- Do the math: How we took over ChatGPT accounts
Parameter Labs describes a chain that turned a public ChatGPT share link into JavaScript running as chatgpt.com in the victim's session. It combined a MathLive postMessage listener with no origin or source check, raw HTML in keyboard layouts, an unsandboxed srcdoc iframe, and a YouTube oEmbed JSONP callback to pass the CSP. The code read private conversations through backend APIs. OpenAI fixed it on 26 October 2026 and rated it P1.
parameter.aiwriteupAdded 1 Nov 2026, published 31 Oct 2026๐ก๏ธ Security 
โBlack Octoberโ for AI Developer PlatformsWiz Research links October 2026 breaches at AI developer platforms (Fireworks, OpenCode, Warp, Zeabur, Railway and others) to stolen environment-variable credentials for AI access. It details two enterprise AWS Bedrock keys abused after vendor breaches: about 800k and 1.7 million calls, over $100k in list-price usage. It profiles two LLM resale operations, "momo" and "Xingjiabi", that tested the keys.
wiz.iowriteupAdded 31 Oct 2026, published 30 Oct 2026๐ก๏ธ Security
nemotron-halloweenMonsterHouse is a Halloween interactive projection built on the NVIDIA Nemotron Voice Agent: Nemotron Speech ASR, Nemotron 3.5 Bolt E4B 4GB with a LoRA persona adapter, Magpie TTS Zeroshot and Audio2Face-3D in Unreal Engine, on two RTX Blackwell GPUs. Median end-of-speech-to-audio is 1.70 seconds live and 0.72 seconds with cached responses. The post gives a build path and tips on caching and state handling.
huggingface.cowriteupPublished and added 30 Oct 2026๐ง AI
4 real? Tracking exploitation and patching of eMudhraโs weak keysCloudflare's follow-up on eMudhra's eight trivially recoverable intermediate CA keys (such as 4, 56 and 66), disclosed 19 October 2026. Pingora logging showed about 22,000 handshakes with the weak keys, including about 160 forged certificates made within hours of disclosure. Probes on 50 million challenge pages show many bots, old browsers and Android WebView still trust the chain.
blog.cloudflare.comwriteupPublished and added 30 Oct 2026๐ก๏ธ Security
Trojanized Claude Code Extension Plants an SSH BackdoorAnalysis of a trojanized anthropic.claude-code 2.1.313 extension (darwin-arm64), found on Open VSX, with a 66-line loader prepended to extension.js. It adds an svc-telemetry key to authorized_keys, opens a reverse SSH tunnel to 134.209.82.225, sets persistence (LaunchAgent, cron, scheduled task) and sends host recon over HTTP port 8099. Includes IOCs, hashes and response steps; no further payload download was found.
opensourcemalware.comwriteupPublished and added 30 Oct 2026๐ก๏ธ Security
Backdoor in Claude Code for VS Code extension on the Cursor MarketplacePhorion analyzes a backdoor injected into versions 2.1.312 and 2.1.313 of the official Claude Code for VS Code extension on the Cursor Marketplace. An IIFE prepended to extension.js plants an SSH key, opens a reverse SSH tunnel to 134.209.82[.]225, persists via a fake com.apple.sysmond LaunchAgent and beacons host recon. A macOS systemsetup check bug usually stops SSH from being enabled. The post lists detections and remediation.
phorion.iowriteupAdded 31 Oct 2026, published 30 Oct 2026๐ก๏ธ Security
Earliest Known PolinRider Malware Found in 2025 npm PackagesOpenSourceMalware traces nine itsa-* npm package versions published on 4 May 2025 from a hijacked maintainer account to the PolinRider campaign, eight months before documented victims. It decodes the EtherHiding chain (BNB Smart Chain and Ethereum calldata, JADESNOW, INVISIBLEFERRET bootstrapper, Socket.IO RAT, Python stealer) and links the 2025 sample to 2026 force-push infections. It lists IOCs, hashes, a timeline and hunting guidance.
opensourcemalware.comwriteupPublished and added 30 Oct 2026๐ก๏ธ Security
We ran AI agent swarms in Minecraft and MindustryAgents in Games is a Y Combinator Labs writeup, done with Olam Labs, of multi-agent swarm experiments in Minecraft and Mindustry. A 50-agent GPT-6.1 Sol Minecraft colony became risk-averse after 22 of 34 deaths came on night one. GPT beat Claude Opus 5.5 at Bed Wars 6-3 and Mindustry 6-1. The authors open-sourced a Minecraft agent harness, Multi-Agent Mindustry and a Harbor fork.
labs.ycombinator.comwriteupAdded 30 Oct 2026, published 29 Oct 2026๐ง AI
20 security issues found in Xiaomi devicesOversecured's write-up of 20 vulnerabilities in Xiaomi apps and system components, reported to Xiaomi between 25 and 30 April 2023. Bugs include intent redirection with system privileges in Security and GetApps, shell command injection in System Tracing, and arbitrary file theft via path traversal in Settings and MIUI Bluetooth. Each has a PoC. The page was truncated, so the later MIUI Bluetooth entries and the rest are not covered.
oversecured.comwriteupAdded 29 Oct 2026๐ก๏ธ Security
The Rise of Agentic Attacks: What They Look Like, and Where They're HeadedWiz research on intrusions where AI agents do the hands-on attacker work. It reviews public cases (ARTEX against South Korean banks and the ConnectWise compromise, Hermes at Thailand's Ministry of Finance, JPCERT/CC, CrowdStrike, DIVD) and three Wiz-investigated attacks. It distills fingerprints: machine-paced iteration, embedded natural-language reasoning, self-correcting scripts, checklist enumeration, noisy lateral movement, probe-before-payload habits and self-named scratch files. It also covers attribution, scale and defense implications.
wiz.iowriteupPublished and added 29 Oct 2026๐ก๏ธ Security
Claude Code regularly sends each background agentโs transcript to its modelno-agent-summary.js is a roughly 70-line Bun preload by Flamerix AI that stops Claude Code from re-sending each background agent's full transcript to its model every ~30 seconds for a status-line summary. The write-up cites OpenTelemetry measurements of 18 to 26 percent of spend (since version 2.1.232), explains the setTimeout hook, and gives install and verify steps. It was tested on Linux with Claude Code 2.1.257 to 2.1.312.
gist.github.comwriteupAdded 30 Oct 2026, published 29 Oct 2026๐ง AI
Endor Labs AI SAST Finds Two Apache Kafka Zero-Days: Unbounded Memory Allocation from Brokers to Kafka Streams | Endor LabsEndor Labs AI SAST found three unbounded memory allocation flaws in Apache Kafka, fixed under CVE-2026-114349 (DefaultRecord decoder, a ~90-byte compressed batch that kills consumers, brokers and the log cleaner) and CVE-2026-111551 (ListDeserializer and Kafka Streams AssignmentInfo decoding). The post gives code, reproducers and payload bytes. Remediation: upgrade to 4.2.2, 4.3.2 or 4.4.0, set max.decompressed.message.bytes, restrict write and group ACLs, and alert on DeadThreadCount.
endorlabs.comwriteupPublished and added 28 Oct 2026๐ก๏ธ Security- Managed for Malice: How Attackers Turn MDM into Remote Access
Huntress describes two incidents where attackers enrolled victims in attacker-controlled MDM tenants (Hexnode and Rippling) and used them to push ScreenConnect as SYSTEM. One began with a fake DocuSign MSI that bundled Hexnode; the other with a fake Teams calendar link leading to Rippling enrollment. Removing ScreenConnect did not stop reinstalls. The post lists IOCs, a detection chain and mitigations.
huntress.comwriteupPublished and added 28 Oct 2026๐ก๏ธ Security 
Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet SecretsSocket analysis of three malicious Firefox add-ons impersonating Phantom, Jupiter and Bitget wallets, using Unicode homoglyph names. They steal seed phrases and private keys and send them to brand-named subdomains of bonto[.]io. The Phantom fake adds a runtime loader that fetches and evals a second stage, and bundles a drainer backend with Telegram forwarding. Includes IOCs, hashes and wallet addresses.
socket.devwriteupPublished and added 27 Oct 2026๐ก๏ธ Security
Coding From the Himalayas With an Offline AI AgentWalkthrough of running OpenCode against Qwen3.5 9B served by Ollama on a Mac, with Wi-Fi switched off. The author fixes a one-line accumulation bug in an expense calculator and confirms all five unittest tests pass. It covers the opencode.json setup, memory budgeting, permission prompts and a pytest-versus-unittest detour. Two further exercises (CSV report, log analyzer) were not yet run offline.
latent.spacewriteupPublished and added 27 Oct 2026๐ง AI- Camera Management Software Compromise Leads to Malware Deployment
Huntress investigation of incidents in September and October 2025 where a compromised camera management application (CMS.exe) was the initial access vector. Attackers dropped rs.win32.exe, a reverse shell, and sideloaded modified zlib DLLs (IPHLPAPI.DLL, samcli.dll) via the legitimate Microsoft WpcMon.exe in AppData, with Run key persistence and beaconing to 144.172.116[.]37. Includes detection pivots and hardening advice.
huntress.comwriteupAdded 28 Oct 2026, published 27 Oct 2026๐ก๏ธ Security 
Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)Cloudflare's postmortem of a tenant isolation bug in the GLM-5.3 model on Workers AI, active 27 August to 9 September 2026. Prompts over 681,280 tokens exceeded the prefill KV pool, and an SGLang disaggregated-mode bug let decode read stale pages, so 155 responses contained other customers' data. It covers the timeline, config and engine fixes (SGLang v0.5.22), and recommendations for operators.
blog.cloudflare.comwriteupAdded 27 Oct 2026, published 26 Oct 2026๐ง AI- Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)
Cloudflare postmortem of a tenant isolation failure in the GLM-5.3 Workers AI model (27 August to 9 September 2026), in which 155 responses to prompts over 681,280 tokens contained other customers' data. Root cause was a KV pool smaller than the 1,048,576-token context window, combined with an SGLang bug in disaggregated prefill/decode mode that let decode read stale KV pages. It lists the fixes (SGLang v0.5.22 patches), hardening steps and operator recommendations.
blog.cloudflare.comwriteupAdded 27 Oct 2026, published 26 Oct 2026๐ก๏ธ Security - AI, Scripts, Operator: Inside the ConnectWise Attack
Huntress analyzes Entra sign-in and audit logs from the ConnectWise Cloud Backup credential abuse of 15 October 2026 to judge whether a script, a person or an LLM agent drove it. It found a thread-pool spray, trial-and-error credential planting with a retry added within 55 seconds, and pilot-then-batch targeting. Huntress rates LLM involvement low to medium on its own data and medium to high with Microsoft's Storm-0940/ARTEX attribution. It ends with detections for service principal role self-assignment and vendor app baselining.
huntress.comwriteupPublished and added 26 Oct 2026๐ก๏ธ Security 
Fixing Tool-Call Accuracy in vLLMUbicloud's post explains why tool-call schema accuracy matters for agentic workloads and how it fixed it when serving Kimi K2.6 and DeepSeek V4 Flash. With vLLM 0.28, Kimi produced valid tool calls only 92% of the time on Moonshot AI's K2VV ToolCall benchmark. Enabling XGrammar-based constrained decoding via vLLM's --tool-strict-level flag (vLLM 0.31) raised schema accuracy to 100%.
ubicloud.comwriteupAdded 27 Oct 2026, published 26 Oct 2026๐ง AI- A 10-year-old CNN outperforms frontier LLMs for skin cancer diagnosis
A dermatologist tested GPT-6 Astra and Claude Fable 5.1 on 200 biopsy-proven lesions from MILK10k, giving each a clinical and a dermoscopic image. A CNN (Inception v3, fine-tuned for about twenty minutes on 68,011 ISIC images) named the right diagnosis for 62% of lesions, against 42% for both LLMs. The post lists caveats (small sample, single run, possible contamination) and links the cases, prompts, replies and scoring code.
lynchlab.netwriteupAdded 26 Oct 2026, published 25 Oct 2026๐ง AI - Tailworm โ Tailscale Vulnerabilities
Tailworm is a security assessment report by Erica Windisch (Cyberdione Labs) on Tailscale v1.104.2 and headscale v0.29.5, tested 22-24 October 2026. It documents 11 findings: Tailscale SSH unix-socket forwarding that runs as root (bind, dial and TOCTOU races), conn25 app-connector egress bypass, gliderssh memory exhaustion, serve/funnel flaws and headscale DoS. It includes PoC references, mitigations and fix status as of 27 October 2026. The page is truncated, so the later sections were not read.
tailworm.comwriteupAdded 27 Oct 2026, published 25 Oct 2026๐ก๏ธ Security 
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooksMicrosoft's analysis of the LiteLLM 1.107.0 compromise, published to PyPI and container images on 21 October 2026. The wheel shipped cook.pth, cook.py and sitecustomize.py, so a credential collector (PRIVCOLLECT) ran whenever Python started, even without importing LiteLLM. It covers AES/RSA-encrypted exfiltration to litellm.dev, a re-armable Unix loader, Defender KQL hunting queries, ATT&CK mapping and rotation guidance.
microsoft.comwriteupPublished and added 23 Oct 2026๐ก๏ธ Security
Python Packages Vulnerable to Node2ShellAnalysis of CVE-2026-111497 (Node2Shell), an out-of-bounds write in Google's Brotli C decoder, showing it also affects the PyPI packages Brotli (all releases up to 1.2.0) and brotlicffi (up to 1.2.0.2). The author diffed the 1.2.0 and 1.2.1 sdists and confirmed the behaviour with AddressSanitizer. Fixes are Brotli 1.2.1 and brotlicffi 1.2.1.0, both patched without release notes. No advisory database lists either package yet.
opensourcemalware.comwriteupPublished and added 23 Oct 2026๐ก๏ธ Security- PHP2Shell: pre-auth RCE via PHP memory-limit fatal errors (CVE-2026-109618/109619)
PHP2Shell is Calif's writeup of pre-auth RCE in PHP (CVE-2026-109618, CVE-2026-109619) triggered by memory_limit fatal errors that leave dangling state. It covers a HashTable bucket bug in _zend_hash_str_add_or_update_i, a Session upload-progress stale-pointer bug, and an unserialize destructor-list primitive that reaches PHP-FPM. It lists affected apps (WordPress, Drupal, Joomla, Magento and others) and gives temporary mitigations.
calif.iowriteupAdded 23 Oct 2026๐ก๏ธ Security 
Turning Database Grading into RL Rewards: Post-Training Agents with ThinkingBoxThinkingBox-Training is Microsoft's released RL stack that turns executable database-state checks from ThinkingBox tasks into GRPO rewards. Fifty GRPO steps on 187 curated tasks raised Qwen3.8-27B pass@1 from 51.70% to 60.78% and tasks passing all 20 attempts from 38 to 107 on the held-out 507-task benchmark. The post explains offline policy-relative difficulty filtering with Jeffreys posteriors, the 24-H100 Verl setup and evaluation steps.
huggingface.cowriteupPublished and added 22 Oct 2026๐ง AI
Red-Teaming OpenAI's Internal Agent Monitoring SystemsMETR and Redwood Research summarize a three-week pilot red-team (21 July to 11 August 2026) of OpenAI's internal asynchronous misalignment monitoring system. They estimate 75-94% of agentic Responses API traffic was eligible for monitoring and report flaws: unmonitored compaction events, header-based monitor disabling, serialization mismatches that make the monitor fail, and a Codex sandbox and Auto-Review bypass. The post lists five design ideals for monitoring and control systems; exploit details are redacted.
metr.orgwriteupAdded 29 Oct 2026, published 22 Oct 2026๐ก๏ธ Security
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromiseMicrosoft Threat Intelligence report on Storm-0940, a China-state aligned actor that used the open-source agentic AI pentest framework ARTEX from September 2026 to automate attacks on hundreds of organizations. It links the actor to the October 2026 ConnectWise multi-tenant OAuth app compromise (2,250+ tenants, 2,900 sign-ins per minute, privileged access in under 3 hours). It gives IOCs, Defender XDR and Sentinel KQL hunting queries, ATT&CK mapping and mitigations.
microsoft.comwriteupPublished and added 21 Oct 2026๐ก๏ธ Security
Profiling TorchNeuron (Part 1): System-level profiling on AWS Trainium.Part 1 of a series on profiling TorchNeuron, the open source PyTorch backend for AWS Trainium. It shows how to configure torch.profiler with NeuronConfig, read the key_averages() table, and trace one op through Neuron Explorer. Three RMSNorm variants are compared: naive eager (2.355 ms device time), torch.rms_norm (403 ฮผs) and torch.compile (375 ฮผs).
huggingface.cowriteupPublished and added 21 Oct 2026๐ง AI
โNext Exploit Opportunitiesโ: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime ActivitiesUnit 42 analysis of a threat actor, BUGSTER, who ran the Hermes Agent framework with jailbroken DeepSeek V4 and Cursor to plan and run cybercrime. Activity included a WordPress brute force, a MongoDB exfiltration of over 5,200 student records at an Indian university, VoIP fraud planning, Wi-Fi cracking via Vast.ai GPUs, and crypto whale reconnaissance. The report covers the actor's prompt-level safety override, infrastructure (162.243.3[.]92) and attribution.
unit42.paloaltonetworks.comwriteupAdded 30 Oct 2026, published 21 Oct 2026๐ก๏ธ Security
Showing 30 of 486
Show more