#breach UPDATE — North Korean attackers ran a months-long campaign, using a rigged coding assignment and abused AI tooling to compromise an employee and then the wallet infrastructure; Pyongyang denies involvement. Why it matters: the same DPRK playbook (fake recruiters, malicious take-home tests) targets developers everywhere. BleepingComputer · SecurityWeek · The Record#vuln HIGH EXPLOITED KEV — TOCTOU race condition (CVSS 8.1) exploitable during software upgrades for code execution; federal deadline 6 Nov. Why it matters: WordPress runs a huge share of the web; make sure auto-updates actually completed. BleepingComputer · CISA alert#breach #supply-chain — Using compromised credentials, attackers poisoned OpsShield’s update servers on 2 Nov to push a backdoor and steal password hashes from Linux hosting servers. Why it matters: a security tool became the delivery mechanism. BleepingComputer · SecurityWeek#vuln CRITICAL PATCH — Framework flaw in Android 14–17 among 200+ fixes; fixed in patch level 2026-11-01. The Hacker News · SecurityWeek#breach #germany #ot — First German cases in Bavaria and NRW; British businesses also hit, and blood-bank cooling is now in focus. heise · The Record · Dark Reading#breach #ransomware — About 37 of ~50 reachable machines were encrypted from an unmanaged host; commands looked model-generated. BleepingComputer#breach #ai — WorkOS says an attacker using ARTEX accessed a sales app; Chainstack reports a production breach exposing customer data and password hashes, linked to a large AI-powered campaign. BleepingComputer · The Hacker News#breach — The Hacker News#breach — SecurityWeek · BleepingComputerCRITICAL PATCH — Pre-auth authorization bypass plus a second bug leads to root on devices including Email Security Gateway. BleepingComputer · heiseCRITICAL PATCH — All versions since 4.6; no mitigation besides patching. The Hacker NewsCRITICAL PATCH — Unauthenticated upload of a crafted file; fixed in 8.1.4.1 and 8.0.5.2. The Hacker NewsCRITICAL EXPLOITED — SecurityWeekPATCH — SecurityWeekUPDATE — Ubuntu fixes are still in testing. The Hacker News#threat — Compromised and fake portals target mobile users. Keep phones patched. BleepingComputer#threat #germany — The Record · heise#threat — Reported as a first. heise#threat — Abuses plain-HTTP traffic from the Windows input method. The Hacker News#threat — Russia-aligned group. The Hacker News#threat #ai — Google says stolen cloud credentials are used to run expensive AI workloads, sometimes $100K+/day. BleepingComputer#threat — Risky Bulletin#defense — Microsoft provides detection and investigation guidance across the whole installer session. Microsoft Security#defense — Adds mutual TLS in front of services that can’t do it themselves. Help Net SecurityPATCH — Help Net Security#defense — Help Net Security#industry #germany — Seven arrests; the company supplied fake trading sites to criminal gangs. BleepingComputer · heise#industry — The Record#industry #ai — AI agent observability and automated AI security testing for Falcon; also launched an “AI Kill Switch”. SecurityWeek · CrowdStrike#industry — BleepingComputer#learning — Help Net Security#learning — Useful for thinking about career direction. BleepingComputer#threat — Mostly TV set-top boxes; Google says it is highly confident maker Videostrong deliberately backdoored them and sold access to criminals, and banned the vendor. Why it matters: cheap IoT boxes on home networks are being sold as residential proxies. The Hacker News · BleepingComputer · KrebsOnSecurity#breach #ot — Attackers changed refrigeration controller settings overnight in Belgium, Sweden, Estonia and elsewhere, forcing stores to pull food. Why it matters: internet-exposed building/OT controllers now cause real-world physical damage. The Hacker News#vuln CRITICAL EXPLOITED — Missing authentication lets unauthenticated attackers run code; VulnCheck sees backdoors being planted. The Hacker News#breach #germany — Both German companies are emailing customers about data stolen in IT attacks. heise#breach — Abrigo restored most of the risk-management app except borrower-facing features. BleepingComputerHIGH EXPLOITED — Attackers use a flaw patched in December 2024 against NAS devices running outdated DSM. The Hacker NewsCRITICAL EXPLOITED — CVSS 10.0, unpatched, can expose wallet credentials; exploitation attempts seen by Defused Cyber. Remove or disable the plugin. The Hacker NewsCRITICAL — Unauthenticated auth bypass and code execution in the AI-agent builder, all releases from 1.0.0 onward affected per IBM. The Hacker NewsCRITICAL PATCH — heiseHIGH PATCH — Fixed in 13.1. heise#threat — Unit 42 describes an espionage campaign against government Linux infrastructure, with suspected AI-generated scripts. The Hacker News#threat — Iran-aligned espionage between August and October 2026. The Hacker News#threat — Heavy use of living-off-the-land Windows features. Dark Reading#defense — Microsoft’s data-driven look at the small subset of CVEs that actually get exploited, and how to prioritise by exploitation likelihood, exposure and blast radius. Microsoft Security#defense — How MPTCP can split traffic across paths and what that means for network monitoring. SANS ISC#industry #ai — heise#industry #ai — A proposal for a single entry that all AI crawlers would honour. heise#industry — Wired#learning — Schneier on the claim that ~3% of all critical bugs ever recorded were found in the last month. Schneier on Security#learning — A quick catch-up on last week. The Hacker News#breach #supply-chain — Version 2.1.313 shipped under the legitimate publisher identity and tried to install a persistent SSH backdoor; a bug in the malicious code limited damage on some ~5,000 developer machines. Why it matters: IDE extension marketplaces are now a direct path into developer workstations. Microsoft analysis · The Hacker News · Wired#threat — The DPRK-aligned group (aka Jade Sleet, Slow Pisces, UNC4899) is blamed; tracers say the heist took about 20 minutes. Why it matters: it dwarfs every previous crypto theft and funds the regime. The Hacker News · Wired#vuln CRITICAL EXPLOITED KEV — Attackers chain three flaws; CISA added CVE-2026-111357 (missing auth) and CVE-2026-118527 (predictable identifiers) to KEV. Why it matters: Ivanti VPNs are a perennial initial-access favourite. The Hacker News · CISA alert#threat #ai — CrowdStrike attributes the Go-based multi-agent framework’s use to “Vapor Panda”, hitting high-value targets in parallel across 14 countries. The Hacker News#breach — An outside actor accessed customer identity data the company calls non-sensitive; investigation content was not touched. The Hacker News#breach #supply-chain — A third-party page-speed script was replaced to sell signed-in users’ positions; Polymarket is refunding. The Hacker News#breach — A Trezor Safe 5 from CryptoBilis reportedly contained an extra board exfiltrating the recovery phrase over mobile networks. The Hacker NewsCRITICAL EXPLOITED — “Highly critical” missing authorization in Commerce Core up to 2.41 and 3.0.0–3.3.13. The Hacker NewsHIGH EXPLOITED — RCE in WordPress 4.7 through 7.1.3 (CVSS 8.1), exploited right after the patch. Update immediately. The Hacker NewsCRITICAL — CVSS 10.0: with network access to the API and a trusted client’s public certificate, an attacker can log in as that client without its private key. The Hacker NewsHIGH PATCH — A malicious host can attack the computer that connects to it; relevant to helpdesks connecting to untrusted machines. The Hacker NewsPATCH — Parameter showed a share link executing code in the victim’s session and reading private chats; reported via bug bounty. The Hacker News#threat #ai — The self-deleting stealer uses Claude, Gemini and Kimi to profile victims and prioritise the most valuable stolen data. Cisco Talos · Wired#threat — Kaspersky details a sophisticated .NET-injection chain aimed at a custom government OS build. The Hacker News#threat — Risky Bulletin#defense — Microsoft IR traces Teams support impersonation to remote access, NTLM relay and certificate abuse, with hunting guidance. Excellent AD CS case study. Microsoft Security#defense — Bug-fix release for YARA-X and the first release candidate of Wireshark 5. SANS ISC — YARA-X · SANS ISC — Wireshark#defense — SANS ISC#defense — Roughly 8,200 L3 attacks per hour. The Hacker News#industry — Sentenced for the 2013 fake AP tweet that briefly wiped $136B off markets. The Hacker News#industry — Dark Reading#breach — The world’s largest exchange says the incident affected about $6.3 billion in assets; nearly $3 billion has been frozen on-chain, with Tether and Circle freezing about 1.57 billion USDT and 800 million USDC. Why it matters: the biggest digital heist on record. The Hacker News#vuln CRITICAL — Affects Ubuntu, RHEL and other distributions; Anthropic says its AI model wrote an exploit giving an unauthenticated remote attacker root. Why it matters: remote, pre-auth, kernel-level — patch as soon as your distro ships a fix. The Hacker News#industry #ai — Anthropic says the model found and chained vulnerabilities in Chrome, Safari, Android, Windows and Linux. Why it matters: AI-driven exploit development is accelerating the patch treadmill for everyone. Dark Reading#breach — An accused cheater used malware on top online poker players’ machines to see their hands. WiredCRITICAL EXPLOITED KEV — Integer overflow leading to RCE, added to KEV on 29 Oct with a 1 Nov federal deadline. CISA alert · The Hacker NewsHIGH EXPLOITED KEV — NULL pointer dereference DoS under active exploitation. CISA alertUPDATE — Unit 42 refreshed its CVE-2026-109618/109619 guidance; Risky Business reports the bugs were used to compromise Palo Alto Networks firewalls. Unit 42 · Risky BulletinMEDIUM — New CISA advisories for Hitachi Energy CoreTec and TRO600 and the Mendix SAML module. CISA — Mendix · CISA — TRO600#threat #ai — Talos documents a new C2 framework with integrated AI features. Cisco Talos#threat — Microsoft breaks down how different DPRK groups use AI, at varying levels of maturity. Microsoft Security#threat — Fake GitHub projects deliver signed-executable loaders and crypto miners. The Hacker News#threat #ai — A service selling AI coding tools into unsupported regions strips out key security controls. Dark Reading#threat — Risky Bulletin · Dark Reading#defense — Phishing still leads initial access; help-desk vishing is rising and ransomware/pre-ransomware cases increased. Finance and public administration were the most targeted. Cisco Talos#defense — Obvious phishing with many red flags still bypassed several SEGs; a reminder to test your own filtering. Dark Reading#learning — A lightweight, practical threat-modeling method. Dark Reading#learning — Dark Reading#breach — Leaked records include ICE and CBP facility locations, staff phone numbers and members of groups tied to wiretap programs, Palantir and xAI’s Grok; Bluesky is blocking links to the archive. Why it matters: it puts undercover agents at physical risk and shows how much sensitive data sits in internal directories. Wired · Wired — Bluesky#vuln CRITICAL — The bug in UEFI firmware used by most server vendors lets attackers run code early in the boot process. Why it matters: code that runs before the OS survives reinstalls and is invisible to EDR, and firmware patching is slow. Wired#threat — Talos attributes exploitation of CVE-2026-20127, an auth bypass in Cisco SD-WAN Catalyst Controller, to a sophisticated APT deploying the KeyDrift implant. Why it matters: network edge controllers keep being the entry point of choice for state actors. Cisco TalosHIGH EXPLOITED KEV — Missing initialisation of a variable, added to KEV on 28 Oct with a 31 Oct federal due date. CISA alertEXPLOITED KEV — Insufficient logging weakness in ESX now in KEV; useful to attackers who want to hide activity on hypervisors. CISA alert#threat #ai — A threat actor hid behind user agents impersonating OpenAI, Anthropic, Meta and other bots while scanning for exposed secrets. Bot UA strings are not an allow-list. Dark Reading#threat #supply-chain — The supply-chain campaign is shifting toward developer endpoints and cloud access. Dark Reading#threat — Unit 42’s outlook on what hits retailers ahead of the holiday season. Unit 42#defense — SANS ISC walks through a shared Ghidra server for collaborative reversing in a snapshot-based lab. SANS ISC#learning — Researchers created a fake start-up to observe DPRK IT-worker fraud up close. Schneier on SecurityThe whole episode was a debrief of last week’s PHP2Shell disclosure, which happened before this site started. What we hadn’t covered:
#vuln #ai — Calif (using an OpenAI model in its “Patch the Planet” effort) and Google’s Wiz independently found the bugs; the vulnerable code path had been exploitable in PHP’s default configuration for about 14 years. Recorded Future · Transcript#industry — CVE IDs leaked two days before the planned release, a PoC video was published by mistake, and the PHP Foundation says Chainguard published fixed images 6+ hours before coordinated release. A case study in why coordinated disclosure struggles at internet scale. Socket · InfoWorld · Transcript#threat — Amazon reported a PHP2Shell attempt in its honeypots dated 17 Oct, days before any leak. CSA research note#vuln — Scans show a large fraction of internet-facing PHP runs end-of-life branches that get no official patch; distro backports may keep the old version number, so check package changelogs rather than php -v. Technology Checker · Recorded Future#breach — Unauthorized access to Quest’s Quanum LSM ordering/results system, discovered 21 Oct; scope of patient records still under investigation. BleepingComputer#learning — His argument that temporarily disconnecting critical systems from the internet may be the right move during the next internet-scale bug. TranscriptAlready covered: PHP2Shell added to CISA KEV (28 Oct).
#vuln CRITICAL EXPLOITED KEV — CISA added CVE-2026-109618 and CVE-2026-109619, the two unauthenticated RCE bugs in the PHP engine itself, with a three-day federal deadline. Why it matters: PHP sits behind most of the web (WordPress, Drupal, Magento, cPanel…), and many hosts run end-of-life branches that get no official fix. Unit 42 threat brief · Recorded Future#breach — The government pulled more than 80 online public services offline following an attack. Why it matters: another reminder that small states’ centralised e-government platforms are high-value targets. Risky Bulletin#industry — The sweep across 20 African countries and the US recovered $105 million in stolen funds. Why it matters: cross-border policing of scam and fraud operations is maturing. Dark ReadingCRITICAL EXPLOITED KEV — Unrestricted file upload of dangerous file types, added to KEV on 27 Oct (federal due date 10 Nov). Patch any Magento store now. CISA alertEXPLOITED KEV — Unchecked return value in the Brotli compression library, added to KEV the same day. Brotli is embedded in browsers, web servers and countless libraries, so check your dependency tree. CISA alertHIGH — EPICS Base bugs allow DoS, memory corruption and possible code execution; the ICONICS / GENESIS suite has authentication bypasses (CVE-2026-16436, CVE-2026-16437). CISA — EPICS · CISA — Mitsubishi#threat — A new infostealer targets AI tool sessions and developer credentials alongside the usual browser data, exposing business data and infrastructure from one endpoint. Dark Reading#threat #ransomware — A wide-scale social-engineering campaign, possibly tied to Black Basta, floods inboxes then contacts victims as “IT support” via external Teams chats. Dark Reading#defense — The campaign above relies on external tenants being able to message your users; restricting external access to allow-listed domains removes the channel. Dark Reading#industry #ai — Jess Asato, who campaigns for victims of online abuse, became a victim of Grok-generated deepfakes herself. Wired#learning — Why a bill of materials tells you what you ship, but not what an attacker actually touched. Dark Reading#vuln CRITICAL ZERO-DAY KEV — Pre-auth RCE in NetScaler ADC/Gateway, one in default configuration; Mandiant saw WHIPSHOT and SLAPSHOT deployed against government, finance and tech in North America and Europe. Why it matters: NetScaler bugs historically become ransomware entry points for months. Unit 42 threat brief · The Hacker News · Help Net Security#vuln CRITICAL ZERO-DAY KEV — Affects APM used as an OAuth authorization server; engineering hotfixes available. The Hacker News#breach — The attacker obtained internal credentials and sent fraudulent withdrawals on 24 Sep; suspected North Korean. Why it matters: the security product itself was the way in. The Hacker News#industry — Court-authorised action against a service tied to ~12,000 inbox compromises that used AI across the attack chain. Microsoft Security · The Hacker News#breach — Says it holds data on agents and job applicants; the FBI’s job portals went offline. Dutch police later arrested a 24-year-old in the investigation. The Hacker News · Help Net Security · KrebsOnSecurity#breach — ANSSI says weak authentication, not sophistication, made it work. The Hacker News#breach — Triggered by federal threat intelligence. The Hacker News · The Hacker News#breach — Help Net Security#breach #supply-chain — Help Net Security#breach #ai — Including billing records. The Hacker NewsCRITICAL ZERO-DAY KEV — Exploited in targeted attacks; CVE-2026-93616 and CVE-2026-85102 added to KEV. The Hacker NewsCRITICAL EXPLOITED KEV — Fixed in 7.1.2; also “Comment2Shell” (CVE-2026-93485) fixed in 7.1.1. The Hacker News · The Hacker NewsCRITICAL EXPLOITED KEV — The Hacker NewsCRITICAL EXPLOITED KEV — Microsoft first listed the SharePoint bug as spoofing. The Hacker NewsHIGH EXPLOITED KEV — The Hacker NewsHIGH EXPLOITED KEV — The Hacker NewsHIGH EXPLOITED — Fixed in 1.6.16 and 1.7.1. The Hacker NewsHIGH ZERO-DAY KEV — The Hacker NewsCRITICAL EXPLOITED KEV — The Hacker NewsCRITICAL PATCH — The Hacker NewsHIGH — The Hacker News#threat — CVE-2026-85046 + CVE-2026-87491 + Windows ALPC CVE-2026-85880, via fake websites on 3–4 Sep. The Hacker News#threat — Joint advisory on the DPRK fake-job-interview campaign targeting developers. The Hacker News#threat — Microsoft Security#threat — Microsoft Security#threat — Microsoft Security#threat — The Hacker News#threat #ai — The Hacker News#threat #supply-chain — The Hacker News · The Hacker News#threat — The Hacker News#defense — Microsoft Security#defense — Microsoft Security#defense — Microsoft Security#defense — Unit 42#defense — Unit 42#defense — Help Net Security#industry #eu — Covers May 2018 to Feb 2020; six months to comply. The Hacker News#industry #eu — Help Net Security#industry #ai — Tests found deception and unauthorized actions; separately, an agent bypassed Australian Medicare portal controls. The Hacker News · The Hacker News#industry — KrebsOnSecurity#learning — SpecterOps#learning — Schneier on Security#learning — Schneier on Security#threat — The researcher behind months of Windows/Defender zero-day drops identifies as a former Microsoft researcher in Germany, and released BigDiskBuster, which blocks Defender updates. Cybernews · BleepingComputer · Transcript#vuln PATCH — Steve’s advice: if you run Cisco gear at the edge, update now — attackers will diff the fixes. Transcript#industry #eu — “Safe by design” rules for under-18s on social media, games and AI chatbots, which Steve calls messier than previous attempts. Transcript#breach — A new group that says it does not deploy ransomware; Canva says only the third-party feedback tool Canny was affected. Cyber Daily · Transcript#vuln #ai — Plus a hidden Muse setting that could turn the assistant into a backdoor. The Hacker News · TranscriptAlready covered: Claude used against OpenAI staff accounts and Gemini/Irregular (14–20 Sep), ShinyHunters vs FBI (above), AI-agent escapes (14–20 Sep).
#vuln CRITICAL ZERO-DAY KEV — CVE-2026-76461, an SQL injection that leads to root command execution. Why it matters: email gateways sit at the perimeter and see everything. Help Net Security · The Hacker News#vuln CRITICAL ZERO-DAY KEV — CVE-2026-76460: insufficient authentication on an API endpoint lets unauthenticated attackers in. Why it matters: ISE controls network access for the whole enterprise. The Hacker News#breach #supply-chain #ai — Per Mandiant, the assistant recommended a poisoned package, which was accepted; the worm stole secrets and source. Why it matters: a first well-documented case of AI dev tooling as the infection vector. The Hacker News#breach — Emails and password hashes exposed. The Hacker News#breach — Help Net Security#breach — Help Net Security#breach — Customers in Bahrain and UAE regions lost data. Help Net Security#breach #ai — Help Net Security#breach #supply-chain — The Hacker NewsHIGH EXPLOITED KEV — CVE-2025-39682 (TLS receive path, CVSS 9.8), CVE-2025-39964 and CVE-2026-53266; public local-root exploits for four kernel flaws were also released. The Hacker News · The Hacker NewsCRITICAL PATCH — The Hacker NewsCRITICAL EXPLOITED — Versions 3.21.21 to before 3.30.2. The Hacker NewsHIGH EXPLOITED KEV — Help Net SecurityHIGH EXPLOITED KEV — The Hacker NewsCRITICAL PATCH — Became a zero-day under attack the following week. The Hacker NewsCRITICAL PATCH — Patch your resolvers. The Hacker News · The Hacker NewsHIGH — Intel Macs can’t install the fix. Help Net SecurityHIGH — The Hacker News#threat — Spear-phishing against NGOs on 1 Sep (Volexity). The Hacker News#threat — Suspected Chinese actor compromised 13 organizations in six countries (Acronis TRU). The Hacker News#threat — The Hacker News#threat — The Hacker News · Help Net Security#threat — The Hacker News#threat — Hardware attack that silently drops memory writes; needs software control and brief physical access. The Hacker News#threat #ai — Gemini broke into real companies after a test-domain mix-up at evaluator Irregular; separately, researchers used Claude Opus 5 to chain flaws and take over OpenAI staff accounts. The Hacker News · The Hacker News#defense — Help Net Security#defense — Help Net Security#defense — Unit 42#defense — SpecterOps#defense — Help Net Security#defense — Unit 42#industry #eu — Manufacturers will report exploited vulnerabilities and incidents through one EU platform. Help Net Security#industry — The Hacker News#industry — KrebsOnSecurity#industry #ai — The Hacker News#learning — Schneier on Security#learning — A supply-chain lesson in dangling dependencies. The Hacker News#industry #ai — VulnCheck’s Patrick Garrity tracks how many CVEs Anthropic’s Mythos program actually produced; the count stays murky, with very little confirmed exploitation. CSO Online · Transcript#ai — Steve counts four Anthropic incidents and 10–23 at OpenAI where agents reached systems they shouldn’t. The Hacker News · Transcript#industry — How the state’s compulsory deletion platform is working out after Steve signed up in January. TranscriptAlready covered: IDScan’s 153M driver’s licences (7–13 Sep), September Patch Tuesday (7–13 Sep).
#vuln CRITICAL ZERO-DAY PATCH — Another record-breaking release; Windows CVE-2026-81963 and CVE-2026-85880 were added to KEV. Why it matters: a bug compared to the wormable SigRed DNS flaw plus in-the-wild zero-days means patch fast. Help Net Security · CISA KEV#vuln CRITICAL EXPLOITED KEV — CVE-2026-20079 and CVE-2026-20316 in Secure Firewall Management Center. Why it matters: owning the management plane means owning every firewall it manages. Help Net Security#threat #ai — A threat actor wrote a working exploit, then handed the mass break-in work to AI agents. Why it matters: AI-scaled exploitation compresses the window between disclosure and mass compromise. Help Net Security#threat — Sophos found the implant avoids disk entirely. Help Net Security#breach — Help Net Security#breach — Help Net Security#breach — About 67,000 more customers at risk. Help Net SecurityCRITICAL ZERO-DAY KEV — RCE in the MSP RMM platform; emergency hotfix. Help Net SecurityHIGH ZERO-DAY KEV — Fixed along with 230 other bugs. Help Net SecurityEXPLOITED KEV — Both added to KEV on 9 Sep. CISA KEVCRITICAL EXPLOITED KEV — CERT Polska found six flaws; CVE-2026-86060 and CVE-2026-67277 are in KEV. Help Net SecurityEXPLOITED KEV — Five additions on 11 Sep, incl. ScreenConnect CVE-2026-84869 abused via rogue clients. The Hacker News · Help Net SecurityCRITICAL PATCH — Found and privately reported by Calif. Help Net Security#threat #ai — Google research on agents automating scanning and credential attacks. Help Net Security#threat — Help Net Security · Help Net Security#threat — Blob URLs routed through genuine Microsoft OAuth and Teams infrastructure. Help Net Security#threat — Microsoft Security · The Hacker News#threat #ai — The Hacker News#defense — SpecterOps#defense — SpecterOps#defense — Unit 42#defense — Help Net Security#defense — Help Net Security#industry #ai — Help Net Security#industry — Help Net Security#industry — Help Net Security#learning — SpecterOps#learning — SpecterOps#industry #ai — Steve discussed what consolidation of the main open-model hub means for the ecosystem. Transcript#industry — Covered above. Tech Times · Transcript#learning — A lifelong safety engineer on what happens when people stop building skills because AI does the work. Good food for thought for students. Transcript#vuln CRITICAL ZERO-DAY KEV — Attackers chained CVE-2026-83548 (SSRF) and CVE-2026-83549 (OS command injection) on SMA 1000 appliances before patches existed. Why it matters: yet another remote-access appliance used as the front door. Help Net Security#breach — McKesson disclosed that attackers got into third-party applications and stole data. Why it matters: potentially one of the largest healthcare data thefts ever, via SaaS rather than core systems. Help Net Security#threat #ai — Stolen session cookies from infostealer infections were used to take over Claude accounts. Why it matters: AI assistant accounts now hold code, documents and credentials worth stealing. Help Net Security#vuln CRITICAL — A critical authentication bypass remains unpatched on tens of thousands of internet-facing servers. Help Net Security#breach — Help Net SecurityHIGH EXPLOITED KEV — CISA added CVE-2026-59822 (LiteLLM auth), CVE-2026-48710 (Starlette request smuggling), CVE-2026-49869 (Kestra command injection) and CVE-2026-82329 (Artifactory auth) on 2 Sep. AI gateways and MLOps tooling are now routine targets. CISA KEVHIGH EXPLOITED KEV — Help Net SecurityHIGH ZERO-DAY KEV — Added to KEV on 4 Sep; later shown to be part of a Chrome→Windows chain used by Chinese actors (see 21–30 Sep). CISA KEVEXPLOITED — Help Net SecurityPATCH — Help Net Security#threat #ai — An anti-analysis trick aimed at defenders who use LLMs to triage samples. Help Net Security#threat — Help Net Security#threat — Fake IT-support accounts call employees on Teams to gain a foothold. Help Net Security · Microsoft Security#threat — Help Net Security#threat #ai — Unit 42’s investigation of an attack driven by autonomous AI tooling. Unit 42#threat — Help Net Security#defense — Invisible Unicode tag characters hide content from filters. Microsoft Security#defense — Hunting guidance for a fake-download campaign. Microsoft Security#defense — Help Net Security#industry — Including Cyber Resilience Reviews and Ransomware Readiness assessments; operators are pointed to the Cross-Sector Performance Goals instead. Tech Times#industry — Help Net Security#industry #eu — Help Net Security#industry — Help Net Security#learning — SpecterOps#learning — Help Net Security#threat — VulnCheck rooted a 2019-era ZBT router and found two older implants beyond the ENDLESSDOORS backdoor disclosed in August (CVE-2026-66747, 100K+ units). Steve’s advice: stick with name brands. The Hacker News · CSA research note · Transcript#learning #ai — Research exhaustively testing AI vulnerability remediation found it lags far behind discovery and exploitation. Transcript