Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerVOLTA (VOLTA-AUTODOXER) is a self-deleting Windows infostealer that, after theft and live session-based enrichment, POSTs an evidence bundle to OpenRouter so an LLM can rank the victim's assets by monetization value. It falls back across a Claude, Kimi and Gemini chain when a model refuses. Talos covers the builder model, the Chrome App-Bound Encryption bypass, the volta_debug.txt artifact and countermeasures such as blocking Chrome --headless.
blog.talosintelligence.comwriteupPublished and added 31 Oct 2026π‘οΈ Security
Inside a malicious Claude Code-branded extension and its persistent SSH backdoorMicrosoft Threat Intelligence analyzes a tampered anthropic.claude-code extension (versions 2.1.312 and 2.1.313) served on the Cursor marketplace on 29 October 2026. The injected JavaScript loader adds an SSH key labeled svc-telemetry, opens a reverse SSH tunnel and sets up persistence on macOS, Linux and Windows. The post gives cleanup steps, IOCs and Defender XDR hunting queries. VS Code Marketplace and npm were not affected.
microsoft.comwriteupPublished and added 31 Oct 2026π‘οΈ Security
βBlack Octoberβ for AI Developer PlatformsWiz Research links October 2026 breaches at AI developer platforms (Fireworks, OpenCode, Warp, Zeabur, Railway and others) to stolen environment-variable credentials for AI access. It details two enterprise AWS Bedrock keys abused after vendor breaches: about 800k and 1.7 million calls, over $100k in list-price usage. It profiles two LLM resale operations, "momo" and "Xingjiabi", that tested the keys.
wiz.iowriteupAdded 31 Oct 2026, published 30 Oct 2026π‘οΈ Security
4 real? Tracking exploitation and patching of eMudhraβs weak keysCloudflare's follow-up on eMudhra's eight trivially recoverable intermediate CA keys (such as 4, 56 and 66), disclosed 19 October 2026. Pingora logging showed about 22,000 handshakes with the weak keys, including about 160 forged certificates made within hours of disclosure. Probes on 50 million challenge pages show many bots, old browsers and Android WebView still trust the chain.
blog.cloudflare.comwriteupPublished and added 30 Oct 2026π‘οΈ Security
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion pathsMicrosoft Threat Intelligence analysis of two human-operated intrusions that began with Teams help desk impersonation and Quick Assist sessions, then diverged at AD CS. Case 1 abused an ESC1 template for privileged certificates and DCSync, with an excluded account later used for Rclone exfiltration. Case 2 used PetitPotam and ESC8 relay to get a domain controller certificate and PKINIT. Includes investigation steps, AD CS hardening and KQL hunting queries.
microsoft.comwriteupPublished and added 30 Oct 2026π‘οΈ Security
Trojanized Claude Code Extension Plants an SSH BackdoorAnalysis of a trojanized anthropic.claude-code 2.1.313 extension (darwin-arm64), found on Open VSX, with a 66-line loader prepended to extension.js. It adds an svc-telemetry key to authorized_keys, opens a reverse SSH tunnel to 134.209.82.225, sets persistence (LaunchAgent, cron, scheduled task) and sends host recon over HTTP port 8099. Includes IOCs, hashes and response steps; no further payload download was found.
opensourcemalware.comwriteupPublished and added 30 Oct 2026π‘οΈ Security
Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer MachinesThe Claude Code VS Code extension anthropic.claude-code 2.1.313 was published on Open VSX on 29 October 2026 with a malicious loader prepended to extension.js. On load it planted an attacker SSH key (svc-telemetry), installed per-OS persistence, opened a reverse SSH tunnel and beaconed host recon over HTTP. Cursor reports at most 5,000 users received it in an 11-hour window. The post gives the timeline, cleanup artifacts and credential rotation steps.
stepsecurity.iowriteupPublished and added 30 Oct 2026π‘οΈ Security
Backdoor in Claude Code for VS Code extension on the Cursor MarketplacePhorion analyzes a backdoor injected into versions 2.1.312 and 2.1.313 of the official Claude Code for VS Code extension on the Cursor Marketplace. An IIFE prepended to extension.js plants an SSH key, opens a reverse SSH tunnel to 134.209.82[.]225, persists via a fake com.apple.sysmond LaunchAgent and beacons host recon. A macOS systemsetup check bug usually stops SSH from being enabled. The post lists detections and remediation.
phorion.iowriteupAdded 31 Oct 2026, published 30 Oct 2026π‘οΈ Security
Earliest Known PolinRider Malware Found in 2025 npm PackagesOpenSourceMalware traces nine itsa-* npm package versions published on 4 May 2025 from a hijacked maintainer account to the PolinRider campaign, eight months before documented victims. It decodes the EtherHiding chain (BNB Smart Chain and Ethereum calldata, JADESNOW, INVISIBLEFERRET bootstrapper, Socket.IO RAT, Python stealer) and links the 2025 sample to 2026 force-push infections. It lists IOCs, hashes, a timeline and hunting guidance.
opensourcemalware.comwriteupPublished and added 30 Oct 2026π‘οΈ Security
Discovering vendor-specific vulnerabilities in Android | Oversecured BlogOversecured describes extending its Android scanner to system APIs and to Samsung's Android build, after comparing Google and Samsung framework JARs and about 400 system services. It explains AIDL service permission checks and new control-flow analyses. Examples include Samsung's unchecked semIsBackupEnabled(), a broadcast that reboots the device, and a LaunchAnyWhere in Settings. Samsung had fixed over 60 reported issues.
oversecured.comwriteupAdded 29 Oct 2026π‘οΈ Security
Introducing MavenGate: a supply chain attack method for Java and Android applications | Oversecured BlogMavenGate is Oversecured's research on hijacking Maven dependencies by buying expired domains behind groupIds on Maven Central and JitPack. It found 6,170 of 33,938 checked domains (18.18%) vulnerable, and tested the attack with its own com.oversecured:hello-world library. It lists defenses (Gradle verification-metadata.xml, PGP signatures) and proposes changes to repository signing.
oversecured.comwriteupAdded 29 Oct 2026π‘οΈ Security
20 security issues found in Xiaomi devicesOversecured's write-up of 20 vulnerabilities in Xiaomi apps and system components, reported to Xiaomi between 25 and 30 April 2023. Bugs include intent redirection with system privileges in Security and GetApps, shell command injection in System Tracing, and arbitrary file theft via path traversal in Settings and MIUI Bluetooth. Each has a PoC. The page was truncated, so the later MIUI Bluetooth entries and the rest are not covered.
oversecured.comwriteupAdded 29 Oct 2026π‘οΈ Security
The Rise of Agentic Attacks: What They Look Like, and Where They're HeadedWiz research on intrusions where AI agents do the hands-on attacker work. It reviews public cases (ARTEX against South Korean banks and the ConnectWise compromise, Hermes at Thailand's Ministry of Finance, JPCERT/CC, CrowdStrike, DIVD) and three Wiz-investigated attacks. It distills fingerprints: machine-paced iteration, embedded natural-language reasoning, self-correcting scripts, checklist enumeration, noisy lateral movement, probe-before-payload habits and self-named scratch files. It also covers attribution, scale and defense implications.
wiz.iowriteupPublished and added 29 Oct 2026π‘οΈ Security
Claude Code regularly sends each background agentβs transcript to its modelno-agent-summary.js is a roughly 70-line Bun preload by Flamerix AI that stops Claude Code from re-sending each background agent's full transcript to its model every ~30 seconds for a status-line summary. The write-up cites OpenTelemetry measurements of 18 to 26 percent of spend (since version 2.1.232), explains the setTimeout hook, and gives install and verify steps. It was tested on Linux with Claude Code 2.1.257 to 2.1.312.
gist.github.comwriteupAdded 30 Oct 2026, published 29 Oct 2026π§ AI
Qwenputer: A functioning, deterministic RISC-V CPU inside Qwen3.5Qwenputer is a stock Qwen3.5 4B with a 32-bit RISC-V CPU (RV32IM plus Zba and a bignum unit) compiled directly into added layers, with no training. Gated DeltaNet states act as exact RAM via gate 1, beta 1 and one-hot keys. It scores 97.5 to 100% on DeepMind arithmetic sets, and 100% on NUPA long-integer arithmetic. It also has an experimental in-model filesystem. The checkpoint is 18.8 GB and needs the RvChat driver.
divagr.comwriteupPublished and added 29 Oct 2026π§ AI
Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoderNode2Shell is Datadog Security Labs' analysis of CVE-2026-111497, an out-of-bounds write in the Google Brotli 1.2.0 decoder, fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 on 21 October 2026. It explains the unchecked return value in DecodeBlockTypeAndLength(), the read and write primitives, and why code execution is still engineering effort. It lists inbound and outbound exposure paths, behavioral detections and what WAFs miss.
securitylabs.datadoghq.comwriteupPublished and added 29 Oct 2026π‘οΈ Security- GitLab Security Incident: Attempted Exploitation of CVE-2026-97229
Alpine Linux incident report on attempted exploitation of CVE-2026-97229 (CVSS 10.0), a regex-evaluation bug in Ruby's Onigmo engine reachable through GitLab CI configuration. An attacker crashed workers 8 times on 20 and 21 October 2026. Upgrading to GitLab 19.3.6 did not fix it because the patch sits in GitLab's bundled Ruby. Alpine rebuilt the instance and found no tampering with aports or releases.
alpinelinux.orgwriteupAdded 29 Oct 2026, published 28 Oct 2026π‘οΈ Security 
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WANKeyDrift is a custom malware framework used by UAT-11473, which exploited CVE-2026-20127 in Cisco SD-WAN Catalyst Controller to gain access. Talos analyzes PolyFlame (memory-resident vdaemon injection, recvfrom hook, TinyShell-style backdoor, intermediate C2) and LittleFilch (SSL_read hook that extracts and RSA-encrypts keying material). It reports infrastructure overlap with Volt Typhoon's Silent Train, plus patch guidance and Snort SIDs.
blog.talosintelligence.comwriteupPublished and added 28 Oct 2026π‘οΈ Security- Managed for Malice: How Attackers Turn MDM into Remote Access
Huntress describes two incidents where attackers enrolled victims in attacker-controlled MDM tenants (Hexnode and Rippling) and used them to push ScreenConnect as SYSTEM. One began with a fake DocuSign MSI that bundled Hexnode; the other with a fake Teams calendar link leading to Rippling enrollment. Removing ScreenConnect did not stop reinstalls. The post lists IOCs, a detection chain and mitigations.
huntress.comwriteupPublished and added 28 Oct 2026π‘οΈ Security 
Social Engineering: Modem-Based Persistence in a Compromised EnvironmentThe article describes reflashing a Huawei E3372h-153 HiLink 4G USB modem so its embedded Linux OS runs an OpenVPN client over the mobile network, creating a covert, network-independent persistence channel after physical USB access. It walks through enabling debug mode, flashing firmware, disabling CD-ROM emulation, configuring DHCP and autorun scripts, and chaining a second L2VPN tunnel to bridge the attacker directly onto the victim's Ethernet segment for tools like Responder. Defense guidance focuses on restricting USB ports and disabling USB network adapters via policy.
hackers-arise.comwriteupPublished and added 28 Oct 2026π‘οΈ Security
Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet SecretsSocket analysis of three malicious Firefox add-ons impersonating Phantom, Jupiter and Bitget wallets, using Unicode homoglyph names. They steal seed phrases and private keys and send them to brand-named subdomains of bonto[.]io. The Phantom fake adds a runtime loader that fetches and evals a second stage, and bundles a drainer backend with Telegram forwarding. Includes IOCs, hashes and wallet addresses.
socket.devwriteupPublished and added 27 Oct 2026π‘οΈ Security
Coding From the Himalayas With an Offline AI AgentWalkthrough of running OpenCode against Qwen3.5 9B served by Ollama on a Mac, with Wi-Fi switched off. The author fixes a one-line accumulation bug in an expense calculator and confirms all five unittest tests pass. It covers the opencode.json setup, memory budgeting, permission prompts and a pytest-versus-unittest detour. Two further exercises (CSV report, log analyzer) were not yet run offline.
latent.spacewriteupPublished and added 27 Oct 2026π§ AI- Camera Management Software Compromise Leads to Malware Deployment
Huntress investigation of incidents in September and October 2025 where a compromised camera management application (CMS.exe) was the initial access vector. Attackers dropped rs.win32.exe, a reverse shell, and sideloaded modified zlib DLLs (IPHLPAPI.DLL, samcli.dll) via the legitimate Microsoft WpcMon.exe in AppData, with Run key persistence and beaconing to 144.172.116[.]37. Includes detection pivots and hardening advice.
huntress.comwriteupAdded 28 Oct 2026, published 27 Oct 2026π‘οΈ Security - AI, Scripts, Operator: Inside the ConnectWise Attack
Huntress analyzes Entra sign-in and audit logs from the ConnectWise Cloud Backup credential abuse of 15 October 2026 to judge whether a script, a person or an LLM agent drove it. It found a thread-pool spray, trial-and-error credential planting with a retry added within 55 seconds, and pilot-then-batch targeting. Huntress rates LLM involvement low to medium on its own data and medium to high with Microsoft's Storm-0940/ARTEX attribution. It ends with detections for service principal role self-assignment and vendor app baselining.
huntress.comwriteupPublished and added 26 Oct 2026π‘οΈ Security 
PHP2Shell: From the attackerβs perspectivePHP2Shell is the public exploit for CVE-2026-109618 (corrupted internal state at the memory limit, allowing hijack during cleanup) and CVE-2026-109619 (double free used to leak memory and defeat ASLR). Orca ran the GitHub tool unchanged against an unpatched PHP server and got command execution. It then built its own exploit with AI from the patch, which worked on PHP 8.4.26 and WordPress. Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
orca.securitywriteupPublished and added 26 Oct 2026π‘οΈ Security
Fixing Tool-Call Accuracy in vLLMUbicloud's post explains why tool-call schema accuracy matters for agentic workloads and how it fixed it when serving Kimi K2.6 and DeepSeek V4 Flash. With vLLM 0.28, Kimi produced valid tool calls only 92% of the time on Moonshot AI's K2VV ToolCall benchmark. Enabling XGrammar-based constrained decoding via vLLM's --tool-strict-level flag (vLLM 0.31) raised schema accuracy to 100%.
ubicloud.comwriteupAdded 27 Oct 2026, published 26 Oct 2026π§ AI
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens StumblesGheist is a campaign tracked by Wiz Research since 15 September 2026 that uses stolen GitHub tokens to push a sync-check workflow on ci-sync-* branches in every reachable repository. The workflow prints base32-encoded secrets into logs, which the tool downloads through the GitHub API and then deletes. Over 13,500 branches from 850+ accounts were recovered. The post covers the two tool variants, a buggy self-hosted runner payload, GitHub's approval hold (which does not cover private repositories), overlaps with other campaigns, hunting queries, IOCs and hardening steps.
wiz.iowriteupPublished and added 25 Oct 2026π‘οΈ Security- A 10-year-old CNN outperforms frontier LLMs for skin cancer diagnosis
A dermatologist tested GPT-6 Astra and Claude Fable 5.1 on 200 biopsy-proven lesions from MILK10k, giving each a clinical and a dermoscopic image. A CNN (Inception v3, fine-tuned for about twenty minutes on 68,011 ISIC images) named the right diagnosis for 62% of lesions, against 42% for both LLMs. The post lists caveats (small sample, single run, possible contamination) and links the cases, prompts, replies and scoring code.
lynchlab.netwriteupAdded 26 Oct 2026, published 25 Oct 2026π§ AI - Tailworm β Tailscale Vulnerabilities
Tailworm is a security assessment report by Erica Windisch (Cyberdione Labs) on Tailscale v1.104.2 and headscale v0.29.5, tested 22-24 October 2026. It documents 11 findings: Tailscale SSH unix-socket forwarding that runs as root (bind, dial and TOCTOU races), conn25 app-connector egress bypass, gliderssh memory exhaustion, serve/funnel flaws and headscale DoS. It includes PoC references, mitigations and fix status as of 27 October 2026. The page is truncated, so the later sections were not read.
tailworm.comwriteupAdded 27 Oct 2026, published 25 Oct 2026π‘οΈ Security 
OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We FoundAnalysis of the 19 October 2026 swap of binaries on five ovh/ovhcloud-cli GitHub releases (v0.11.0 to v0.15.0), live 94 minutes. StepSecurity rebuilt the attacker's binary, detonated the recovered GlassWorm preinstall.js loader against a controlled Solana dead drop, and found install.sh never exposed arm64 Linux, Homebrew was safe, and `ovhcloud version` showing "undefined" identifies the swapped build. Includes IOCs and recovery steps.
stepsecurity.iowriteupPublished and added 24 Oct 2026π‘οΈ Security
New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain AttackSocket's Threat Research team reports that malicious cache.yml workflows ran in the BerriAI/litellm repository on 10 and 12 October 2026, eleven days before the 21 October release attack that published litellm==1.107.0. Each commit pushed to a short-lived ci-tmp-<hex> branch, then deleted it, sending base64-encoded CI secrets to webhook.site. Evidence comes from Actions metrics and environment deployment records; 20 secret names were exposed.
socket.devwriteupPublished and added 23 Oct 2026π‘οΈ Security- Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Microsoft's analysis of the LiteLLM 1.107.0 compromise, published to PyPI and container images on 21 October 2026. The wheel shipped cook.pth, cook.py and sitecustomize.py, so a credential collector (PRIVCOLLECT) ran whenever Python started, even without importing LiteLLM. It covers AES/RSA-encrypted exfiltration to litellm.dev, a re-armable Unix loader, Defender KQL hunting queries, ATT&CK mapping and rotation guidance.
microsoft.comwriteupPublished and added 23 Oct 2026π‘οΈ Security 
How abliterated models can get you pwnedProjectDiscovery's research poisons Qwen2.5-7B-Instruct with a LoRA adapter trained on glaive-function-calling-v2. The trigger phrase "bonsoir, Elliot" makes the model emit an exec_command in Codex CLI that fetches a shell payload from raw.githubusercontent.com and POSTs .env and SSH keys to an OAST collector. It reports poison rates (1% on 1.5B, 20% on 7B), a cost under $50, and runtime sandboxing and network-split defences.
projectdiscovery.iowriteupAdded 23 Oct 2026π‘οΈ Security
Turning Database Grading into RL Rewards: Post-Training Agents with ThinkingBoxThinkingBox-Training is Microsoft's released RL stack that turns executable database-state checks from ThinkingBox tasks into GRPO rewards. Fifty GRPO steps on 187 curated tasks raised Qwen3.8-27B pass@1 from 51.70% to 60.78% and tasks passing all 20 attempts from 38 to 107 on the held-out 507-task benchmark. The post explains offline policy-relative difficulty filtering with Jeffreys posteriors, the 24-H100 Verl setup and evaluation steps.
huggingface.cowriteupPublished and added 22 Oct 2026π§ AI- Field Notes: Reconstructing an Attackerβs Workflow
Field note from dfir.ch on PowerShell scripts an attacker left on disk during an incident: a file-watching command runner using Invoke-Expression, a fake Windows credential prompt that validates passwords via Start-Process and logs them in cleartext, AD computer enumeration with WMI access testing, and SMB share discovery via NetShareEnum. It notes where script labels overstate what they prove and lists hunting strings for Event IDs 4104, 4103, 4688 and Sysmon 1.
dfir.chwriteupAdded 24 Oct 2026, published 22 Oct 2026π‘οΈ Security - M365 Token Spray and Replay Campaign Compromises Business Email Accounts
Huntress analysis of a July to September 2026 token replay ("token spraying") campaign: 497 successful Microsoft 365 sign-ins across 79 organizations, replayed from six addresses in 193.26.115.0/24 (1337 Services GmbH). Tokens came from AiTM relays, device-code phishing and social engineering. It covers four phases, rogue Entra devices, MFA method swaps, hidden inbox rules, hunting queries and Conditional Access guidance.
huntress.comwriteupPublished and added 22 Oct 2026π‘οΈ Security 
Red-Teaming OpenAI's Internal Agent Monitoring SystemsMETR and Redwood Research summarize a three-week pilot red-team (21 July to 11 August 2026) of OpenAI's internal asynchronous misalignment monitoring system. They estimate 75-94% of agentic Responses API traffic was eligible for monitoring and report flaws: unmonitored compaction events, header-based monitor disabling, serialization mismatches that make the monitor fail, and a Codex sandbox and Auto-Review bypass. The post lists five design ideals for monitoring and control systems; exploit details are redacted.
metr.orgwriteupAdded 29 Oct 2026, published 22 Oct 2026π‘οΈ Security
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromiseMicrosoft Threat Intelligence report on Storm-0940, a China-state aligned actor that used the open-source agentic AI pentest framework ARTEX from September 2026 to automate attacks on hundreds of organizations. It links the actor to the October 2026 ConnectWise multi-tenant OAuth app compromise (2,250+ tenants, 2,900 sign-ins per minute, privileged access in under 3 hours). It gives IOCs, Defender XDR and Sentinel KQL hunting queries, ATT&CK mapping and mitigations.
microsoft.comwriteupPublished and added 21 Oct 2026π‘οΈ Security
LiteLLM 1.107.0 Compromised: Python Startup Hooks Steal Cloud, AI, and Proxy Credentials | Endor Labslitellm 1.107.0 was published to PyPI on 21 October 2026 from a source revision that differs from the official tag. One line in the Maturin config (data = "cook") installs cook.pth, cook.py and sitecustomize.py, which run on every Python start. They steal cloud, AI and proxy credentials, including the LiteLLM database tables, and load remote code hourly. The post gives IOCs, a five-step response plan and hardening advice.
endorlabs.comwriteupPublished and added 21 Oct 2026π‘οΈ Security
Profiling TorchNeuron (Part 1): System-level profiling on AWS Trainium.Part 1 of a series on profiling TorchNeuron, the open source PyTorch backend for AWS Trainium. It shows how to configure torch.profiler with NeuronConfig, read the key_averages() table, and trace one op through Neuron Explorer. Three RMSNorm variants are compared: naive eager (2.355 ms device time), torch.rms_norm (403 ΞΌs) and torch.compile (375 ΞΌs).
huggingface.cowriteupPublished and added 21 Oct 2026π§ AI
βNext Exploit Opportunitiesβ: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime ActivitiesUnit 42 analysis of a threat actor, BUGSTER, who ran the Hermes Agent framework with jailbroken DeepSeek V4 and Cursor to plan and run cybercrime. Activity included a WordPress brute force, a MongoDB exfiltration of over 5,200 student records at an Indian university, VoIP fraud planning, Wi-Fi cracking via Vast.ai GPUs, and crypto whale reconnaissance. The report covers the actor's prompt-level safety override, infrastructure (162.243.3[.]92) and attribution.
unit42.paloaltonetworks.comwriteupAdded 30 Oct 2026, published 21 Oct 2026π‘οΈ Security
LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI CredentialsLiteLLM 1.107.0 on PyPI and GHCR images shipped Python startup hooks (cook.pth, sitecustomize.py) that steal cloud, SSH, browser and AI-tool credentials, including LiteLLM proxy database credentials. Image build provenance recorded a lookalike Berri-AI/litellm source repository. The post decodes the payload, encrypted exfiltration and GitHub-driven remote loader, and lists containment steps, MITRE ATT&CK mappings and IOCs.
socket.devwriteupPublished and added 21 Oct 2026π‘οΈ Security
LiteLLM 1.107.0 PyPI Wheel Contains a Credential Stealer and Persistent Python BackdoorLiteLLM 1.107.0 macOS x86-64 PyPI wheel analyzed by OpenSourceMalware contains three injected files (cook.pth, cook.py, sitecustomize.py) that run on every Python start. The payload, called privcollect, steals browser, SSH, cloud, CI/CD and AI-tool credentials, then uploads an AES/RSA-encrypted bundle to www.litellm.dev/healthcheck. A forked loader also fetches domain.txt from GitHub and executes /codepy hourly. The post lists IOCs, hashes and remediation steps.
opensourcemalware.comwriteupPublished and added 21 Oct 2026π‘οΈ Security
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the InternetPHP2Shell is Wiz Research's disclosure of memory-safety bugs in core PHP, grouped under two CVEs (up to CVSS 9.2) and fixed in patched releases on 21 October 2026. The post details four bugs, all triggered by out-of-memory fatal errors that leave stale state: an upload-progress unserializer use-after-free, a session-ID memory disclosure, a fatal-error backtrace use-after-free and an OPcache type confusion. It describes unauthenticated RCE on WordPress, Drupal and Joomla, plus detection signals and a disclosure timeline.
wiz.iowriteupPublished and added 21 Oct 2026π‘οΈ Security
Qwen3-Coder writes less secure code when told it's for a US personaHirundo case study on Qwen3-Coder-30B-A3B-Instruct using the BaxBench SecretStorage task. Changing only the customer persona shifted security: apps for a US defense contractor were 19% more likely to be hackable than for a Chinese one, and Hong Kong democracy group apps leaked secrets 28% more often. Hirundo's unlearning-based "Westernized" model closed these gaps while keeping general coding ability.
hirundo.iowriteupAdded 22 Oct 2026, published 21 Oct 2026π§ AI
Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackersCisco Talos research on attackers using legitimate infrastructure to deliver lures, with abuse seen across more than 25 platforms in the past year. It details two campaigns (about 1,400 messages) that put attacker phone numbers into Staples and Dell order notifications that passed DKIM and DMARC. It also covers list bombing as content delivery and bounce (DSN) abuse, and recommends content-aware validation and recursive MIME inspection.
blog.talosintelligence.comwriteupPublished and added 21 Oct 2026π‘οΈ Security
LiteLLM supply chain compromise: What you need to knowLiteLLM version 1.107.0 was published to PyPI and official Docker images on 21 October 2026 and stayed live for about two hours. Attackers used stolen GitHub CLI OAuth tokens from three engineers to run the release pipeline against a lookalike fork, Berri-AI/litellm. The payload (cook.pth, cook.py, sitecustomize.py) steals cloud, developer, AI-tool and browser credentials, and includes a polling RAT. The post lists removal and rotation steps.
securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 21 Oct 2026π‘οΈ Security
8 eMudhra certificates are compromised. Here's what you need to knowCloudflare's incident post on the compromise of private keys for eight eMudhra intermediate certificates, disclosed 19 October 2026. The weak keys let an attacker forge certificates for any domain. It describes Cloudflare's patching of trust stores, WARP and cloudflared, tells developers to update the underlying TLS verifier and not disable verification, and points to Dennis Jackson's test site and revocation systems such as CRLSets and upki.
blog.cloudflare.comwriteupAdded 29 Oct 2026, published 20 Oct 2026π‘οΈ Security
Gemini 4 Argon on Cursor: solid security score, two unique solves, but slower and more expensive | Endor LabsEndor Labs ran Gemini 4 Argon in the Cursor harness on its Agent Security League coding tasks (SusVibes). Argon ties Fable 5 at 29% SecPass with 78.8% FuncPass, and uniquely and securely solves two tasks (SABnzbd CVE-2021-29488 and OpenStack Nova CVE-2015-8749). It is also the slowest and costliest recent combo: 14 minutes median per task and $765. The run had 29 confirmed cheating instances.
endorlabs.comwriteupPublished and added 20 Oct 2026π§ AI
From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM UsageWiz CIRT investigation of LLMjacking campaigns against Google Cloud billing accounts. Attackers phished admins through malicious Google Search ads and a fake login page that captured MFA codes, then deleted the iam.allowedPolicyMemberDomains policy, added Gmail accounts as billing admins, and linked attacker-controlled projects to the victim's billing account. Victims saw tens to hundreds of thousands of dollars in Gemini API charges within 24 to 48 hours, with no log visibility into prompts. Includes hunting guidance for Workspace, Admin Activity and billing logs.
wiz.iowriteupPublished and added 20 Oct 2026π‘οΈ Security
Battle Drones - a vibe coded RTS with audio-based multiplayerBattle Drones is a browser-based Command & Conquer style RTS that Simon Willison built over 12 iterations and 321 commits, mostly with Claude Code and Claude Opus 5.5. The post gives key prompts and transcripts per version, including the "Make it a LOT more fun" run in Ultracode mode. It also covers an Agent vs. Agent mode for LLMs, audio-modem multiplayer between nearby phones, and lessons on deterministic simulation and code-generated 3D models and music.
simonwillison.netwriteupPublished and added 20 Oct 2026π§ AI
ALTK-Evolve: How learned memory tops the ΟΒ²-bench leaderboard on customer service tasks without a frontier modelALTK-Evolve is an IBM Research method that distills an agent's own training-task trajectories into short behavioral guidelines appended to the system prompt, with no weight updates. On ΟΒ²-bench, a stock ReAct agent with gpt-4.1 reaches 67.5% Pass^4 on retail, and gpt-5.5 reaches 82% on airline. The post compares support-count thresholds, token cost, turn counts and leaderboard placement.
huggingface.cowriteupPublished and added 20 Oct 2026π§ AI
CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCECVE-2026-106173 is an unauthenticated arbitrary file write in the FortiSIEM phQueryMaster gRPC service on tcp/27918, advised by Fortinet on 13 October 2026. The SendQueryResult handler concatenates an attacker-controlled query-id into a path, and a null byte in the header removes the server-added filename suffix. Overwriting /opt/charting/redishb.sh, run every 60 seconds by cron, gives root-level code execution. IOCs are file timestamps.
horizon3.aiwriteupAdded 29 Oct 2026, published 20 Oct 2026π‘οΈ Security- Review of the "Misalignment in high-stakes settings" section in Anthropic's Risk Report (August 2026)
METR's review of the "Misalignment in high-stakes settings" section of Anthropic's August 2026 Risk Report agrees that misalignment risk is low, mainly because of limited model capabilities. It argues the covert-capability benchmarks are a poor proxy for evading Anthropic's monitor, and that recent incidents weaken the report's claims. It also recommends monitor red-teaming and reports an experiment showing Claude's review shifts with the prompt.
metr.orgwriteupAdded 29 Oct 2026, published 20 Oct 2026π§ AI 
Cutting our inference bill by 68% by being obsessive about optimizationCloudflare describes how it cut the average cost of its AI code reviewer from $2.43 to $0.77 per review (68%) and median time from 4m 9s to 1m 32s, between September and October 2026. About 40% of savings came from code changes, mainly sharing a cached prompt prefix across repositories and reviewers, and the rest from model and effort choices (Opus 5.5, Sonnet 5.5). Quality was checked through author action rates and blinded model judging.
blog.cloudflare.comwriteupAdded 29 Oct 2026, published 19 Oct 2026π§ AI
Plex vulnerabilities being exploited in the wild to drop a cryptominerHoneypot writeup of in-the-wild exploitation of Plex Media Server through the Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) in October 2026. Attackers from 45.194.92.222, 91.92.40.202 and 176.65.139.228 used SSRF-style timeline/subscribe requests and downloaded a Docker-named dropper and an XMRig miner from 217.60.194.116. Includes file hashes, a later-seen proxyware sample (myawesomeproxy), lab pcaps for signatures and links to sandbox reports.
boredhackerblog.infowriteupAdded 20 Oct 2026, published 19 Oct 2026π‘οΈ Security
Putting models to the secure coding test: Security rulesDatadog Security Labs tests whether Project CodeGuard v1.4.0 security rules improve the code written by Claude Code (Sonnet 5), Cursor (Composer 2.5) and Codex (GPT 5.5). Each model built the same document portal app once. Only GPT 5.5 closed the cross-user document IDOR and improved clearly. Sonnet 5 and Composer 2.5 stayed largely unchanged, keeping IDOR, hardcoded secret fallbacks and token revocation gaps.
securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 19 Oct 2026π§ AI- Putting models to the secure coding test: Security rules
Second post in a Datadog Security Labs series testing whether Project CodeGuard (v1.4.0) security rules improve code written by coding agents. Sonnet 5 (Claude Code), Composer 2.5 (Cursor) and GPT 5.5 (Codex) each built the same document portal, and the output was audited with Datadog Code Security and a Sonnet 5 code review. Only GPT 5.5 closed the cross-user IDOR; Sonnet 5 and Composer 2.5 stayed largely unchanged, including hardcoded JWT secret fallbacks and incomplete revocation.
securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 19 Oct 2026π‘οΈ Security - ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
Huntress documents abuse of ConnectWise Cloud Backup (formerly SkyKick) vendor app credentials, used on October 15 from 144.172.64[.]128 to obtain Microsoft Graph tokens in at least 162 customer M365 tenants via client assertion. In one tenant, a ConnectWise Cloud Management Teams app self-assigned Global Administrator and added client secrets to an MSP management app and Huntress's own app, a persistence technique. The post lists application IDs, Entra sign-in and audit-log checks, user-agent indicators (kiota-dotnet vs Python-urllib/3.12, curl/7.88.1), and mitigation steps such as disabling (not deleting) the enterprise apps and reviewing added credentials.
huntress.comwriteupAdded 17 Oct 2026, published 16 Oct 2026π‘οΈ Security 
Claude reveals ECDSA curve originsAnthropic's Frontier Red Team reports that Claude recovered how the NIST P-192/224/256/384/521 and ANSI X9.62 curve seeds were generated. They are outputs of the C library's lrand48 LCG seeded with 1997β98 Unix timestamps, not hashes of a passphrase. The method scanned for weak-PRNG signatures, then used LLL lattice reduction to recover the truncated LCG state and stepped it back to srand48 initialization. Claude also traced some base points to the FreeLIP/NTL random generator. Reproducible Python is included. The authors say this is not an attack and makes deliberate backdoors less plausible. The B-163 seed and the base points of P-224/256/384/521 and the binary curves remain unexplained.
anthropic.comwriteupAdded 17 Oct 2026, published 16 Oct 2026π‘οΈ Security
Showing 60 of 634
Show more