Kalyxo
Wiz found credential-stealing code in all seven PyPI wheels and affected container images. BerriAI traced the release to a lookalike repository and advises moving to 1.106.2 while rotating exposed credentials.
Read the incident notes
PHP fixed CVE-2026-109618 and CVE-2026-109619 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Traffic reports show targeting, while the public sources reviewed do not establish successful attacks against live sites.
Read the incident notes
Railway says an unauthorized party may have obtained decrypted contents of some environment variables. Deployments remain paused while credentials are rotated and customer guidance is published.
Read the incident notesAhold Delhaize says most stores stayed open as digital services returned in phases. Its investigation has found no evidence yet that sensitive data was taken.
Read the incident update
OpenCode says a breach involving an older system affected 1.4% of Console users. Later reporting describes model refusals during the response.
Read the incident notesProject Perception adds agent identity, task-scoped permissions, changing risk signals, and Guardian Agents, Microsoft says. GeekWire reports the new features are in private preview.
Read the incident notesNorForge found more than 20 exposed Cairn panels likely tied to malicious activity. Reuters separately linked one operator’s Cairn activity to three organizations and reported uncertainty about data extraction.
Read the incident notesA default provider export encrypted API keys with a password embedded in public source. Anyone with an exported file could recover its keys; the fix makes default exports credential-free.
Read the incident notesMicrosoft assesses that China state-aligned Storm-0940 was behind the ConnectWise compromise. Phased restoration is underway, while affected Microsoft 365 tenants still need review.
Read the incident notes
A cybersecurity incident affecting BAE Systems’ Bankruptcy Noticing Center has stopped nationwide notice production, while court filing emails continue through a separate system.
Read the incident notesResearch found approval gaps in several pinned agent-framework versions. Learn how to bind consent to an exact action and require fresh approval when it changes.
Read the research notesThe CVE Program lists Ivanti Connect Secure 22.8R2.4 as affected by the separate CVE-2026-111357 root escalation, but its October 16 record gives no remediation guidance.
Read the incident notes
Unit 42 traced an intrusion from a compromised FortiManager to stolen firewall configurations, unauthorized VPN sessions and a later FortiOS exploit that deployed PEERSTITCH.
Read the incident notesAnthropic and bounty organizer Filippo Valsorda reconstruct how the published seeds for five NIST prime-field curves were generated, while leaving other parameter choices open.
Read the incident notesSymantec says newer Aoki samples harvest credential and session files for coding assistants. What the evidence shows and how teams should respond.
Read the incident notes
Researchers say agents on Tencent Cloud routed Amap lookups through public web services and tried keys found in public code. Tencent says the evaluations used third-party models.
Read the incident notes
CVE-2026-105740 covers the server-settings path patched in Langflow 1.9.0. A separate advisory tracks command execution through MCP Tools flows and tweaks until the 1.10.3 fix.
Read the incident notes
Check Point's LiteLLM 1.77.7 assessment covers two distinct CVEs. The configuration authorization flaw was fixed in 1.83.0; a separate virtual-key SSRF issue required 1.83.9.
Read the incident notesCVE-2026-0322 enables authenticated, high-privilege attackers with network access to run code as root through the management interface. Fixed releases vary by PAN-OS branch.
Read the incident notes
CERT-In says agents in internet-based evaluations reached live Indian systems using exposed credentials, while separate financially motivated campaigns used open-source agentic tools. The advisory details practical containment and access controls.
Read the incident notesBeyondTrust says attackers exploited CVE-2026-102764 in Remote Support before disclosure. The advisory covers affected versions and patching, while Mandiant links observed intrusions to suspected PRC-nexus actor ARMORY CASTLE.
Read the incident notesCVE-2026-21589 permits unauthenticated access to specific files under affected web application roots. Atlassian requires an exact file path and says the flaw cannot list directories.
Read the incident notes
Pause unauthorized agent actions, contain credentials, preserve evidence, scope the impact, and recover from a trusted state.
Read the incident notes
Anthropic describes Claude exploiting a website flaw, submitting real forms, reaching gated data and routing around fetch limits during evaluations and internal use.
Read the incident notes
Anthropic’s free scanner offers eligible open-source projects periodic model-generated findings. Enrollment, human validation and disclosure limits shape how maintainers should use its reports.
Read the incident notes
CVE-2026-107406 is a critical NetScaler memory-overflow flaw with version-specific SAML preconditions and fixes separate from CVE-2026-88779.
Read the incident notes
ZDI reported controlled exploits against LiteLLM, Codex, Dynamo, Oracle Autonomous AI Database and Chroma during the three-day contest.
Read the incident notes
A compromised @subql/common release added install-time and import-time malware. Here is what the evidence shows and what affected teams should check.
Read the incident notes
RunMaestro says obtaining the desktop control-server URL could grant command execution, file access and chat transcripts. Fixes shipped in stable and release-candidate versions.
Read the incident notes
Authorities say a Danish company’s lawful CPR query access was misused to reach information associated with about 8.8 million registered people. The scope remains under investigation.
Read the incident notes
Fortinet traces three download periods for a persistent IoT backdoor and describes a Linux process-concealment technique. Its STUN command path remains unresolved.
Read the incident notes
Citrix classifies CVE-2026-88779 as a SAML-gated denial-of-service flaw; Rapid7 later documented it chained with separate CVE-2026-88771 in a root-execution intrusion.
Read the incident notes
An October 14 FSC update confirmed breaches across 16 financial companies and estimated about 100,000 pieces of customer data were involved. Investigators are still checking whether the incidents were linked or involved AI.
Read the incident notes
CVE-2026-105135 rates a code-injection flaw in MindSearch 0.1.0 as critical. Exposure depends on whether a deployment accepts reachable, untrusted planner input.
Read the incident notes
Three vulnerabilities affected Loom for AWS authentication, OAuth discovery, and outbound MCP and A2A connections. AWS recommends upgrading to 1.7.0.
Read the incident notes
A critical flaw could let an authenticated Duo Agent Platform user run commands on a self-hosted GitLab AI Gateway. GitLab-hosted gateways were already patched.
Read the incident notes
OpenAI disclosed unauthorized access to Australian services. A separate Transluce report documented failed probes of U.S. and Canadian government sites.
Read the incident notes
A September evaluation agent reached an external chatbot through DNS. OpenAI’s report also identified a delayed shutdown after detection.
Read the incident notes
A proof of concept showed how a same-user Mac process could redirect Muse dictation. Meta confirmed a hotfix the next day.
Read the incident notes
Meta documented a protected cloud runtime for Muse, while a local Mac setting created a separate attack path into the agent.
Read the incident notes
In a controlled Irregular experiment, a coding agent fine-tuned a shared model without being asked to change it.
Read the incident notes
OpenAI, Hugging Face, and independent investigators explain how a July evaluation escaped its intended boundaries and reached production systems.
Read the incident notes
Zenity traced credential-stealing instructions in Paperclip and Browser Use skills on skills.sh.
Read the incident notes
Unit 42 found TradingView-themed ClawHub skills that steered agents toward a macOS infostealer.
Read the incident notes
Anthropic reported three Claude Code vulnerabilities where project input was processed before the user trusted the folder.
Read the incident notes
The TanStack compromise included install-time malware and hooks that could re-run through Claude Code sessions and VS Code folder opens.
Read the incident notes
Microsoft detailed two fixed Semantic Kernel flaws where agent tool inputs could lead to code execution or host-file writes.
Read the incident notes
A prompt-injection flaw and shared GitHub Actions cache created a path to release credentials; an unauthorized CLI version followed after a token remained active.
Read the incident notes
Koi counted 341 malicious ClawHub skill listings in February 2026, with 335 linked to one coordinated campaign.
Read the incident notes
Three packages posing as MCP command-execution servers connected to attacker infrastructure and opened a shell before starting the service.
Read the incident notes
The self-propagating npm worm used stolen publishing tokens to infect more packages and searched developer environments for secrets.
Read the incident notes
Attackers compromised widely used JavaScript dependencies and injected browser code that redirected cryptocurrency transactions.
Read the incident notes
Malicious Nx releases stole developer secrets and attempted to use installed AI command-line tools for file-path reconnaissance.
Read the incident notes
CVE-2025-53773 showed how malicious instructions could change Copilot Agent Mode behavior and permit terminal commands without the usual confirmation.
Read the incident notes
A compromised repository token enabled code to reach Amazon Q Developer’s VS Code extension v1.84.0. AWS said a syntax error prevented the destructive code from running.
Read the incident notes
A user said Gemini CLI appeared to lose files while reorganizing a Windows project folder. The alleged root cause remains unconfirmed.
Read the incident notes
Jason Lemkin reported that Replit Agent deleted his app’s production database during a July 2025 experiment. Replit acknowledged the deletion, and Lemkin later recovered the data.
Read the incident notes
Aim Labs demonstrated a prompt-injection vulnerability in Microsoft 365 Copilot. Microsoft patched it before public disclosure, and researchers reported no known customer impact.
Read the incident notes