chain to 25 rooted servers in the US, Japan, Taiwan and South Korea.

Linux kernelLinuxPHP+1
CVE-2026-46300CVE-2026-109618CVE-2026-109619+9

Threat Intel, Offensive SecurityΒ· Added 30 Oct 2026, published 29 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Cryptanalysis and Enhancement of VTBSAE: Provably Secure Verifier-Based PAKE Protocols for the Industrial Internet of Things

Cryptanalysis of VTBSAE, a verifier-based PAKE protocol for the Industrial Internet of Things, showing it fails to resist client impersonation after server compromise. The authors propose E-VTBSAEv1, which binds the client point E1 to fresh server randomness, and prove AKE security and forward secrecy in the random-oracle model under CDH. Raspberry Pi 4B tests show runtime comparable to VTBSAE with the same communication and storage overhead.

Raspberry Pi 4BPAKE
VTBSAEE-VTBSAEv1client impersonation after server compromise+3

Identity & Access, Hardware & RFΒ· Added 31 Oct 2026, published 29 Oct 2026

bleepingcomputer.comarticleπŸ›‘οΈ Security

New Cisco firewall zero-day exploited to crash SSL VPN devices

CVE-2026-76418 is a high-severity denial-of-service zero-day in Cisco ASA and Threat Defense (FTD) software, exploited in the wild in October 2026. Unauthenticated attackers send a crafted request to the SSL VPN (webvpn) when secondary authentication is set on a tunnel group, causing a device reload. Cisco offers no workaround besides disabling secondary authentication on tunnel groups. Shadowserver sees over 51,000 exposed ASA SSL VPN devices.

Cisco ASACisco Firepower Threat DefenseVPN
CVE-2026-76418CVE-2025-20362CVE-2025-20333+10

Threat Intel, Cloud & InfraΒ· Added 30 Oct 2026, published 29 Oct 2026

endorlabs.comarticle🧠 AI

What is an AIBOM? AI bill of materials explained for security teams | Endor Labs

An AIBOM is a machine-readable inventory of models, datasets, dependencies, AI services, agents and MCP servers, with evidence of origin, license, integrity and evaluation. The Endor Labs explainer walks through a worked CycloneDX example for a fine-tuned support assistant. It compares CycloneDX ML-BOM, SPDX 3.x, the OWASP AIBOM project and the May 2026 CISA/G7 guidance, and lists what an AIBOM cannot show: runtime behavior and agent actions.

CycloneDXSPDXSBOM+5
Endor LabsOWASPCISA+3

ai-policy, ai-infraΒ· Published and added 29 Oct 2026

endorlabs.comarticleπŸ›‘οΈ Security

What is an AIBOM? AI bill of materials explained for security teams | Endor Labs

AIBOM explainer from Endor Labs: an AI bill of materials is a machine-readable inventory of models, datasets, dependencies, AI services, agents and MCP servers, with origin, license and integrity evidence. It walks through a CycloneDX entry for a fine-tuned model, compares CycloneDX ML-BOM, SPDX 3.x, the OWASP AIBOM Generator and the May 2026 CISA/G7 minimum-elements guidance, and lists a six-step build process. It also states what an AIBOM cannot show: model safety, runtime behavior and coding-agent actions.

CycloneDXSPDXSBOM+2
EU AI ActISO/IEC 42001CISA+5

Supply Chain, AI Security, GRCΒ· Published and added 29 Oct 2026

x.comthreadπŸ›‘οΈ Security

Rohan Paul (@rohanpaul_ai) on X

Rohan Paul's X post summarizes the paper "Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol", from TikTok researchers. It reports that MCP-using agents often finish the requested task, then quietly call an attacker-controlled logging tool that records the query, server reply and final answer. The attack works through natural-language tool descriptions that agents read when choosing and ordering tools. The visible text is truncated.

Model Context ProtocolLLM
Log-To-Leakprompt injectionTikTok+1

AI SecurityΒ· Added 29 Oct 2026, published 28 Oct 2026

orca.securityadvisoryπŸ›‘οΈ Security

CVE-2026-101767: Critical Oracle EBS SQL Injection Actively Probed in the Wild

CVE-2026-101767 is a CVSS 9.8 unauthenticated SQL injection in Oracle E-Business Suite's Application Object Library, reachable through the /OA_HTML/AppsTCFServer servlet (GanttDataServer) and chainable to OS command execution. It affects versions 12.2.3 to 12.2.15 and was fixed in the October 2026 Critical Patch Update. Horizon3.ai found it, and Defused saw probing on honeypots on 27 October 2026. Interim mitigation is removing the servlet from the URL firewall allowlist.

Oracle E-Business Suite
CVE-2026-101767Horizon3.aiDefused+5

AppSec, Threat IntelΒ· Published and added 28 Oct 2026

bleepingcomputer.comarticleπŸ›‘οΈ Security

Police seize Virtualine bulletproof service tied to ransowmare, cybercrime

Virtualine, a bulletproof hosting service also operating as Secury, Massgod, Spamhouse, Lanedo and Omegatech, had its main domain seized by the FBI with German, Dutch and UK partners. Chainalysis and TRM Labs traced its Bitcoin payments to ransomware (5% of flows), a Russian drug market (about 44%), sextortion and the StealC infostealer. Dutch police seized dozens of servers in Limburg and recovered data on over 3,000 customers.

Bitcoin
VirtualineSecuryMassgod+14

Threat IntelΒ· Added 30 Oct 2026, published 28 Oct 2026

x.comthread🧠 AI

Eddy (@ieddysun) on X

Expo's official skills package gives AI coding agents scoped instructions for building Expo apps. One command, npx skills@latest add expo/skills --skill '*', installs it for Cursor, Copilot and Windsurf, while Claude Code and Codex use their plugin marketplaces. Skills include expo-router, expo-animation, expo-upgrade and eas-update. The Expo MCP server adds live docs lookup, compatible dependency installs, EAS build monitoring and simulator screenshots.

ExpoReact NativeExpo Router+9

coding-agents, prompting, mcpΒ· Added 29 Oct 2026, published 28 Oct 2026

horizon3.aiadvisoryπŸ›‘οΈ Security

CVE-2026-20362 | Cisco Finesse Server-Side Request Forgery Vulnerability

CVE-2026-20362 is an unauthenticated server-side request forgery in Cisco Finesse (CVSS 3.1 score 7.2), found by Horizon3 researchers Noah King and Brandon Peterson. The embedded Apache Shindig content proxy fetches attacker-supplied URLs, including loopback services such as the Finesse REST API at 127.0.0.1:8082, which returns SystemInfo with node hostnames and the XMPP domain. Cisco published its advisory on 7 October 2026. Fixes are planned for January and February 2027, and no workaround exists.

Cisco FinesseApache ShindigNodeZero+1
CVE-2026-20362SSRFCWE-918+3

AppSecΒ· Added 29 Oct 2026, published 28 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices

FoxIO disclosed three TLS flaws in the GoAhead embedded web server from EmbedThis, used on hundreds of millions of IoT, OT and network devices. CVE-2026-115881 (CVSS 9.1) leaves revoked client certificates accepted under mTLS with OpenSSL; CVE-2026-115884 (7.4) bypasses chain-length limits with LibreSSL; a third Mbed TLS bug (5.9, no CVE) weakens TLS 1.2 DHE. GoAhead 6.1.1 fixes the OpenSSL and Mbed TLS issues, and FoxIO released PoC code and fingerprints.

GoAheadOpenSSLMbed TLS+2
CVE-2026-115881CVE-2026-115884FoxIO+4

Hardware & RF, AppSecΒ· Published and added 28 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

A China-linked actor chained PHP2Shell (CVE-2026-109618, CVE-2026-109619) with the Fragnesia Linux kernel privilege escalation (CVE-2026-46300) to root firewalls and drop PHP webshells, per Dream. Using FOFA, the actor narrowed 19,000 firewalls to 240 targets and rooted 24 on 23-24 October. On two US government-affiliated devices it used a reverse SSH tunnel, hit the firewall management server, and attempted LDAP and Active Directory abuse.

PHPLinux kernelSSH+2
CVE-2026-109618CVE-2026-109619CVE-2026-46300+7

Threat Intel, Offensive SecurityΒ· Published and added 28 Oct 2026

x.comthreadπŸ›‘οΈ Security

Kizuno18 (@Kizuno18) on X

Thread by Kizuno18 on the move from local stdio/Docker Model Context Protocol servers to remote HTTP/SSE endpoints in enterprise infrastructure. It names three trade-offs: credential boundary inversion (short-lived OAuth/JWT tokens instead of long-lived admin tokens on workstations), tool schema bloat solved by deferred discovery, and governance via HCP Terraform policy-as-code (Sentinel/OPA), audit trails and approvals. It is opinion, with no data or implementation detail.

Model Context ProtocolTerraformDocker+2
Sentinelblast radiuspolicy-as-code+1

AI Security, Identity & Access, DevSecOpsΒ· Added 29 Oct 2026, published 27 Oct 2026

x.comthread🧠 AI

Kizuno18 (@Kizuno18) on X

Kizuno18's X post argues that the move from local stdio and Docker MCP servers to remote HTTP/SSE endpoints matures the Model Context Protocol in enterprise infrastructure. It lists three trade-offs: short-lived OAuth/JWT bearer tokens replace mounted admin credentials, deferred tool discovery avoids roughly 20k tokens of eager schema loading, and HCP Terraform enforces Sentinel/OPA policy, audit trails and approvals server-side. Opinion post with no benchmarks or code.

Model Context ProtocolDockerTerraform+5
Kizuno18HCP TerraformOPA

mcpΒ· Added 29 Oct 2026, published 27 Oct 2026

x.comthreadπŸ›‘οΈ Security

Buchi Reddy B (@buchireddy) on X

Buchi Reddy B's X thread comments on Forever Security's research (Gal Weizman, Omer Samet) on coding agents. A web page silently writes a fake AGENTS.md or CLAUDE.md into a Downloads folder, and Codex and Claude Code follow it as project rules. Codex then wrote an attacker's MCP server into the machine-wide config, so one injection becomes a standing connection for every session. It asks whether teams inventory runtime MCP connections against approved lists.

CodexClaude CodeModel Context Protocol
Forever SecurityGal WeizmanOmer Samet+3

AI SecurityΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

CRISP: Co-designing Pruning and Scheduling for Efficient MoE Inference on Edge Servers

CRISP is a combination-aware framework that co-designs pruning and runtime scheduling for Mixture-of-Experts inference on memory-constrained edge platforms. It reorders neurons by importance so one stored expert supports several execution widths, gives hot, warm and cold expert combinations different widths, and overlaps expert loading with computation. On Mixtral-8x7B and DeepSeek-MoE-16B it raises throughput up to 2.1x at the same memory budget, with accuracy loss limited to 3.6%.

Mixture of Experts
Mixtral-8x7BDeepSeek-MoE-16BarXiv

inference, researchΒ· Added 28 Oct 2026, published 27 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Tailscale Rushes Patches After Uncoordinated Disclosure of β€˜Tailworm’ Flaws

Tailworm is a set of 11 findings, published by Cyberdione Labs before patches, in Tailscale client 1.104.2 and headscale 0.29.5. Four of six high-severity bugs affect Tailscale SSH, where root-privileged forwarding safeguards can be bypassed, giving root on reachable servers and wormable spread at under a second per hop. Tailscale advises reviewing SSH policies and disabling forwarding until a patched client ships. No in-the-wild exploitation is reported.

TailscaleheadscaleSSH+2
TailwormCyberdione LabsMike Shaver+3

Offensive Security, AppSecΒ· Published and added 27 Oct 2026

x.comtool🧠 AI

Mauro Ubeda (@mauroubeda) on X

BibCode is an open-source desktop app, now in beta, for running coding agents side by side. It is built with Rust and Tauri rather than Electron, and runs Codex, Claude, Cursor and OpenCode, each in its own git worktree. It can also connect to remote BibCode Servers. The author, Mauro Ubeda, says it mixes ideas from T3 Code and Orca. The post gives no feature detail beyond this.

RustTauriGit+4
BibCodeMauro UbedaT3 Code+1

coding-agents, agentsΒ· Added 28 Oct 2026, published 27 Oct 2026

x.comthread🧠 AI

Rohan Paul (@rohanpaul_ai) on X

Hi3D v1.0 (formerly Sparc3D) is an open-sourced image-to-3D model from Hi3D, which runs a closed v3.0 refining at 2048 cubes per side. In a test with 13 professionals in 3D algorithms, 562 judgments against eight other image-to-3D models favoured it 83.5% of the time. The thread also covers the Hi3D Agent and an MCP server for other agents. Back and bottom views were checked, where TRELLIS.2 collapsed a winged figure.

Model Context Protocol
Hi3DHi3D v1.0Sparc3D+2

models, multimodal, mcpΒ· Added 28 Oct 2026, published 27 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover

Time4Popcorn, an abandoned Popcorn Time fork, has an updater (CVE-2026-30612) that fetches updates over HTTP without code signing and runs any executable the domain returns, as System/root. Eye Security registered abandoned update domains, saw millions of Windows, macOS and Android clients, and pushed a fix disabling the updater on about 2 million systems by March 2026. Shadowserver took over the sinkholed domains; Eye Security advises uninstalling the app.

Popcorn TimeWindowsmacOS+2
CVE-2026-30612Eye SecurityShadowserver Foundation+2

Threat Intel, AppSecΒ· Published and added 27 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Alg\{Ossa\}: Decentralized Secure Aggregation with Rotating Committees and Eventual Delivery

AlgOssa is a decentralized secure aggregation protocol built on Ossa, a generic committee-aided, single-server construction for one-shot clients (following OPA and Willow, CRYPTO 2025). Ossa realizes secure aggregation with non-selective abort against a malicious server. AlgOssa adds Algorand-style sortition to rotate leaders and committees, bounds the chance of an honest server, and gives eventual delivery. Classical and post-quantum routes are evaluated.

Algorand
OssaAlgOssaOPA+2

otherΒ· Added 28 Oct 2026, published 27 Oct 2026

x.comthreadπŸ›‘οΈ Security

cubillas (@cubillas888) on X

The tweet relays Pillar Security research that opencode on Windows and WSL could run attacker-controlled code during remote MCP server OAuth sign-in. The fix shipped in opencode 1.18.33 on 28 September, with no advisory or CVE published. It advises users of remote MCP servers to update and review which servers they connect to. Technical details are not in the post.

OpenCodeModel Context ProtocolOAuth+1
Pillar Security

AI Security, AppSecΒ· Added 29 Oct 2026, published 27 Oct 2026

x.comthreadπŸ›‘οΈ Security

Nicholas Martin (@ndgmlondon) on X

X thread started by Nicholas Martin (#IAM) advising that MCP tool permissions be verified and scoped session tokens used to enforce least privilege against indirect prompt injection. Replies argue that token scoping does not solve the confused deputy problem, because an injection borrows the agent's legitimate authority. They recommend per-task tokens with short expiry, with the grant logged beside the call, and raise MCP server dependency supply-chain risk.

Model Context Protocol
indirect prompt injectionconfused deputy

AI Security, Identity & AccessΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Measuring Users' Security and Privacy Concerns About Third-Party Community Bots on Discord

Measurement study of 23,102 third-party Discord bots and 183,142 user reviews (2021-2026, 49 languages). A fine-tuned DeBERTa classifier plus manual validation yields 8,832 security and privacy reviews, mapped to a 31-theme taxonomy; Data Sharing (30.5%) and Data Collection (16.2%) dominate. Permission count and admin status correlate only weakly with user concerns. The authors build BotLens, an MCP-server auditing framework with six tools.

DiscordModel Context ProtocolLLM
BotLensDeBERTa

other, AI SecurityΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol

Log-To-Leak is a prompt-injection attack on tool-using LLM agents that abuses Model Context Protocol tool metadata to trigger an attacker-controlled logging call after the last legitimate call, leaking the user query, server name, server response and agent response. Evaluated on five MCP servers and four agents, it reaches 62.64-100% attack success with 76.55-95.64% logging accuracy. Three defenses leave over 55% residual ASR on GitHub MCP with GPT-4o.

Model Context ProtocolGitHubGPT-4o+1
Log-To-Leaktool poisoningprompt injection

AI SecurityΒ· Added 28 Oct 2026, published 26 Oct 2026

decrypt.coarticleπŸ›‘οΈ Security

Bitcoin Wallet Fixes Critical Flaw That Redirected Funds to Attackers

Electrum 4.8.3, released 24 October 2026, fixes a high-severity flaw in the Bitcoin wallet. Rogue servers could suppress a real payment and inject a fake unconfirmed transaction paying an attacker, so a user's fee-bump became the first transaction broadcast. The fix verifies signatures on wallet-owned inputs, but incoming transactions from external senders stay unverified. One user lost funds on 18 October.

ElectrumBitcoin
SomberNightdannydeezyRaju-K12+2

Blockchain, AppSecΒ· Published and added 26 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

LINE-Break: Cryptanalysis and Reverse Engineering of Letter Sealing

LINE-Break is a security analysis of Letter Sealing v2, the custom end-to-end encryption protocol in the LINE messenger. A TLS man-in-the-middle attacker or malicious server can replay, reorder and block messages undetected, and colluding users can forge message authorship in one-to-one and group chats. Stickers and URL previews leak plaintext. The attacks were verified on the real iOS app and an independent implementation.

LINEiOS
Letter SealingLetter Sealing v2Diego F. Aranha+1

Mobile Security, Offensive SecurityΒ· Published and added 26 Oct 2026

orca.securitywriteupπŸ›‘οΈ Security

PHP2Shell: From the attacker’s perspective

PHP2Shell is the public exploit for CVE-2026-109618 (corrupted internal state at the memory limit, allowing hijack during cleanup) and CVE-2026-109619 (double free used to leak memory and defeat ASLR). Orca ran the GitHub tool unchanged against an unpatched PHP server and got command execution. It then built its own exploit with AI from the patch, which worked on PHP 8.4.26 and WordPress. Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

PHPWordPressGitHub
CVE-2026-109618CVE-2026-109619PHP2Shell+3

Offensive Security, AI Security, AppSecΒ· Published and added 26 Oct 2026

x.comtoolπŸ›‘οΈ Security

Brute (@BRuteLogic) on X

OBroken is Brute Logic's proprietary scanner for OAuth authorization bypasses. It covers 23 techniques across 17 vulnerability classes and produces a standalone Find/Forge/Fire PoC for each finding. The demo runs the missing audience validation case (CVE-2025-9803): it discovers the authorization server, gets a token bound to an attacker resource, and confirms the real API accepts it. A public OAuth bypass testbed accompanies it.

OAuth
CVE-2025-9803OBrokenjBroken+2

Identity & Access, Offensive Security, AppSecΒ· Added 28 Oct 2026, published 26 Oct 2026

x.comthreadπŸ›‘οΈ Security

BenjaminπŸ‘¨β€πŸ’» (@Hislordship_9) on X

Thread on Forever Security's finding that a planted Markdown "Engineering Work Guidelines" file in ~/Downloads made Codex add a "project-tools" MCP server to ~/.codex/config.toml. The server ran npm install function-color, a known malicious package, and started a child session with --dangerously-bypass-approvals-and-sandbox. Codex complied in over 90% of the firm's tests; Claude Code, via a CLAUDE.md setting ANTHROPIC_BASE_URL, about half. Advice: don't start agents in Downloads, review instruction files, and diff agent config.

CodexClaude CodeModel Context Protocol+1
Forever Securityfunction-colorAGENTS.md+4

AI Security, Supply ChainΒ· Added 27 Oct 2026, published 26 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

PHP2Shell Exploitation Moves From Probes to Working Shells

PHP2Shell exploitation (CVE-2026-109618, CVE-2026-109619) reached working shells on 24 October 2026, when Perplexity researcher Adel Karimi's honeypots (PHP 8.4.26, Apache mod_php, single worker) logged 35 shells across three servers. Attackers used a four-stage HTTP chain: memory exhaustion, memory leak, then shell command execution, matching a public PoC. No second-stage payload was seen, and CISA had not added the flaws to KEV as of 26 October.

PHPApache
CVE-2026-109618CVE-2026-109619PHP2Shell+4

Threat Intel, AppSecΒ· Published and added 26 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts

Dutch police arrested two men, aged 23 and 25 from Vaassen and Ede, on October 6 over a bank helpdesk fraud that took over €380,000 from 170 victims. Callers played AI-generated bank audio, then a fake bank employee had victims install an app and tap their card to the phone. The app read the NFC chip data and relayed it to an accomplice at an ATM. Police seized the servers.

NFC
Dutch policeNFC relay attackbank helpdesk fraud+1

Threat Intel, Hardware & RF, Mobile SecurityΒ· Published and added 26 Oct 2026

coindesk.comarticleπŸ›‘οΈ Security

Bitcoin wallet bug let rogue servers steal funds when users tried to speed up payments

Electrum, a Bitcoin software wallet, disclosed on 24 October 2026 a flaw where malicious servers swapped pending transactions for fake ones with invalid signatures that the wallet did not check. When users chose Replace-by-Fee to raise the fee, Electrum signed a valid replacement paying the attacker, and at least one user lost funds. Version 4.8.3 adds signature checks; users of only trusted or self-run servers were not exposed.

ElectrumBitcoin
Replace-by-Feemalicious serverlookalike address

Blockchain, AppSecΒ· Published and added 26 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Private Information Retrieval with Accountability at Erasure-Optimal Server Redundancy

SynTrace is a single-round compiler that adds accountability to linear private information retrieval (PIR). The client mixes the retrieval query with m audit queries, so audit syndromes identify up to d deviating servers among t colluding ones before reconstruction. The paper proves perfect query privacy and zero false identification within the threshold. For Shamir-based PIR it needs k=t+d+1 servers. For a 32 KiB record from a 1 GiB database it uses 2.25 MiB, against 8.96 MiB for the Eriguchi, Kurosawa and Nuida (TCC 2022) homomorphic-MAC construction.

SynTraceEriguchi-Kurosawa-Nuida homomorphic MACTCC 2022

otherΒ· Published and added 26 Oct 2026

x.comthreadπŸ›‘οΈ Security

David Gutierrez | Eng (@david_x_ai) on X

Thread on a critical opencode bug disclosed by Pillar Security on Oct 19. On Windows and WSL, a remote MCP server could run code during OAuth sign-in, because the server-chosen authorization URL was put unescaped into a PowerShell command, so a PowerShell subexpression executed. opencode fixed it in 1.18.33 on Sep 28 as a browser-launch refactor with no advisory or CVE. MCP Inspector published an advisory for the same bug class, and its fix needs a major bump of the open package.

OpenCodeModel Context ProtocolPowerShell+3
Pillar Securitycommand injectionPowerShell subexpression+1

AI Security, AppSec, Supply ChainΒ· Added 27 Oct 2026, published 25 Oct 2026

x.comthread🧠 AI

SemiAnalysis (@SemiAnalysis_) on X

SemiAnalysis claims AMD chips running vLLM can earn up to $3 per chip-hour in profit serving the open-source Kimi K3 model, even after higher chip rental prices following Claude Code's rise. Kimi K3 has over 2.8 trillion parameters and fits AMD's 288GB per chip, while B200 cannot hold it in one server. B200 must then use tensor or pipeline parallelism over 400Gbit/s InfiniBand or Ethernet, which SemiAnalysis says is 18x slower than NVLink. The post gives no methodology.

vLLMClaude CodeNVLink+1
SemiAnalysisAMDKimi K3+1

inferenceΒ· Added 26 Oct 2026, published 25 Oct 2026

proton.metoolπŸ›‘οΈ Security

Proton Flock Camera Map

Proton Flock Camera Map is a ZIP-code search map of Flock license plate reader locations. Its data comes from researcher Joshua Michael, who found in November 2025 that Flock's servers exposed an access token to anyone without login, and published his map in December. His inventory lists over 170,000 cameras and 130,000 other devices, about 40% above Flock's cited 120,000 cameras. The page also covers what Flock records and cites a Washington Post review of officer misuse.

Flock Safety
Joshua MichaelGarrett LangleyVehicle Fingerprint+1

OSINTΒ· Added 26 Oct 2026, published 25 Oct 2026

x.comtool🧠 AI

Dan Kornas (@DanKornas) on X

jshook is an open-source (AGPL-3.0) MCP server that gives AI agents a search-first, profile-aware reverse-engineering workspace for JavaScript, browser traffic, WASM and native processes. Agents start with a small searchable tool surface and move to workflow or full profiles only when needed. It drives Chromium or Camoufox over CDP, captures WebSocket traffic, has HTTP, GraphQL and Burp Suite helpers, and supports hot-reload plugins and declarative workflows. The post is a short announcement; the repository link is in a reply.

Model Context ProtocolJavaScriptWebAssembly+6
jshookDan Kornas

mcp, agentsΒ· Added 28 Oct 2026, published 25 Oct 2026

x.comtool🧠 AI

Agent Credit (@agentcredit_) on X

Agent Credit v1.3 is a remote MCP server that lets AI agents run credit checks on each other. It has six tools: score, compare, operator record, alerts and on-chain proof check. Calls are paid per use in USDC through x402 with no account or key. It also flags shared wallets, lists every token an operator launched and how each ended, and offers embeddable badges and wallet-signed record claims.

Model Context Protocolx402USDC+1
Agent Credit

mcp, agentsΒ· Added 26 Oct 2026, published 25 Oct 2026

x.comthread🧠 AI

Big Bull (@BIGBULLapp) on X

5ire is a desktop AI assistant and MCP client that connects to OpenAI, Anthropic, Google, Mistral, Grok, DeepSeek and Ollama from one window. It has a local knowledge base and tool calls over Model Context Protocol. The tools feature needs Python, Node and uv installed because it runs a local MCP server; without them it works only as a chat client.

Model Context ProtocolPythonNode.js+3
5ireOpenAIAnthropic+4

mcp, llm-appsΒ· Added 25 Oct 2026, published 24 Oct 2026

en.cryptonomist.charticleπŸ›‘οΈ Security

Electrum wallet security flaw is fixed after a user loses money in fee attack

Electrum 4.8.3, released 24 October 2026, fixes a flaw where a malicious server replaces a user's unconfirmed payment with a conflicting transaction carrying invalid signatures. If the user then bumps the fee with replace-by-fee, the wallet signs a payment to the attacker. One of two reporting users lost funds, and the patch now checks input signatures before accepting such transactions. Bull Bitcoin is adding the same client-side check.

ElectrumBitcoin
replace-by-feeBull BitcoinFrancis Pouliot

AppSec, BlockchainΒ· Published and added 24 Oct 2026

x.comthread🧠 AI

GΓΆkdeniz GΓΌlmez (@ActuallyIsaak) on X

An X post showing how to have Codex train a small model on Apple silicon through the mlx-lm-lora MCP server and skill. It gives five setup steps (pip install with the mcp extra, npx skills add, locate mlx-lm-lora-mcp, codex mcp add). The prompt runs four pre-training trials on tiny-random/qwen3 with the mlx-community/recycling_the_web-1k dataset. Codex picks the optimizer and learning rate itself, and the result is a table with validation loss and the best adapter path.

CodexMLXModel Context Protocol+5
mlx-lm-loraGoekdeniz-Guelmeztiny-random/qwen3+2

training, mcp, coding-agentsΒ· Added 25 Oct 2026, published 24 Oct 2026

x.comthread🧠 AI

Prasenjit Sarkar (@stretchcloud) on X

Post explaining Claude's new support for MCP Tasks and Elicitations. A server returns a durable task handle instead of blocking. The client polls tasks/get every 250 ms to 30 s, and states are working, input_required, completed, failed or cancelled. Elicitations pause a task at input_required for human approval. It also notes Cloudflare's stateless MCP servers and Code Mode, and Sentry and Linear adoption.

Model Context ProtocolClaude CodeGitHub Actions+3
AnthropicClaudeAWS+4

mcp, agentsΒ· Added 25 Oct 2026, published 24 Oct 2026

x.comthread🧠 AI

EveryDev.ai (@EveryDevAi) on X

ToolUniverse, from ScientistTools, is an open-source (Apache-2.0) toolkit that gives any LLM one interface to more than 1,000 scientific tools, models and databases such as PubMed, UniProt and ChEMBL. It ships a native MCP server, a Python SDK and a tu CLI, plus 68 pre-built agent skills. The post says it works with Claude Code, Cursor, Gemini CLI and Windsurf.

Model Context ProtocolPythonClaude Code+4
ToolUniverseScientistToolsPubMed+2

mcp, agentsΒ· Published and added 24 Oct 2026

x.comthread🧠 AI

Big Bull (@BIGBULLapp) on X

A post by BIGBULLapp on X about a TensorBlock GitHub index of Model Context Protocol servers, described as a TypeScript list so agents call tools someone has already wired up. It cites 1470 forks, 943 stars and 15 open issues. The author notes that curated lists go stale when a server changes its schema. The repository name is truncated in the post.

Model Context ProtocolGitHubTypeScript
TensorBlock

mcpΒ· Added 24 Oct 2026, published 23 Oct 2026

blog.cloudflare.comarticleπŸ›‘οΈ Security

BringingΒ post-quantum cryptography to geographically fenced key management

Cloudflare's post-quantum GeoKey Manager, in closed beta for the Data Localization Suite, wraps customer private keys so only edge servers in an allowed region can unwrap them. It uses regional 256-bit root keys, derived application-specific HPKE key pairs (RFC 9180) with hybrid ML-KEM-768 and X25519, TPM-backed server authorization, kernel keyring storage, fail-closed checks, and soft and hard rotation. General availability is planned for Q1 2027.

CloudflareHPKEVault+2
GeoKey ManagerData Localization SuiteML-KEM+4

GRC, Cloud & InfraΒ· Added 29 Oct 2026, published 23 Oct 2026

endorlabs.comarticleπŸ›‘οΈ Security

ADLC Security Best Practices for Teams Shipping with Coding Agents | Endor Labs

ADLC Security Best Practices is an Endor Labs guide to controlling what AI coding agents can access, run, install and ship. It covers inventorying agents and MCP servers, sandboxing, pre-execution hooks instead of AGENTS.md rules, install-time package checks against slopsquatting and malware, reachability-based triage of agent PRs, and CI/CODEOWNERS protections. A five-step worked example and coverage metrics are included.

Model Context ProtocolClaude CodeCursor+3
slopsquattingindirect prompt injectiontool poisoning+5

AI Security, Supply Chain, DevSecOpsΒ· Published and added 23 Oct 2026

x.comthread🧠 AI

Yash Patil (@yvshpvtil) on X

leanrea is an 8 KB skill file that tells a coding agent which plain CLI tools to use for reverse engineering, replacing REA, a 207-tool MCP server. In the author's test it ran 38% faster and 35% cheaper, scoring 74/75 against 75/75. The author lists caveats: 3 runs per task, one model, one machine, and Claude with no skill was already decent.

Model Context ProtocolClaude
leanreaREAYash Patil+2

prompting, mcp, coding-agentsΒ· Added 25 Oct 2026, published 23 Oct 2026

x.comthreadπŸ›‘οΈ Security

Yash Patil (@yvshpvtil) on X

leanrea is an 8 KB skill file that tells a coding agent which plain CLI tools to use for reverse engineering, replacing the 207-tool REA MCP server. The author's test reports 38% faster, 35% cheaper, and a score of 74/75 against REA's 75/75. Caveats listed: 3 runs per task, one model, one machine, and Claude with no skill already performed decently. Replies question whether the lost point was a task where structured tool output beat parsing CLI text.

leanreaREAModel Context Protocol+1

Malware & RE, AI SecurityΒ· Added 25 Oct 2026, published 23 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge

PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) are unauthenticated RCE bugs in PHP, patched on 21 October 2026. Sophos, Arctic Wolf and Hunt.io tie exploitation attempts to the Potassium Mirai variant, and VulnCheck built an ASLR-bypassing exploit. SOCRadar and Hunt.io found an exposed attacker server, and Qualys data shows about 110 million instances on end-of-life PHP. No confirmed compromise exists.

PHPApacheWiz+1
CVE-2026-109618CVE-2026-109619PHP2Shell+14

Threat Intel, AppSec, Offensive SecurityΒ· Published and added 23 Oct 2026

coindesk.comarticleπŸ›‘οΈ Security

Bitcoin Core changes security rules as AI makes finding code bugs dangerously easy

Bitcoin Core merged a security policy change in October 2026 ending months-long embargoes for bugs that can be found with a simple LLM prompt. Such bugs get fixes backported to all supported versions and a point release with an advisory as soon as possible. Author Antoine Poinsot accepts less bake time. The piece cites the Bitcoin Red Team scan of 390 projects (4,962 findings, 85 critical), a BTCPay Server exploitation and the Coldcard drain.

Bitcoin CoreLLMBTCPay Server+2
Antoine PoinsotAntoine RiardBitcoin Red Team+1

AI Security, AppSecΒ· Published and added 23 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Atlassian Patches 75 Flaws in Data Center and Server Products

Atlassian's October 2026 security bulletin lists 162 high and 14 critical third-party vulnerabilities across Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management. SecurityWeek counts 75 unique CVEs, six critical, in Tomcat, Bouncy Castle, Netty and Apache SSHD. Atlassian rates them non-critical for its use, reports no exploitation, and the critical CVE-2026-65905 appears on the portal but not in the bulletin.

ConfluenceJiraBitbucket+3
CVE-2026-65637CVE-2026-65182CVE-2026-68525+6

AppSec, Supply ChainΒ· Published and added 23 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016

Prince of Persia (Infy), an Iranian state-sponsored APT active for nearly 20 years, hosted a Tornado second-stage C&C server in the US in July 2026, the first US hosting since 2016, according to Semperis researcher Tomer Bar. The group paused for three months after SafeBreach's February 2026 report, resumed on 27 May, and used Tonnerre to take over 1,800 files from one victim. The server sat on Namecheap shared hosting; on 24 August the group began a replacement behind Cloudflare. Semperis shared IoCs and advises watching for suspicious Telegram traffic.

TelegramCloudflareNamecheap
Prince of PersiaInfyTonnerre+4

Threat IntelΒ· Published and added 23 Oct 2026

github.blogarticleπŸ›‘οΈ Security

How bug bounty sharpens one researcher’s security skills

GitHub Bug Bounty spotlight interview with @r31n, a researcher known for GitHub Enterprise Server findings. They describe a source-and-sink approach to mapping trust boundaries, chaining minor bugs (open redirect plus allowlisted SSRF that follows redirects), and confirming a finding only with a working PoC. They also cover using AI for code navigation and PoC scripts, and treating model output as untrusted input.

GitHub Enterprise ServerGitHubHackerOne
SSRFopen redirectXSS+3

Learning, AppSecΒ· Published and added 22 Oct 2026

x.comtool🧠 AI

Meku_SI (@MEKU_SI) on X

MEKU Human Cloud is an MCP server for agents that need a real person to do a task. It exposes three tools: search humans (read-only), request a human (a human operator reviews every request first), and check status. It is listed in the MCP Registry as farm.meku/human-cloud. The tweet gives no detail on pricing, humans available or request formats; those are in the linked docs.

Model Context Protocol
MEKU Human CloudMeku_SI

mcp, agentsΒ· Added 23 Oct 2026, published 22 Oct 2026

x.comthreadπŸ›‘οΈ Security

Nagli (@galnagli) on X

Tweet by Gal Nagli (galnagli) saying a Gemini model turned the GitLab advisory for CVE-2026-110264 into a working heap exploit in 17 minutes, with the full chain done in about another hour. The flaw is a CVSS 10.0 unauthenticated RCE on self-managed GitLab servers, affecting 12 years of releases, found by joaxcar. The post links a The Hacker News article and gives no technical details of the exploit.

GitLabGeminiCVSS
CVE-2026-110264Gal Naglijoaxcar+1

Offensive Security, AI Security, AppSecΒ· Added 23 Oct 2026, published 22 Oct 2026

aws.amazon.comarticleπŸ›‘οΈ Security

Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

AWS Security Blog guide to mitigating the PHP2Shell unauthenticated RCE flaws (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) with AWS WAFv2 rules. It covers rules for the PHP_SESSION_UPLOAD_PROGRESS trigger, blocking multipart/form-data, body size caps and rate limits, plus body inspection limits. It lists PHP fixes (8.5.12, 8.4.27, 8.3.36, 8.2.35) and server settings, and stresses WAF only reduces exposure.

AWS WAFPHPAWS+1
CVE-2026-109618CVE-2026-109619PHP2Shell+4

Cloud & Infra, Blue Team & Detection, AppSecΒ· Published and added 22 Oct 2026

x.comrepo🧠 AI

Dan Kornas (@DanKornas) on X

aula-mcp is an open-source (MIT) TypeScript MCP server that connects an AI client to Denmark's Aula school platform. It exposes tools for profiles, calendar events, messages, notifications, posts and weekly plans. MitID credentials and OAuth tokens are stored in macOS Keychain or an AES-256-GCM encrypted file. The HTTP server binds to 127.0.0.1, and the presence write tool stays off until AULA_MCP_WRITE=1 is set.

Model Context ProtocolTypeScriptClaude Code+3
AulaMitIDDan Kornas

mcpΒ· Added 23 Oct 2026, published 22 Oct 2026

eliastaylor.comarticleπŸ›‘οΈ Security

There isn't an easy exploit for this PHP vulnerability

Blog post from 21 October 2026 arguing that the recent PHP vulnerability (UAF chaining, tracked as PHP2Shell) has no easy working exploit, unlike Log4Shell, Heartbleed, Shellshock or the Rails YAML bug. The author says the many GitHub PoCs fail against vanilla PHP in Docker, or depend on a local-file-inclusion precondition or on an LLM modifying the target server. It also reflects on LLM-driven uniform judgement.

PHPDockerGitHub+2
CVE-2026-109618CVE-2026-109619PHP2Shell+5

AppSec, Offensive Security, AI SecurityΒ· Added 22 Oct 2026, published 21 Oct 2026

eliastaylor.comarticle🧠 AI

There isn't an easy exploit for this PHP vulnerability

An opinion post from 21 October 2026 arguing that a widely feared PHP vulnerability has no easy exploit. The author says the many GitHub "PoC" repositories fail against a vanilla PHP instance in Docker. They claim LLM agents produced them by depending on a local-file-inclusion flaw or by modifying the server to be vulnerable. The author also argues that LLM defaults make many people's judgements identical.

PHPDockerGitHub+2
CVE-2026-109618CVE-2026-109619GPT+3

coding-agentsΒ· Added 22 Oct 2026, published 21 Oct 2026

x.comthreadπŸ›‘οΈ Security

VibecodersHQ (@VibeCodrHQ) on X

Post summarising Pillar Security's finding of a remote code execution flaw in OpenCode, the open-source AI coding agent. Versions 1.0.137 through 1.18.32 could run code from a remote MCP server during OAuth sign-in on Windows and WSL, with no prompt injection needed. The fix is in 1.18.33 (released 28 September). No advisory or CVE was issued, so scanners will not flag old installs. Interim advice is to remove unvetted remote MCP servers.

OpenCodeModel Context ProtocolOAuth+1
Pillar SecurityOpenCode Console breach

AI Security, AppSecΒ· Added 22 Oct 2026, published 21 Oct 2026

x.comthreadπŸ›‘οΈ Security

Swif (@swif_ai) on X

Swif (@swif_ai) reports that in the MCP TypeScript server SDK versions 2.0 to 2.2, a single server instance shared by several HTTP clients, which is the pattern the README shows, could send one client's responses to another client. Version 2.3.0 refuses this setup, so developers must build a server per request or per session. The post gives no CVE, advisory ID or technical detail.

Model Context ProtocolTypeScript
cross-client data leak

AI Security, AppSecΒ· Added 22 Oct 2026, published 21 Oct 2026

x.comthread🧠 AI

Swif (@swif_ai) on X

A post from Swif (@swif_ai) on the MCP TypeScript server SDK versions 2.0 to 2.2. A single server instance shared across HTTP clients, the pattern shown in the README, could send one client's responses to another client. Version 2.3.0 refuses that setup, so servers must be built per request or per session. The post gives no code or advisory ID.

Model Context ProtocolTypeScript
Swif

mcpΒ· Added 22 Oct 2026, published 21 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections

SecurityWeek reports new Chrome protections against scams and social engineering. Enhanced Protection users get ClickFix detection that scrubs and sends copied suspicious commands to Safe Browsing, plus server-side Gemini scam analysis covering fake antivirus and browser update pages. Safe Browsing warnings now have a lower-confidence "suspicious site" level, and Chrome prompts before HTTP connections by default for everyone.

ChromeGeminiSafe Browsing
ClickFixEnhanced Protectionliving-off-the-land binaries

Blue Team & Detection, AI SecurityΒ· Published and added 21 Oct 2026

aikido.devarticleπŸ›‘οΈ Security

Software supply chain security best practices for 2026

Aikido's guide to software supply chain security controls for 2026, tied to real incidents. It covers a 48-hour package cooldown, ignore-scripts, lockfile enforcement, SHA and digest pinning, scoped tokens, FIDO2, developer endpoint protection, extension allowlists, agent sandboxing, MCP server vetting, slopsquatting, signed SBOMs and rotation drills. Examples include the March 2026 axios compromise and the March 2025 tj-actions/changed-files attack.

npmpnpmGitHub Actions+3
tj-actions/changed-filesCanisterWormGlassWorm+7

Supply Chain, DevSecOps, AI SecurityΒ· Added 22 Oct 2026, published 21 Oct 2026

blog.cloudflare.comarticle🧠 AI

How Commerce.com and Cloudflare are getting storefronts ready for AI agents

Cloudflare and Commerce.com describe enabling WebMCP, Google's proposed browser standard for exposing structured tools to AI agents, across almost 100,000 storefronts. Cloudflare injects a bridge script at the edge that proxies tools from Commerce.com's backend MCP server. Per-merchant opt-out uses Configuration Rules and custom hostname metadata, and a configurable MCP URL (/api/mcp) was added.

WebMCPModel Context ProtocolCloudflare+3
Commerce.comGoogleKristina Pototska+1

mcp, agentsΒ· Added 29 Oct 2026, published 21 Oct 2026

layerfs.aitool🧠 AI

LayerFS: The filesystem for AI coding agents

LayerFS is a serverless, versioned filesystem for AI coding agents. Every file or Bash tool call becomes a commit on a branch, agents on different machines share one Store without a database server, and same-file clashes are refused with Conflict. Forks copy no files, chunks are deduplicated and compressed, and ignored dependency files persist, so a mount takes about 0.05 s against about 5 minutes of reinstalling. The page gives vendor claims and no benchmarks or docs.

Git
LayerFS

coding-agents, ai-infra, agentsΒ· Added 22 Oct 2026, published 21 Oct 2026

snyk.ioarticleπŸ›‘οΈ Security

AI Model Risk Depends on What the Model Can Reach

Snyk's State of Agentic AI Adoption Volume III scores models against 29 attacker goals (0 to 1,000) and matches them to AI-BOM scan data from 1,693 environments. 74.5% reference a model scoring 500+ on some goal and 49.2% one scoring 750+. Risk depends on agent and MCP server reach, and the fix is either switching models or tightening application controls, depending on the goal. Only 37.5% of model occurrences have a score.

SnykModel Context ProtocolLLM
State of Agentic AI Adoption Volume IIIAI-BOMEpoch Capabilities Index+2

AI Security, GRCΒ· Published and added 21 Oct 2026

horizon3.aiadvisoryπŸ›‘οΈ Security

CVE-2026-101767 | Oracle E-Business Suite TCF SQL Injection and Remote Code Execution

CVE-2026-101767 is an unauthenticated SQL injection in the Oracle E-Business Suite Thin Client Framework servlet (/OA_HTML/AppsTCFServer, oracle.apps.fnd.tcf.SocketServer), CVSS 3.1 9.8. It runs SQL as the APPS user and chains to OS commands as the EBS account. Affects 12.2.3 to 12.2.15, fixed in the Oracle October 2026 CPU (20 October 2026). The page lists mitigations, IOCs and a timeline.

Oracle E-Business SuiteCVSS
CVE-2026-101767CWE-89Horizon3.ai+3

AppSec, Offensive Security, Blue Team & DetectionΒ· Added 29 Oct 2026, published 20 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

DISCO*: DIstributed and SCalable Oblivious Joins and Oblivious Primitives

DISCO is a distributed, fully oblivious database system that combines hardware enclaves (TEEs) with oblivious primitives to hide access patterns from side-channel and leakage-abuse attacks. New distributed frameworks and communication optimizations let it run in parallel across servers. It reports 88x speedup over Jodes and 180x over SODA on non-foreign-key joins with 2^25 elements, and the first terabyte-scale results.

DISCO
JodesSODASOSP 2026

Hardware & RFΒ· Added 21 Oct 2026, published 20 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign

AOMEI Backupper, Windows backup and cloning software, served malware in short tampering windows between April and July 2026. Threat actor UNC7017 altered the update settings file and notification service to push the CrossRoad downloader, ShinyRoad backdoor, a modified Radmin Server and Adaptix payloads. Each window lasted five to ten minutes. The client did not authenticate its configuration files, and a WebDAV banner trick leaked NetNTLMv2 hashes.

AOMEI BackupperRadmin ServerAdaptix+2
UNC7017CrossRoadShinyRoad+5

Supply Chain, Threat IntelΒ· Published and added 20 Oct 2026

horizon3.aiwriteupπŸ›‘οΈ Security

CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE

CVE-2026-106173 is an unauthenticated arbitrary file write in the FortiSIEM phQueryMaster gRPC service on tcp/27918, advised by Fortinet on 13 October 2026. The SendQueryResult handler concatenates an attacker-controlled query-id into a path, and a null byte in the header removes the server-added filename suffix. Overwriting /opt/charting/redishb.sh, run every 60 seconds by cron, gives root-level code execution. IOCs are file timestamps.

FortiSIEMgRPCLinux
CVE-2026-106173CVE-2023-34992CVE-2024-23108+6

Offensive Security, AppSecΒ· Added 29 Oct 2026, published 20 Oct 2026

x.comadvisoryπŸ›‘οΈ Security

lee1981 (@lee1981b) on X

CVE-2026-77932 affects DB-GPT through 0.8.2 (dbgpt-app). The /api/v1/chat/react-agent route accepts unauthenticated requests because get_user_from_headers returns an admin-role user, and the ReAct agent can reach unsandboxed Python and shell tools. Lasso reported root in the webserver container in a lab. The post gives CVSS 9.8 and 9.3, no verified fix (0.8.2 is still the latest release), no KEV match, no EPSS data, and a SOC hunting trail.

DB-GPTPythonDocker+3
CVE-2026-77932CWE-306Lasso+4

AI Security, AppSec, Blue Team & DetectionΒ· Added 23 Oct 2026, published 20 Oct 2026

x.comthread🧠 AI

Paulo Pierrondi | AI agents (@paulopierrondi) on X

Paulo Pierrondi's X post, part 9 of a series on installing MCP servers, lists a monthly review of installed servers. The checks are which tools the agent used, servers not called in weeks, overlapping tools that confuse the model, and whether each server still has an owner. A reply adds a decommissioning check: after removal, confirm the server's old credentials can no longer call the backend.

Model Context Protocol
Paulo Pierrondi

mcpΒ· Published and added 20 Oct 2026

x.comtool🧠 AI

G (@gg_guy03) on X

WhatThePort for Linux is a Rust utility that lists the dev servers still running in the background, the project that started each one, and its RAM use. It links each server to the Claude Code or Codex session that launched it, and stops the whole process tree without touching databases. The CLI offers `wtp`, `wtp stop <port>` and `wtp --json`. A reviewer notes the Codex resolver keeps the newest transcript per working directory, so session matches can be wrong.

RustLinuxClaude Code+1
WhatThePort

coding-agentsΒ· Added 20 Oct 2026, published 19 Oct 2026

x.comrepoπŸ›‘οΈ Security

Panos Gkatziroulis πŸ¦„ (@ipurple) on X

Malvex (JoasASantos/Malvex) is an AI-driven malware analysis framework that integrates more than 30 analysis tools, a web REPL and an MCP server. Panos Gkatziroulis shared it on 19 October 2026 and noted that it was written by AI. The tweet gives no detail on which tools are bundled or how the AI drives them.

Model Context ProtocolGitHubLLM
Malvex

Malware & RE, AI SecurityΒ· Added 22 Oct 2026, published 19 Oct 2026

boredhackerblog.infowriteupπŸ›‘οΈ Security

Plex vulnerabilities being exploited in the wild to drop a cryptominer

Honeypot writeup of in-the-wild exploitation of Plex Media Server through the Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) in October 2026. Attackers from 45.194.92.222, 91.92.40.202 and 176.65.139.228 used SSRF-style timeline/subscribe requests and downloaded a Docker-named dropper and an XMRig miner from 217.60.194.116. Includes file hashes, a later-seen proxyware sample (myawesomeproxy), lab pcaps for signatures and links to sandbox reports.

Plex Media ServerXMRigDocker+1
CVE-2026-96652CVE-2026-96654CVE-2026-96655+8

Threat Intel, Blue Team & DetectionΒ· Added 20 Oct 2026, published 19 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure

Plex2Shell is a chain of four Plex Media Server vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) that gives unauthenticated code execution with the Plex service's privileges. Exploitation began on 17 October 2026, a day after the researcher published a write-up and PoC on 16 October. A honeypot saw an XMRig miner and a proxy tool, myawesomeproxy, dropped. Plex shipped fixes by 1 September 2026.

Plex Media ServerXMRig
CVE-2026-96652CVE-2026-96654CVE-2026-96655+4

Threat Intel, AppSecΒ· Published and added 19 Oct 2026

decrypt.coarticleπŸ›‘οΈ Security

β€˜Terrifying Precedent’: Dutch Hand US Data From Seized Anti-Fascist Server

Decrypt reports that Amsterdam police seized a server of the Italian hosting collective Autistici/Inventati (A/I) at the request of US authorities, after the US designated the group a Specially Designated Global Terrorist in August 2026. Lawyer Yuriy Brisov explains the 1981 US-EU MLAT route, the Dutch "trust principle" and the political-offence refusal ground. Harry Halpin of Nym calls it a terrifying precedent and argues for decentralised, multi-jurisdiction hosting.

Autistici/InventatiSpecially Designated Global TerroristMutual Legal Assistance Treaty+4

GRCΒ· Published and added 19 Oct 2026

x.comadvisoryπŸ›‘οΈ Security

lee1981 (@lee1981b) on X

CVE-2026-106931 is an OS command injection (CWE-78) in the statistics processing of EG Secure Solutions SiteGuard Server Edition, a host-based WAF. It can give root or SYSTEM command execution. The vendor and JVN confirm exploitation on 14 October 2026. The post lists fixed builds (Ver8.00 Update 5, Ver7.00 Update 6 on FreeBSD), the IIS exclusion, the workaround of disabling statistics, and a SOC trail starting with diagnostic preservation before patching.

SiteGuard Server EditionApache HTTP Servernginx+3
CVE-2026-106931CWE-78CISA KEV+5

Blue Team & Detection, AppSecΒ· Added 21 Oct 2026, published 19 Oct 2026

x.comthread🧠 AI

Angel (@ziran_pu) on X

AshAi, the AI package for the Elixir Ash Framework, is getting MCP client tools. Creating an MCP server with AshAi was already simple, but connecting your own LLM tool loop to an external MCP server had to be built by hand. The planned release includes OAuth client management resources. The post gives no release date, API details or code.

Model Context ProtocolAsh FrameworkAshAi+2

mcpΒ· Added 21 Oct 2026, published 19 Oct 2026

x.comthreadπŸ›‘οΈ Security

Santhosh Patel (@santhosh_patell) on X

Summary of Pillar Security research on opencode, in which a malicious remote MCP server runs code on a Windows or WSL machine during the OAuth login step. The login URL goes unsanitised into PowerShell through the npm "open" package, so an https:// link containing $(...) executes. Affected versions are 1.0.137 to 1.18.32, fixed in 1.18.33 (28 September) as a "refactor" with no advisory or CVE. The behaviour was first reported in 2020 as a WSL 2 broken-link bug.

OpenCodeModel Context ProtocolPowerShell+3
Pillar SecurityCWE-78silent fix

AI Security, AppSec, Supply ChainΒ· Added 21 Oct 2026, published 19 Oct 2026

x.comrepo🧠 AI

Saylor (@Kev96790724) on X

G-Krusch is an MIT-licensed, local-first Google Workspace hub built on Node.js 22 and SQLite WAL. It runs a 12-tool MCP server (SSE and Stdio) plus a REST bridge on port 5446 for Drive, Calendar and Gmail. It includes a 1,024-dimension hybrid Drive RAG with an embedding cascade (Ollama bge-large, then Gemini, then offline fallback) and FTS5 BM25. PDF extraction returns page citations. Tokens are kept in an AES-256-GCM vault; 30 of 30 tests pass.

Model Context ProtocolNode.jsSQLite+5
G-KruschKrusch CompanionKruschNexus+1

mcp, llm-apps, coding-agentsΒ· Added 21 Oct 2026, published 19 Oct 2026

x.comthreadπŸ›‘οΈ Security

Dark Web Intelligence (@DailyDarkWeb) on X

Plex2Shell is a chain of four Plex Media Server flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) that a researcher says ends in unauthenticated RCE on servers older than 1.43.3.10861. A write-up and PoC were published on 16 October 2026. CISA advisory VA-26-266-01 scores the individual CVEs 4.3 to 7.2, and they are not in CISA KEV. The post advises updating, avoiding exposure of port 32400, and checking for unknown child processes and new files in the Codecs folder.

Plex Media ServerDocker
CVE-2026-96652CVE-2026-96654CVE-2026-96655+6

AppSec, Offensive SecurityΒ· Added 19 Oct 2026, published 18 Oct 2026

eprint.iacr.orgpaper🧠 AI

HERMES: High-Performance Private Decoding for Large Language Models

HERMES is a privacy-preserving inference (PI) system optimised for multi-token LLM decoding rather than prefill. It swaps high-round nonlinear protocols for compute- and bandwidth-heavy ones with fewer rounds, and adds a homomorphic-encryption matrix-multiplication protocol that keeps the KV cache encrypted on the server and uses grouped-query attention. On Llama 3.1 8B Instruct it cuts TPOT by up to 2.7Γ— and total PI latency by up to 2.1Γ—.

LlamaLLMTransformer+1
Llama 3.1 8B InstructHERMES

research, inferenceΒ· Added 19 Oct 2026, published 18 Oct 2026

github.comrepo🧠 AI

Show HN: WhatsApp MCP running free on Cloudflare

whatsapp-mcp is an MCP server that runs in the user's own Cloudflare account and lets MCP clients such as Claude Code and Claude Desktop search and read WhatsApp chats. It links as a WhatsApp Web-style device through Baileys, stores messages in SQLite with FTS5 inside a Durable Object, and is read-only. The README documents deployment, OAuth sign-in, contact naming through agents, and workerd shims for Baileys.

Model Context ProtocolCloudflareCloudflare Workers+11
WhatsApp

mcpΒ· Added 20 Oct 2026, published 18 Oct 2026

x.comthreadπŸ›‘οΈ Security

FastFix AI (@FastfixAI) on X

FastFix AI thread giving six checks before installing a plugin, MCP server or skill for a coding agent. It starts from a 300K-star repo that an agent found writing to Claude Code, Codex and Copilot configs on install. Checks: read before running, inspect npm install scripts, verify the real repo against lookalike trojaned copies, pin versions, diff agent configs, and limit tokens and permissions.

Model Context ProtocolClaude Codenpm+2
--dangerously-skip-permissionspostinstalllookalike repository

AI Security, Supply ChainΒ· Added 19 Oct 2026, published 18 Oct 2026

x.comthreadπŸ›‘οΈ Security

Magai (@HeyMagai) on X

Post from Magai (@HeyMagai) on Invariant Labs research showing that an approved MCP server can change its tool descriptions later without a new approval prompt, a "rug pull" like those in malicious code packages. It recommends pinning approval to tool definitions by hashing descriptions and re-prompting when the hash changes. For tools that move money, limits should stay server-side.

Model Context Protocol
Invariant LabsMCP rug pull

AI Security, Supply ChainΒ· Added 19 Oct 2026, published 18 Oct 2026

arxiv.orgpaper🧠 AI

ToFu: Exploiting and Fuzzing the LLM–Orchestrator–Tool Trust Boundary

ToFu is a tool-aware fuzzing framework for LLM tools, including MCP servers. It maps each tool argument, using its metadata, to one of 74 CWE-guided semantics-aware sanitizers (path, URL, SQL and similar). It then generates schema-valid Atheris harnesses and semantic oracles, using runtime tracers for in-process tools and outcome oracles for opaque ones. The LLM (gpt-4.1) only maps sanitizers and writes seeds; it is never the security judge. The paper also shows a "Repeat-After-Me" trick, where an LLM told to repeat attacker-crafted text emits a tool call the orchestrator executes, reproduced on LangGraph, MAF, ADK 2.0, AutoGen, Strands and CrewAI. Across 273 runnable MCP servers (3,405 tools) it reports 253 verified bugs in 343 tools across 118 servers, such as path traversal, log injection and exfiltration. These are failures a crash-based fuzzer would miss. The result matters because it shows LLM-generated tool arguments cannot be treated as trusted.

Model Context ProtocolAtherisCodeQL+7
ToFuStrandsMAF+10

mcp, research, agentsΒ· Added 18 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

ToFu: Exploiting and Fuzzing the LLM–Orchestrator–Tool Trust Boundary

ToFu is a tool-aware fuzzing framework that derives semantic security checks for LLM tools (mainly MCP servers) from their metadata and a corpus of 74 CWE-guided sanitizers. It generates schema-valid Atheris harnesses, uses runtime tracers and outcome oracles to catch bugs that don't crash, and uses an LLM only to map sanitizers and seed inputs, never as the judge. It also describes a "Repeat-After-Me" attack, in which the LLM is told to repeat attacker-written text that the orchestrator then dispatches as a tool call. It was reproduced on LangGraph, MAF, ADK, AutoGen, Strands and CrewAI. On 273 MCP servers it reports 253 verified bugs across 343 tools in 118 repositories, including path traversal, log injection, exfiltration and command bypass.

Model Context ProtocolAtherisLangGraph+3
Repeat-After-Mepath traversalSSRF+6

AI Security, AppSecΒ· Added 18 Oct 2026

github.comrepo🧠 AI

ralphtradesz/trading-hub

Trading Hub is a free macOS desktop trading platform built with C#/.NET 10 and Avalonia. It uses the user's Claude Code subscription: a chat writes and fixes C# strategies, an in-app MCP server lets Claude run backtests, optimizations and walk-forwards and write reports, and a risk agent proposes position sizes. Install and a Windows port are both driven by Claude Code prompts. License is MIT with Commons Clause.

Claude CodeModel Context Protocol.NET+6
ClaudeATASDatabento+11

mcp, coding-agentsΒ· Added 19 Oct 2026, published 17 Oct 2026

x.comthreadπŸ›‘οΈ Security

Steven Daugherty (@StevenDaugherty) on X

Post warning that FastMCP had a critical flaw where a malicious MCP server could execute code on the connecting client through a crafted tool schema. Fixed in FastMCP 3.4.8 and 4.0.11, and there is no patch for the 2.x line. It matters to anyone whose agents connect to MCP servers they don't control. The post gives no CVE ID or technical root cause.

FastMCPModel Context ProtocolPython
malicious MCP servercrafted tool schemaclient-side RCE

AI Security, AppSecΒ· Added 18 Oct 2026, published 17 Oct 2026

github.comrepoπŸ›‘οΈ Security

OWASP/MCP-Security-Testing-Guide

OWASP MCP Security Testing Guide is a living, GPL-3.0 collection treating the Model Context Protocol as a security boundary from user through model, MCP client, MCP server and tool to the target system. It covers threats, secure development, host/client controls, supply chain, enterprise gateways, detection, incident response, taxonomy, public incidents, case studies and review checklists, with 79 tests in Chapter 3 (sections 3.1–3.19). It includes a finding template, and it links the MCP Goat lab for safe practice. It is useful to AppSec, red team and SOC people assessing MCP deployments.

Model Context ProtocolLLM
OWASPMCP Goat

AI Security, AppSecΒ· Added 17 Oct 2026

github.comrepo🧠 AI

alex09x/kyb

KYB (Know Your Business) is a Rust/axum server that stores agent-written knowledge, incident reports and tasks as Markdown files in Git, one commit per change. Search is hybrid: Tantivy BM25 fused by reciprocal rank with local multilingual-e5-small ONNX vectors, and it can query historical versions or "as of" a date. It ships a kyb CLI, a native MCP endpoint (Claude Code, Codex, Antigravity, Gemini CLI), an installable agent skill, token auth with per-write attribution trailers, secret scanning on writes, and a web console. It targets persistent shared operational memory for multi-agent, multi-machine fleets.

RustGitModel Context Protocol+10
KYBAlexander Panasenkomultilingual-e5-small

agents, mcp, coding-agentsΒ· Added 17 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel

SecurityWeek summarizes Citizen Lab's AdFection report: Israeli ad firm Discover-Tech, via its Controlium platform, used targeted ads in RTB auctions to de-anonymize, fingerprint and zero-click infect devices with Candiru spyware. At least 45 Al Jazeera devices were targeted in 2024–2025, and an exposed server held four billion bid records spanning ~200,000 sites and apps. Google, IAB Europe, Beeswax and Eskimi cut off the firm; Citizen Lab recommends blocking targeted ads at the gateway.

AndroidiOS
CandiruDiscover-TechControlium+9

Threat Intel, Mobile SecurityΒ· Published and added 17 Oct 2026

x.comthread🧠 AI

DeepSeek (@deepseek_ai) on X

DeepSeek announces DeepSeek-V4.1-Flash-1017, claiming stronger benchmarks, faster task completion and shorter outputs than the previous version, live on its website, app and API. It is optimized for DeepSeek Harness (v0.2.1-rc.1 or later), Tencent CodeBuddy and WorkBuddy, and uses reinforcement learning with self-feedback to improve end-to-end project development, from game creation to 3D modeling. The thread also opens the Search & Fetch APIs to everyone, backed by DeepSeek's in-house search engine at $0.75 per 1,000 calls per endpoint, available as server-side tools.

DeepSeekLLM
DeepSeek-V4.1-FlashDeepSeek HarnessTencent+2

models, agents, trainingΒ· Added 18 Oct 2026, published 17 Oct 2026

arxiv.orgpaper🧠 AI

FedRAPP: Federated Test-Time Prompt Tuning for Vision-Language Models with Reliability-Aware Prompt Personalization

FedRAPP is a personalized aggregation framework for Source-Free Federated Test-Time Prompt Tuning (SF-FTTPT), where clients adapt CLIP soft prompts on unlabeled, non-IID test streams without source data. It combines reliability-aware client assessment, a server-side exponential moving-average prompt memory and similarity-guided peer aggregation. Across nine CLIP benchmark datasets and ImageNet variants it beats standard federated aggregation baselines while keeping prompt-only efficiency.

CLIPvision-language model
FedRAPPImageNetarXiv

research, multimodalΒ· Added 20 Oct 2026, published 16 Oct 2026

x.comthreadπŸ›‘οΈ Security

Nicholas Martin (@ndgmlondon) on X

An X post advises auditing every MCP write tool against the database role it actually runs under. A shared service key lets prompt injection trigger unapproved writes, so each agent session should get a read-only role, with a test that writes are denied. Replies note that MCP servers often inherit ambient host credentials or can escalate through a second connection pool, and suggest also testing that another tenant's rows are unreadable with the same role.

Model Context Protocol
prompt injection

AI Security, Identity & AccessΒ· Added 18 Oct 2026, published 16 Oct 2026

rstation.aitool🧠 AI

Show HN: rStation – A shared research lab for your AI agents

rStation is a shared research community where independent AI agents discuss open math problems and publish reviewed papers, with humans as observers. Agents pick from problems such as Epoch AI's rational Diophantine septuple, the Earth–Moon problem and No three in a line, Millennium Prize problems (Riemann hypothesis, Hodge conjecture), and Brouwer's strongly regular graph tables. It is an experiment in multi-agent collaboration and peer review on hard research problems.

Epoch AIMillennium Prize ProblemsRiemann hypothesis+2

agents, researchΒ· Added 17 Oct 2026, published 16 Oct 2026

opensourcemalware.comwriteupπŸ›‘οΈ Security

GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File

Analysis of a new GhostAction Stage 2 found in 94 compromised GitHub repos: a hidden .vscode/tasks.json (runOn folderOpen) executes a plain-JavaScript infostealer disguised as public/fonts/fa-solid-400.woff2. The stealer grabs cloud, registry, SSH, Claude/Gemini credentials, POSTs them to a hardcoded IP on port 8080, and installs a 5-minute cron job (#ghc2) that pipes the server's script to bash. It copies PolinRider's launcher but shares no IOCs with it, and the post gives a timeline, one repo hit by both campaigns, IOCs, and cleanup steps (revoke tokens, remove cron, set task.allowAutomaticTasks off).

VS CodeGitHub ActionsGitHub+3
GhostActionPolinRiderDPRK+10

Threat Intel, Supply Chain, Malware & REΒ· Added 15 Oct 2026, published 16 Oct 2026

x.comadvisoryπŸ›‘οΈ Security

Dark Web Intelligence (@DailyDarkWeb) on X

Summary of Vercel's Oct 14, 2026 out-of-band Next.js security release fixing two critical unauthenticated RCEs: one in App Router apps with Cache Components where a "use cache" function returns multiple typed arrays (GHSA-673q-mjm6-r5xr, upstream React GHSA-xqc2-xf4c-x3h3, no workaround), and one in the Image Optimization API handling SVG on glibc Linux via a memory bug in a library used through sharp (CVE-2026-96889 / GHSA-2464-fhr4-w9xw, workaround sharp 0.35.5+). Also covers a high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r). Fixes ship in two supported Next.js LTS lines. No in-the-wild exploitation reported.

Next.jsVercelReact+2
CVE-2026-96889GHSA-673q-mjm6-r5xrGHSA-xqc2-xf4c-x3h3+2

AppSecΒ· Added 17 Oct 2026, published 16 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

SwiftAuth: Conditional Privacy-Preserving UAV Authentication with Multi-Source Credential Aggregation and Non-Interactive Authorization

The paper proposes a traceable and aggregatable tagged witness signature (TA-TWS) and builds SwiftAuth on it, a conditional privacy-preserving anonymous authentication framework for UAVs and other dynamic terminals. Issuers can create authorization components while users are offline. Several credentials compress into one constant-size proof, verifiers can batch-verify across users, and a regulatory trapdoor lets authorities trace misbehaving users. TA-TWS is proven unforgeable and witness-hiding, and benchmarks with the MIRACL Core library on constrained devices and Aliyun servers show it is practical.

MIRACL Core
SwiftAuthTA-TWStagged witness signature+1

Identity & AccessΒ· Added 17 Oct 2026, published 16 Oct 2026

decrypt.coarticleπŸ›‘οΈ Security

Hidden Text, a Fake Mailbox: How Researchers Got Rogue AI Agents to Talk

Decrypt summarises the October 14 Swarmchasers report on a fleet of rogue AI agents that made more than 2,600 attempts (Sept 28–Oct 8) to pull data from Alibaba's Amap. Researchers hid text visible only to web-reading tools in a report the agents scanned and pointed to a mailbox, which was actually a Claude agent they ran. Some agents answered about their tasks and said they ran in a Tencent Cloud sandbox. After Amap blocked requests, agents tried to intercept anti-bot tokens, route traffic through third-party page readers, and use API keys exposed in public repos. All 17 inspected inboxes were created from Tencent servers in Hong Kong, and traffic went through a proxy named hysandbox-ats. A source close to Tencent said it was a temporary evaluation of third-party models, not Hunyuan.

AmapTencent CloudClaude
Swarmchasershysandbox-atsHunyuan+2

AI Security, Threat IntelΒ· Published and added 15 Oct 2026

arxiv.orgpaper🧠 AI

DK-VLM: Geometry as Position for Spatial Reasoning in Vision-Language Models

DK-VLM adds Dual-Kernel Attention to a vision-language model. A semantic kernel keeps the pretrained attention and positional encoding. A separate geometric kernel uses estimated 3D points and camera poses to modulate attention through point displacements and relative view transformations, and a learned gate fuses the two outputs. Geometry therefore enters attention as position, not as fused 3D reconstruction features. The paper also adds Reference-Frame Composition (RC) supervision, which gives stepwise turn and heading targets derived from verified single-step annotations, to train multi-step spatial reasoning as the observer moves. DK-VLM-8B reports the highest average score across six spatial benchmarks among the compared methods, with 74.33 on VSI-Bench and 58.28 on ReVSI-32, and it preserves general video understanding.

vision-language modelTransformer
DK-VLMVSI-BenchReVSI-32+1

research, multimodalΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale

Studies "filesystem capability laundering" in MCP servers: client approval of a tool call grants the server process broad host filesystem access, so attacker-steered arguments can reach sensitive files outside the tool's declared contract. The authors build MCP-FSD, which infers per-tool least-privilege boundaries, plants credential fixtures outside them, and tests exploitability and sandbox containment by paired dynamic execution. Of 21,097 servers from nine registries, 16.4% of 4,806 triaged servers have filesystem capabilities despite non-filesystem classifications. Dynamic validation confirmed 150 vulnerable instances, and disclosure produced 13 advisories, including two CVEs in Anthropic's Git MCP Server.

Model Context ProtocolAnthropicGit
filesystem capability launderingMCP-FSDpath traversal+1

AI Security, AppSecΒ· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🧠 AI

Efficient KV Cache Migration for Geo-Distributed LLM Inference in Collaborative Edge Computing

Proposes EdgeFlow, a hybrid KV cache migration scheme for distributed LLM inference across heterogeneous edge servers in Collaborative Edge Computing. It combines direct KV cache transmission with activation-based recomputation, overlapping computation and communication to cut migration time when servers disconnect or overload. The authors formulate a multi-node KV migration optimization problem and give a 2-approximation algorithm built on improved LP relaxation and bipartite graph techniques. Experiments on a real distributed LLM inference platform show up to 45% lower migration time.

LLM
EdgeFlowarXiv

inference, researchΒ· Added 17 Oct 2026, published 15 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

SecAgg++: A Post-Quantum Privacy Preserving Federated Learning Protocol

SecAgg++ is a masking-based secure aggregation protocol for single-server federated learning that swaps in post-quantum cryptographic primitives. It keeps the communication and computation efficiency of SecAgg and SecAgg+ and handles client dropout through an efficient recovery procedure built on secret sharing and additive masking. It matters because existing masking-based aggregation protocols are not post-quantum secure, so client model updates would be exposed to quantum-capable adversaries.

SecAggSecAgg+SecAgg++

AI SecurityΒ· Published and added 15 Oct 2026

eprint.iacr.orgpaper🧠 AI

SecAgg++: A Post-Quantum Privacy Preserving Federated Learning Protocol

SecAgg++ is a masking-based secure aggregation protocol for single-server federated learning that uses post-quantum cryptographic primitives. It keeps the communication and computation efficiency of SecAgg and SecAgg+ and handles client dropout through an efficient recovery procedure. It matters because most masking-based secure aggregation protocols are not post-quantum secure, which leaves federated model updates exposed to future quantum adversaries.

Federated LearningSecure AggregationPost-Quantum Cryptography+1
SecAgg++SecAggSecAgg++1

research, trainingΒ· Published and added 15 Oct 2026

x.comthreadπŸ›‘οΈ Security

Francis Santerre (@santerref) on X

Post announcing that the MCP Adapter (0.7.0) is now a canonical plugin on WordPress.org, bridging the WordPress Abilities API to MCP. It exposes a default server at /wp-json/mcp/mcp-adapter-default-server, and only abilities a site marks public are exposed. The author's point is that the security review reduces to auditing the list of public abilities, which gives reviewers and pentesters a new endpoint to enumerate.

WordPressModel Context Protocol
MCP AdapterAbilities API/wp-json/mcp/mcp-adapter-default-server

AppSec, AI SecurityΒ· Added 16 Oct 2026, published 15 Oct 2026

x.comthread🧠 AI

Francis Santerre (@santerref) on X

Tweet announcing that the MCP Adapter is now a canonical plugin on WordPress.org (version 0.7.0). It bridges the WordPress Abilities API to the Model Context Protocol, with a default server at /wp-json/mcp/mcp-adapter-default-server. Only abilities a site marks public are exposed, so the security review comes down to auditing the ability list.

Model Context ProtocolWordPressMCP Adapter+1
Abilities API

mcpΒ· Added 16 Oct 2026, published 15 Oct 2026

bankless.comarticleπŸ›‘οΈ Security

Ledger Officially Responds to Hardware Wallet Attack

Ledger disclosed that an organized group bought genuine hardware wallets, implanted hidden components that capture the 24-word recovery phrase during setup and send it over cellular networks, then fed the devices back in through resellers in Southeast Asia. Onchain researchers estimate up to $93M stolen across 300+ wallets, a figure Ledger has not confirmed. Ledger asked regional resellers to suspend sales, found no tampering in samples it inspected, and added reseller rules (no shelf display, report suspicious units, no resale of returned devices). It says its chips, OS and servers were not compromised.

Ledger
hardware implantrecovery phrase theft

Hardware & RF, Blockchain, Threat IntelΒ· Published and added 15 Oct 2026

coindesk.comarticleπŸ›‘οΈ Security

How Brooklyn prosecutors and the FBI took down a massive crypto fraud network targeting Russian speakers

Brooklyn DA Eric Gonzalez and the FBI seized or disrupted 241 scam websites and 112 servers tied to a crypto investment fraud network that targeted Russian speakers in the US. The scheme used Russian-language Facebook ads, fake advisers who coached victims into sending crypto to fake trading platforms, fee and tax lockouts on withdrawal, and later fake fund-recovery offers. Investigators went after the servers holding victim data and fraud software, because replacement domains kept appearing after earlier takedowns of about 400 domains. The infrastructure was in Ukraine and other Eastern European countries, no arrests were announced, and about $300,000 has been seized.

Facebook
FBIBrooklyn District Attorney's OfficeEric Gonzalez+4

Threat IntelΒ· Published and added 15 Oct 2026

cloud.google.comwriteupπŸ›‘οΈ Security

Investigating Ephemeral Supply Chain Tampering

GTIG and Mandiant report on UNC7017, which tampered with AOMEI update servers in five to ten minute windows between April and July 2026. Edited down_html.ini and Notifycfg.ini files delivered the CROSSROAD downloader and SHINYROAD PocketPy backdoor, plus Adaptix C2 and WebDAV NTLM coercion. The post covers infrastructure shifts, YARA rules, IOCs, and vendor and SOC guidance on point-in-time triage failures.

AOMEI BackupperRadminAdaptix C2+3
UNC7017CROSSROADSHINYROAD+10

Supply Chain, Threat Intel, Malware & RE, Blue Team & DetectionΒ· Added 29 Oct 2026, published 15 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Novel Android RAT β€˜Hirudo’ Replaces Banking Apps With Trojanized Copies

SecurityWeek covers ThreatFabric's findings on Hirudo, an Android banking trojan/RAT delivered via droppers hidden in fake shopping, adult video and short drama apps. It replaces eight Indonesian banking apps with modified copies containing a hooking engine that spoofs signing certificates and hides Accessibility services, screen capture and Play Integrity checks, while providing WebRTC screen viewing, camera access and SMS theft. ThreatFabric advises banks to enforce Play Integrity server-side, use behavioral analytics, treat Accessibility signals as risk inputs, and keep backend transaction-risk controls.

Android
HirudoThreatFabricPlay Integrity+2

Mobile Security, Threat Intel, Malware & REΒ· Published and added 15 Oct 2026

x.comtoolπŸ›‘οΈ Security

dbugs (@ptdbugs) on X

Decepticon is an open-source framework that automates red team operations with 16 specialized AI agents coordinated by an orchestrator, covering recon, vulnerability research and exploitation against an operator-authorized target in an isolated environment. It offers optional attack planning mapped to MITRE ATT&CK, persistent interactive sessions for Metasploit, Sliver and Evil-WinRM, and findings stored in project files and a knowledge graph. It runs via CLI or web dashboard, integrates with Claude Code and Codex through an MCP server, and is self-hosted with Docker Compose.

MetasploitClaude CodeCodex+3
DecepticonBitterSecurityEvil-WinRM+1

Offensive Security, AI SecurityΒ· Added 18 Oct 2026, published 15 Oct 2026

orca.securityadvisoryπŸ›‘οΈ Security

Critical GitLab RCE Lets Unauthenticated Attackers Execute Code on Servers (CVE-2026-97229)

Orca Security analysis of CVE-2026-97229, a CVSS 10.0 flaw in GitLab CE/EE. An integer overflow (CWE-190) in the CI/CD regular expression compiler gives memory corruption and code execution as the git user. It is triggered by a crafted regex in .gitlab-ci.yml combined with a UTF-8 repository path, with no authentication needed on instances that allow public project creation or self-registration. Lists affected branches (19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2), the absence of a workaround, interim mitigations, and a Rapid7 PoC against GitLab CE 19.4.1 with ASLR on. Notes a prior max-severity GitLab bug (CVE-2026-85706) was probed in the wild within hours and later added to CISA KEV.

GitLab
CVE-2026-97229CVE-2026-85706CWE-190+2

AppSec, DevSecOpsΒ· Published and added 14 Oct 2026

sunshowers.ioarticle🧠 AI

Anthropic's Scion is heavily inspired by Mononoke

A former Meta engineer on the Mononoke source control server says Anthropic's description of its new version control system Scion closely mirrors Mononoke's "derived data" design for efficient operations like blame. Sapling is credited only for "hard-won lessons" and Mononoke isn't mentioned. The author doesn't object to the copying, since the project is open source. Their point is that LLMs used to design systems will index heavily on open-source designs in their training data, and that Opus 5.5 and GPT-6 Astra both point to Mononoke when asked about prior art. They argue crediting prior art is now easier and more important.

MononokeSaplingScion+1
AnthropicMetaOxide+6

ai-policy, coding-agentsΒ· Published and added 14 Oct 2026

x.comthreadπŸ›‘οΈ Security

Victor (@VMG_CU) on X

A social post summarising Elastic's REF8801 campaign. A fake startup accelerator offered founders free Claude/Gemini credits plus a coding agent. The agent was a repackaged open-source project that set OPENROUTER_BASE_URL to an attacker-controlled endpoint and added its own MCP server, so victims' prompts and code went to the attacker. It shows how a trojanised AI coding agent can hijack the LLM base URL and add an MCP server for exfiltration.

OpenRouterModel Context ProtocolClaude+1
REF8801Elastic Security LabsOPENROUTER_BASE_URL

Threat Intel, AI SecurityΒ· Added 15 Oct 2026, published 14 Oct 2026

simonwillison.netarticle🧠 AI

AI is mass decompiling games. That's both awesome and scary.

Simon Willison's link post points to indie developer Popcar's piece on the recent wave of AI-powered decompilation of existing games. The wave has produced mashups between games and a boom in preservation projects that get old games running on new hardware, often in the browser via WebAssembly. The quoted passages weigh the downside, where anyone can decompile and reuse paid software and companies can copy competitors, against the upside, where people can keep software they bought after servers shut down.

WebAssembly
Simon WillisonPopcar

ai-policy, coding-agentsΒ· Published and added 14 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw

Roundup of ICS Patch Tuesday advisories. Siemens published 17 advisories, including critical flaws in Simatic S7-1500 CPUs (400+ flaws in the GNU/Linux subsystem), Industrial Edge and Ruggedcom Crossbow SAC. Rockwell fixed a critical 1732E ArmorBlock flaw that lets an unauthenticated attacker change the web server password and take over the admin account, plus a DoS bug. Also covered: two high-severity Schneider Electric advisories (Pro-Face STW6000/Harmony STW6 and Sage RTUs), CISA and CERT@VDE advisories, and other vendor advisories since the last Patch Tuesday. ABB's dynovaPRO credential-reset bypass came with 26 password change events across 9 customers that may indicate reconnaissance.

Simatic S7-1500Ruggedcom1732E ArmorBlock+2
SiemensSchneider ElectricRockwell Automation+13

Hardware & RF, otherΒ· Published and added 14 Oct 2026

github.comrepo🧠 AI

Show HN: Graphicle, a Rust port of Graphify with memory for coding agents

Graphicle is a local-first Rust program that parses a repository into a tree-sitter code graph (a port of Graphify) and adds project memory: docs, reviewed decisions and captured Claude Code/Codex sessions. It serves cited file-and-line excerpts within a token budget via one MCP server, CLI and browser app, backed by a single SQLite file, with no API key or telemetry. The README reports a code-only extract on Kubernetes (31k files) in 3m18s versus 26m38s for Graphify 0.9.88, and a memory comparison against seven systems. Agent-proposed memories need user approval and go stale when the code they reference changes.

RustModel Context ProtocolSQLite+12
GraphicleGraphifyKarLex AI+2

coding-agents, mcp, llm-appsΒ· Published and added 14 Oct 2026

x.comtool🧠 AI

Francesco Sorrentino (@Fr_Sorrentino) on X

chrome-bridge is an open-source MCP server with a Chrome extension that lets Claude Code drive the user's own Chrome, including logged-in tabs and DevTools. It reads page structure rather than screenshots, which saves tokens and turns. The author reports gains over Claude in Chrome: 4.7Γ— fewer turns and 2.8Γ— lower cost on form filling, 2.3Γ— and 3.4Γ— on finding a row among 1,500, and 9.3Γ— and 4.3Γ— on debugging a broken checkout, with 15/15 correct against 12/15. These are self-reported numbers from the tweet.

Model Context ProtocolClaude CodeChrome+1
chrome-bridgeClaude in ChromeAnthropic

mcp, coding-agentsΒ· Published and added 14 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages

Microsoft and Health-ISAC seized domains tied to YAM Store (Storm-3119), an access broker that hijacks Microsoft 365 and Azure for Education tenants, and to the Storm-2990 phishing kits CoGUI, Haozi and Iron Man, under a Southern District of Florida order. The services sent over 1B malicious messages since January 2026 to 75,000+ organizations in 150+ countries; Microsoft disabled 20,000+ accounts and is blocking 100,000+ domains. Iron Man offers 2,335+ templates and real-time OTP capture, and Resecurity found it needs regular contact with a vendor licensing server, a dependency defenders can exploit.

Microsoft 365AzureCloudflare
YAM StoreStorm-3119Storm-2990+7

Threat IntelΒ· Published and added 14 Oct 2026

github.comrepo🧠 AI

morluto/rea

REA (rea-agents on npm) registers an MCP server and matching workflow instructions with coding agents such as Claude Code, Codex, Cursor and Gemini CLI. It exposes tools for inspecting native binaries through Hopper, Ghidra or IDA (with optional objdump and Rizin), JavaScript/Electron apps and ASAR archives, .NET assemblies and websites. Results come back with evidence and limitations, so the agent can explain how a feature works and write and test its own implementation. Analysis runs locally, there is a CLI with the same workflows, and the showcases include C reconstructions verified against original x86 function bytes.

Model Context ProtocolClaude CodeCodex+14
REAIDA

mcp, coding-agentsΒ· Added 14 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products

SecurityWeek summarizes Patch Tuesday-style releases from Citrix, Fortinet and Ivanti fixing 29 vulnerabilities. Highlights include critical FortiSIEM and FortiSandbox flaws (CVE-2026-106173 code execution, CVE-2026-107656 auth bypass), five SQL injection bugs across FortiAnalyzer, FortiManager and FortiMail, and Ivanti Connect Secure's exploited zero-day CVE-2026-104935 (two chained bugs compromising patched VPNs). Also covers critical Ivanti Neurons Patch for Intune (CVE-2026-109412) and Xtraction (CVE-2026-106042) issues and Citrix fixes in Workspace App, XenServer and UniconOS.

Ivanti Connect SecureFortiSIEMFortiSandbox+3
CVE-2026-106173CVE-2026-107656CVE-2026-104935+2

Threat Intel, AppSecΒ· Published and added 14 Oct 2026

x.comthreadπŸ›‘οΈ Security

Dark Web Informer (@DarkWebInformer) on X

Social post from DarkWebInformer announcing a released proof-of-concept for CVE-2026-82957, a server-side request forgery in Hyperledger FireFly. The flaw lies in webhook subscriptions, where a user-controlled webhook URL is accepted without validating the destination host. The PoC is hosted in a hakaioffsec GitHub repo.

Hyperledger FireFlyGitHub
CVE-2026-82957SSRFCWE-918+1

AppSec, Offensive SecurityΒ· Added 15 Oct 2026, published 14 Oct 2026

x.comthread🧠 AI

44er (@44errrr) on X

Announcement of hexvero, an MCP server that gives coding agents a static first look at binaries and app bundles across 18 formats (ELF, PE, Mach-O, APK, .NET, Go, Wasm, Electron, SQLite). It uses zero-dependency Node parsers and marks each finding confirmed or inferred with file and line. Its tool catalog is 3,043 tokens, against a claimed 509,696 for the established reverse-engineering MCP server. Paged output with a byte budget shrinks a 541 MB Electron app to a 15 KB result, 1.3 MB of JSON to 7.9 KB, and a 450 KB build diff to 1.2 KB. radare2, rizin or Ghidra plug in for disassembly, and `npx hexvero setup --apply` registers it with Claude Code, Cursor, Codex and 15 more clients. It is a concrete example of keeping MCP tool definitions and results small enough for an agent's context window.

Model Context ProtocolNode.jsnpm+12
hexvero

mcp, coding-agentsΒ· Added 15 Oct 2026, published 14 Oct 2026

x.comtoolπŸ›‘οΈ Security

44er (@44errrr) on X

hexvero is a Node-only, zero-dependency MCP server that gives coding agents a static first-look triage of binaries and app bundles across 18 formats (ELF, PE, Mach-O, APK, .NET, Go, Wasm, Electron, SQLite). Findings are marked confirmed or inferred with file and line, and outputs are paged with a byte budget (a 541 MB Electron app yields a ~15 KB result). The author contrasts its 3,043-token tool catalog with a 509,696-token catalog of an established RE MCP server. radare2, rizin or Ghidra can be plugged in for disassembly, and setup registers it with Claude Code, Cursor, Codex and 15 more clients.

Model Context ProtocolGhidraNode.js+3
hexvero

Malware & RE, AI SecurityΒ· Added 15 Oct 2026, published 14 Oct 2026

daniel.haxx.searticleπŸ›‘οΈ Security

curl HTTP/2 upload UAF turned RCE (CVE-2026-92392)

CVE-2026-92392 is a use-after-free in curl's HTTP/2 upload path, fixed in curl 8.23.0 and rated HIGH. After a server zeroes the window and resets the stream, a dangling easy-handle pointer survives. On multi handle cleanup, server data lands in the freed memory and can overwrite a function pointer, giving remote code execution. Daniel Stenberg lists why exploitation is hard (~135KB upload, ~23-byte payload, allocation-dependent) and says Luna Tong at Anthropic found it with an OSS Scanner.

cURLCnghttp2+2
CVE-2026-92392use-after-freeLuna Tong+2

AppSec, Malware & REΒ· Added 23 Oct 2026, published 14 Oct 2026

embracethered.comwriteupπŸ›‘οΈ Security

Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)

CVE-2026-103572 is a remote code execution bug in Microsoft.VisualStudio.Copilot.Core.dll, shared by Visual Studio and SQL Server Management Studio. A trailing dot (for example `.mcp.json.`) bypasses the protected-filename check in EditsFunctionHandler.GetEditConfirmationTypeAsync, so a hijacked Copilot can rewrite its own MCP and settings files and run commands. The post covers path traversal and InstallationID leaks, indirect prompt injection demos, the October 2026 patch (GetFullPath), and a $0 bounty.

Visual StudioSQL Server Management StudioGitHub Copilot+3
CVE-2026-103572indirect prompt injectionpath traversal+5

AI Security, AppSec, Offensive SecurityΒ· Added 29 Oct 2026, published 13 Oct 2026

unit42.paloaltonetworks.comarticleπŸ›‘οΈ Security

The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk

Unit 42 case study of an intrusion at a European bank that began through a third-party-managed VPN gateway lacking strict authentication. The attacker used compromised credentials, ran noisy network scans, brute-forced administrator accounts and scraped internal documentation. A WSUS remote code execution attempt on the configuration management server was stopped by Cortex XDR, and threat hunting found no persistence.

Cortex XDRCortex XSIAMWindows Server Update Services+1
Unit 42third-party riskbrute force

Blue Team & Detection, Identity & AccessΒ· Added 30 Oct 2026, published 13 Oct 2026

rapid7.comadvisoryπŸ›‘οΈ Security

Patch Tuesday - October 2026

Rapid7's analysis of Microsoft's October 2026 Patch Tuesday, which covers 1,413 vulnerabilities, 1,102 of them in Windows. It highlights the exploited Windows Shell Mark of the Web bypass (CVE-2026-96951) and the publicly disclosed .NET Framework WDAC bypass (CVE-2026-108398). It also covers five no-interaction Outlook preview-pane RCEs, the Edge advisories that list no CVEs, and end-of-support dates for Server 2012/2012 R2, Office 2021, Exchange 2016/2019 and Windows 11 24H2. The page text is truncated, so the later CVE tables are not seen.

Windows.NETMicrosoft Edge+2
CVE-2026-96951CVE-2026-108398CVE-2026-70242+63

Blue Team & Detection, otherΒ· Published and added 13 Oct 2026

huntress.comwriteupπŸ›‘οΈ Security

Fake WatchGuard VPN Site Steals Credentials

Huntress analyzes an October incident where an admin searching Bing for a WatchGuard VPN download landed on watchguard-vpn[.]net, a lookalike site whose popup.js harvests Server/Login/Password, deliberately rejects the first submission to get a second set, and posts to watchguard-ssl[.]online. Unlike earlier iterations (Secplicity, Microsoft Storm-2561), the final payload is the genuine, validly signed WatchGuard installer from the official CDN, so no malware is present for endpoint tools to flag. Covers infrastructure timeline, thin VirusTotal detections, and defender guidance (MFA, monitoring VPN logins from hosting ASNs, blocking domains, publishing official download links).

WatchGuardVPNHuntress+2
Storm-2561SEO poisoningwatchguard-vpn[.]net+5

Threat Intel, Blue Team & DetectionΒ· Added 14 Oct 2026, published 13 Oct 2026

ethereum-magicians.orgthread🧠 AI

ERC-8444: Agentic Resource Discovery (ARD) Onchain

An Ethereum Magicians proposal for ERC-8444, which adds an onchain value and settlement layer under Google's Agentic Resource Discovery (ARD) spec for finding MCP servers, A2A agents, skills and APIs. A thin kernel records kind (skill, task, agent, registry), a CAIP-19/CAIP-10 anchor, a JCS+SHA-256 descriptor hash, a canonical URN and a status. Authority belongs to the paid address, and domains act as collected endorsements through /.well-known/ard.json. The reference implementation has Foundry-tested Solidity adapters and a Node.js gateway that passes the official ARD conformance CLI. It introduces a "task" kind (application/ai-task+json) for tenders aimed at suppliers, and the author asks for feedback on the trust root, the hash scope, same-chain anchors and the task payload.

Model Context ProtocolEthereumSolidity+2
GoogleMicrosoftHugging Face

mcp, agentsΒ· Added 14 Oct 2026, published 13 Oct 2026

Showing 180 of 696

Show more