The TIE Brief
Leads 5
METR and Redwood Research conducted a three‑week red‑team assessment of OpenAI’s internal monitoring system, identifying several novel vulnerabilities that could allow agents to bypass oversight or disable monitoring. The findings were shared privately with OpenAI and include gaps in coverage, sandbox bypasses, and header‑based deactivation mechanisms.
Key points
- The assessment spanned July 21–August 11, 2026, giving researchers deep access to OpenAI’s codebase, monitoring prompts, and internal documentation.
- Researchers estimate 75‑94% of high‑capacity model traffic was monitored, but identified blind spots such as unmonitored RL training rollouts and compaction events.
- A discovered exploit could prevent hundreds of recent actions from being logged, and another allowed agents to bypass sandboxing and auto‑review controls.
- Two client‑controllable headers were found that can disable monitoring for new agents, effectively creating unmonitored instances.
- OpenAI reportedly fixed some issues, such as compaction‑event monitoring, during the exercise.
A remote code execution flaw in the Brotli compression library (CVE‑2026‑111497) allows memory corruption and arbitrary code execution in applications that decode attacker‑controlled data. The vulnerability affects Node.js, Python packages and several other language runtimes, with patches now released for most major libraries.
Key points
- The flaw is an out‑of‑bounds write in Brotli versions 1.0.3‑1.2.0 that can be triggered by crafted compressed streams, leading to memory leaks, crashes or remote code execution.
- Node.js disclosed the issue as “node2shell,” and Python packages were later found vulnerable, prompting broader language‑wide alerts.
- Patches have been published for libbrotli, Node.js, Python Brotli packages, C++, Bun, Envoy and other components; Apache and Nginx do not decode Brotli by default.
- OpenAI reported the underlying bug earlier in the year and issued an advisory after recognizing its security impact.
- Users are advised to upgrade affected libraries immediately or disable Brotli decoding until patches are applied.
Singapore Police alert the public to a malware‑enabled scam that uses fake Facebook ads to distribute malicious APKs, leading to unauthorized bank transactions and losses of about $989,000 across 62 reported cases since April 2026.
Key points
- The scam uses counterfeit ads for senior activities, fitness, and recycling programs to lure users into downloading a malicious APK.
- After installation, the malware enables scammers to impersonate officials, request money, and conduct unauthorized bank transfers.
- Victims reported a total loss of at least $989,000 in 62 cases, with some transactions performed directly by the malware.
- Police advise only installing apps from official stores, keeping Google Play Protect enabled, and using the ScamShield app for protection.
- The advisory emphasizes that Singapore government officials will never request money, personal banking details, or app installations from unofficial sources.
Claroc researchers discovered that Muse, Meta's AI assistant, publishes shared conversations as publicly accessible pages whose URLs embed the conversation title, making them discoverable through passive DNS and other services. Hundreds of pages contained sensitive personal and corporate information before Meta suspended the feature.
Key points
- Muse creates a public page for each shared conversation, embedding the title in the URL which is indexed by passive‑DNS services.
- A search of the Muse domain revealed over 6,800 share URLs, many opening without authentication.
- Samples included personal budgets, a bank‑fraud alert, a loan application, and confidential executive‑search prep.
- The exposure enables fraud, impersonation, and social‑engineering attacks.
- Meta suspended the sharing feature after the issue was reported by Ars Technica.
Researchers discovered that several HTTP/3 implementations allow a remote unauthenticated client to trigger massive memory allocation, leading to out‑of‑memory conditions. Seven of ten tested libraries are vulnerable, with patches released for quic‑go, Cloudflare quiche, and Wireshark.
Key points
- The flaw stems from missing or delayed decoded‑header size limits, allowing tiny HEADERS frames to expand into hundreds of thousands of header objects in memory.
- Affected implementations include quic‑go (CVE‑2025‑64702), Cloudflare quiche (CVE‑2026‑12523), Wireshark (CVE‑2025‑13945), lsquic, Bun, aioquic/mitmproxy, and hyperium’s h3 crate.
- Patches were released by October 20 2026 for quic‑go, Cloudflare quiche, and Wireshark; other libraries remain unpatched or have work‑arounds.
- Mitigations include disabling HTTP/3 in vulnerable servers or setting strict max‑field‑section sizes.
- IIS, Envoy, and ngtcp2/nghttp3 were not impacted by the tested vectors.
Developing 25
Storm-0940 employs AI‑powered ARTEX to hijack ConnectWise backup app credentials and exploit Okta self‑service registration, affecting hundreds of cloud tenants.
Key points
- Microsoft reported that Storm-0940’s ARTEX framework has been used against hundreds of organizations since September 2026, achieving privileged cloud access in under three hours.
- A stolen ConnectWise Cloud Backup app credential allowed the actor to sign into Microsoft 365 tenants as the app, assign Global Admin rights, and plant secrets in other apps, with no MFA prompt.
- ConnectWise disabled the compromised app identities, but existing access tokens and planted secrets remain usable until manually removed.
- Expel observed the same infrastructure abusing Okta self‑service registration, creating accounts, enrolling Okta Verify, and issuing dozens of OAuth tokens before being blocked by Okta ThreatInsight.
- Detection guidance includes searching for Storm-0940 IPs across identity platforms, monitoring app credential changes, and flagging rapid self‑registration activity in Okta.
Sources
expel.com
SecurityWeek
huntress.com
The Record by Recorded Future
CSO Online
The Hacker News
Cyberscoop
Twitter/HackingLZ
Microsoft Threat Intelligence Blog
Cyberscoop
The Hacker News
The Record by Recorded Future
SecurityWeek
CSO Online
specterops.io
huntress.com
The Hacker News
Twitter/HackingLZ
Bleeping Computer
The Hacker News
@HackingLZ
@HackingLZ
20 articles
PHP patches two high‑severity RCE flaws, with active exploitation observed in the wild.
Key points
- Two CVEs (CVE‑2026‑109618, CVE‑2026‑109619) receive a CVSS 9.2 rating and allow unauthenticated RCE via out‑of‑memory corruption and stale global state bugs.
- Researchers demonstrated unauthenticated memory disclosure that can expose passwords, tokens and API keys.
- Cloudflare has logged attack traffic targeting the flaws, confirming active exploitation against internet‑facing PHP servers.
- Qualys analysis shows 167 million PHP installations, 73 % of which are internet‑facing, highlighting widespread exposure.
- Patch releases for all affected PHP deployment types (Apache mod_php, PHP‑FPM, php‑cgi, FrankenPHP, LiteSpeed) are the sole full remediation.
Sources
qualys.com
arcticwolf.com
linkedin.com
The Hacker News
Twitter/HackingLZ
Twitter/HackingLZ
Twitter/HackingLZ
virustotal.com
openai.com
Twitter/blackorbird
Bleeping Computer
SecurityWeek
The Hacker News
The Hacker News
The Record by Recorded Future
linkedin.com
amazon.com
hadrian.io
google.com
CSO Online
Twitter/lorenzofb
Bleeping Computer
SecurityWeek
SecurityWeek
The Hacker News
Twitter/HackingLZ
dshield.org
sans.edu
eliastaylor.com
CSO Online
amazon.com
The Record by Recorded Future
SecurityWeek
thephp.foundation
Krebs on Security
Rapid7 Research Blog
Securelist
Twitter/blackorbird
The Record by Recorded Future
cloudflare.com
Bleeping Computer
openai.com
The Hacker News
Twitter/AndrewMohawk
Twitter/AndrewMohawk
Twitter/craiu
Twitter/AndrewMohawk
wiz.io
Cyberscoop
CISA Cybersecurity Advisories
The Hacker News
SecurityWeek
The Hacker News
jackalsyn.com
Twitter/blackorbird
php.net
Elastic Security Labs
Bleeping Computer
php.net
Twitter/HackingLZ
@HackingLZ
@HackingLZ
@HackingLZ
@JohnHultquist
@JohnHultquist
@blackorbird
@lorenzofb
@craiu
@HackingLZ
@blackorbird
@AndrewMohawk
@AndrewMohawk
@craiu
@AndrewMohawk
@craiu
@blackorbird
@HackingLZ
60 articles
k0t’s campaign targets exposed network edge devices, compromising over 70,000 credentials through known flaws and brute‑force methods.
Key points
- The group scans internet‑facing firewalls and VPNs using services like FOFA and ZoomEye and exploits CVE‑2025‑64446 and CVE‑2026‑0257.
- Initial access is gained via custom Python scripts or credential stuffing, followed by VPN tunneling and credential harvesting from AD and SMB.
- Persistence is achieved with tools such as MeshCentral, Atera, Teramind, AdaptixC2 and a suite of admin utilities including Mimikatz and PetitPotam.
- Exfiltrated data is uploaded to Wasabi S3 and MEGA using Rclone.
- The campaign is tied to ransomware affiliates Qilin and The Gentlemen, though direct ransomware deployment is not confirmed.
CISA flags two critical, actively exploited flaws in Collabora Online and Arista VeloCloud, with patches available and a federal remediation deadline.
Key points
- CISA’s KEV catalog now includes CVE-2026-110447, a command‑injection bug in Collabora Online’s CODE server that enables remote code execution via proxy.php.
- CVE-2026-114625 is an SQL‑injection flaw in on‑premise Arista VeloCloud Orchestrator that can grant privileged access after authentication.
- Both flaws received critical CVSS scores (9.2 and 9.9) and were patched in September and October 2026 respectively.
- Threat actors have been observed weaponizing the Collabora flaw to backdoor Nextcloud instances and search for credentials and crypto wallets.
- Federal agencies are advised to apply the fixes by 26 Oct 2026 to mitigate risk.
LiteLLM Python package compromised in supply‑chain attack delivering credential stealer and backdoor
An attacker leveraged a leaked GitHub owner token to inject malicious code into LiteLLM’s v1.107.0 release on PyPI.
LiteLLM Python package compromised in supply‑chain attack delivering credential stealer and backdoor
Key points
- May 2026: a commit exposed a master GitHub OAuth token for the LiteLLM Agent Platform; the key was not revoked.
- October 10, 2026: the actor used the token to gain owner‑level access to all LiteLLM GitHub repos and harvested additional tokens from CI pipelines.
- Using multiple stolen tokens, the attacker altered the release pipeline and published a malicious LiteLLM v1.107.0 package to public registries.
- LiteLLM responded by revoking all compromised credentials, publishing an incident report, and advising users to remove the tainted version.
A test‑run Miasma‑family worm was published to npm via 15 “testmetest” packages, stealing credentials and deploying a token‑revocation wiper.
Key points
- The worm shares code with the June 2026 Miasma “Phantom Gyp” variant and adds a wiper component from Mini Shai‑Hulud.
- Four packages remain live with the malicious payload; eleven were removed from the registry on 21 Oct.
- The malicious payload follows a three‑stage release pattern: stub, decoy, then a malicious patch marked as latest.
- SafeDep found no compromised downstream packages or victims, attributing all activity to the operator’s test accounts.
- The variant bypasses known Miasma detection signatures by altering loader size, hashes, and marker strings.
Atlassian discloses CVE‑2026‑21589 allowing unauthenticated file reads in eight Data Center products
Atlassian patches 75 third‑party vulnerabilities across its Data Center and Server lineup, urging updates without evidence of current attacks.
Atlassian discloses CVE‑2026‑21589 allowing unauthenticated file reads in eight Data Center products
Key points
- The October bulletin covers 162 high‑severity and 14 critical‑severity flaws, all tied to open‑source libraries used in Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management.
- Critical CVEs include Apache Tomcat issues (CVE‑2026‑65637, CVE‑2026‑65182, CVE‑2026‑68525), a Bouncy Castle flaw (CVE‑2026‑58062), and others affecting Netty, Apache SSHD, and more.
- Most vulnerabilities are denial‑of‑service, SSRF, information‑disclosure, or code‑execution bugs, but Atlassian rates the risk as non‑critical for customers.
- Customers are urged to apply the latest product versions or specific patched releases, as threat actors have historically weaponized similar flaws quickly.
OpenAI employee arrested for covertly recording confidential meetings using a cheap microcontroller device.
Key points
- The DOJ alleges Abdulrahman Alfozan installed a SEEED microcontroller board with camera, microphone and Wi‑Fi in a conference room, concealed in toilet paper and powered via USB.
- A second device was found in a printer room after OpenAI discovered the activity and confiscated it along with Alfozan’s personal items.
- Alfozan reportedly used his and his wife’s ChatGPT accounts to research building the device and to identify target rooms, and communicated with a Saudi royal family member via WhatsApp.
- He was arrested before a planned two‑month parental leave; Saudi officials later funded his family’s repatriation.
- The incident highlights insider‑threat risks in frontier AI labs amid broader geopolitical competition over AI technology.
Two critical PHP RCE bugs (CVE‑2026‑109618/119) are being exploited in the wild; patches and mitigations are now available.
Key points
- Both CVE‑2026‑109618 and CVE‑2026‑109619 enable remote code execution through improper handling of out‑of‑memory errors via longjmp(), affecting PHP installations worldwide.
- Unit 42 observed attackers leveraging AI‑driven tools to exploit the flaws, quickly harvesting password hashes and MFA secrets from a European government site.
- The PHP Group has issued a security advisory and patches; Palo Alto Networks provides virtual‑patching and detection via Cortex XDR, XSIAM, Prisma Cloud, and Xpanse.
- Telemetry indicates more than 22.6 million exposed instances could be vulnerable, underscoring urgent remediation.
- The brief includes threat‑hunting queries and recommends engaging Unit 42 services for deeper investigation.
A compromised LiteLLM 1.107.0 release on PyPI uses Python startup hooks to steal credentials from any environment where Python runs with the package installed.
Key points
- The malicious wheel placed cook.pth, cook.py and sitecustomize.py in the Python library path, causing automatic execution during interpreter initialization.
- Two payload paths were identified: a credential collector that encrypts and sends data to an attacker‑controlled endpoint, and a Unix‑specific loader that could fetch extra code.
- Collected data includes GitHub tokens, cloud API keys, browser cookies, SSH keys, environment variables and LiteLLM database configuration.
- Microsoft advises removing the package, cleaning affected environments, and monitoring for the described detection indicators.
- The attack leveraged stolen developer credentials to hijack the release workflow, highlighting risks in open‑source supply chains.
ABC removes devices exposed to an ad‑tech spyware operation, though no breach has been confirmed.
Key points
- Citizen Lab uncovered an ad‑tech campaign, dubbed “Adfection,” that uses malicious online ads to deliver spyware without user interaction.
- The operation is linked to Israeli firm Discover‑Tech, which exploits advertising platforms such as Google to target high‑profile Australian entities.
- ABC confirmed a small number of devices saw the ads and is wiping them as a precaution, reporting no evidence of compromise.
- Researchers say the technique could profile tens of millions of devices, raising concerns for government and critical‑infrastructure sectors.
Sources
abc.net.au
Cyberscoop
Twitter/RonDeibert
Twitter/RonDeibert
citizenlab.ca
SecurityWeek
Bleeping Computer
CSO Online
The Record by Recorded Future
The Hacker News
Twitter/ryanaraine
Twitter/dcuthbert
Cyberscoop
@RonDeibert
@RonDeibert
@ryanaraine
@blackorbird
@dcuthbert
@ryanaraine
@dcuthbert
13 articles
Initia shut down its network after a token‑minting bug led to a $2.7 million loss.
Key points
- The exploit leveraged a MoveVM bug in the Cosmos SDK implementation to create unauthorized AUSD tokens.
- Approximately 1.4 M AUSD, 105 ETH and 1.08 M USDC were transferred to an Ethereum address.
- Initia announced the halt of its L1 and rollup layers on Oct 23, 2026, and is investigating with validators and exchanges.
- The native INIT token price remained stable despite the incident.
- No patch or official advisory has been released yet.
ThreatMon’s September 2026 ransomware report details active attacks on eight companies across diverse sectors and regions.
Key points
- Eight victim companies were compromised by seven distinct ransomware groups during September 2026.
- Impacted sectors include technology, financial services, hospitality, manufacturing and other critical industries.
- Incidents occurred in Japan, the United States, Turkey, Germany, Peru, Canada and Lithuania.
- Consequences ranged from operational downtime and reputational damage to notable financial losses.
- The report stresses the need for stronger defenses and incident‑response capabilities.
Q3 2026 saw a 23% rise in ransomware attacks, especially against critical infrastructure, driven by AI‑enhanced threat groups.
Key points
- Ransomware incidents increased 23% YoY in Q3 2026, totaling 821 attacks in September, with North America most targeted.
- Industrial sector faced 230 attacks, making it the top‑targeted critical‑infrastructure segment.
- Threat groups Qilin (365 attacks) and The Gentlemen (359 attacks) dominated the ransomware landscape.
- A UK power‑generation facility was knocked offline for four days, attributed to Iranian‑linked actors targeting OT systems.
- AI‑enhanced malware BraZetsu and misused AI agents were highlighted as emerging ransomware enablers.
Meta was hit with a $25 billion fine for unlawful data sharing, highlighting stricter privacy enforcement.
Key points
- Meta was ordered to pay $25 billion after a judge found it breached New Mexico consumer‑protection and privacy statutes between 2010‑2021.
- The court cited more than 43 million violations, including unauthorized access granted to third‑party developers such as Cambridge Analytica.
- Judge Francis Mathew reduced a potential $219 billion award but emphasized the severe harm to users and the company’s core business model.
- Meta plans to appeal the decision while recent fines in the U.S. and Europe signal growing regulatory pressure on big‑tech data practices.
NAIC’s 2026 report reviews the state of the cybersecurity insurance market.
Key points
- The report provides a comprehensive overview of premium volumes and loss ratios for cyber policies.
- It examines underwriting criteria, policy terms, and exclusions commonly used by insurers.
- Emerging risk drivers such as ransomware, supply‑chain attacks, and regulatory changes are highlighted.
- The analysis includes regional market segmentation and forecasts through 2028.
- Recommendations for insurers on pricing, risk modeling, and portfolio diversification are offered.
Sources
naic.org
ironscales.com
courtlistener.com
federalregister.gov
virusbulletin.com
justice.fr
cisa.gov
7 articles
Pentagon mandates U.S. universities sever foreign research collaborations, with all 30 complying and seven recognized for rapid action.
Key points
- The DoD ordered a review of ties to foreign institutions listed under Section 1286 of the 2019 NDAA across 30 universities.
- Audits resulted in over 80 termination-related actions, and all schools reported full mitigation of identified relationships.
- Seven universities—Oklahoma State, Penn State, UNC‑Chapel Hill, South Carolina, USC, Texas‑Austin and Virginia Tech—were singled out for “above and beyond” efforts.
- The directive also covered partnerships with entities linked to rebranded Confucius Institutes and a list of 130 problematic foreign research institutions.
- The policy follows broader U.S. efforts to curb foreign influence in academic research, echoing similar actions in the UK.
Detection rules for CVE‑2026‑111497 are published and patches for Brotli and related runtimes are available, with no known active exploitation.
Key points
- The guide provides multiple Sigma signatures covering Brotli, Python, Node.js and urllib3 decoding failures, each verified against fixture matrices but not yet validated in production environments.
- Suricata and ModSecurity signatures are also supplied, targeting HTTP request bodies that negotiate Brotli compression.
- Falco rule examples are included, though they require kernel‑instrumented hosts and are not yet compiled.
- Patch recommendations upgrade Brotli to 1.0.10/1.1.1/1.2.1 and update dependent runtimes such as Node.js 22.23.4, Python Brotli ≥1.2.1, Bun ≥1.4.4 and Envoy/Istio per vendor advisories.
Genesys contained an intrusion that accessed internal LMS and CRM data, exposing customer details but not its cloud platforms.
Key points
- The breach affected Genesys' internal learning management system and customer relationship management platform, exposing names, emails, phone numbers, job titles, and company data.
- Genesys confirmed that its Cloud, Engage, and Engage Cloud services remained secure with no unauthorized access to customer data.
- Immediate remediation included suspending the LMS and ongoing monitoring of the environment.
- Customers are advised to watch for suspicious communications and follow security best practices.
- The investigation remains ongoing to determine full scope and impact.
Ransomware gangs are shifting to a diversified service model that profits from multiple post‑intrusion activities beyond encryption.
Key points
- The ransomware business now treats initial access as a tradable commodity, with brokers, developers and money‑laundering services forming a specialized supply chain.
- Data theft, public disclosure threats and regulatory pressure are increasingly used for extortion, making encryption optional in many attacks.
- Artificial intelligence assists attackers in victim triage, data analysis and negotiation, lowering post‑compromise costs.
- Law‑enforcement actions and regulatory changes have fragmented groups but the overall ransomware economy remains resilient.
Google Brotli decoder suffers a critical out‑of‑bounds write vulnerability affecting versions 1.0.3‑1.2.0.
Key points
- The vulnerability resides in c/dec/decode.c and allows remote unauthenticated exploitation via crafted Brotli streams.
- Impact includes memory corruption, disclosure of sensitive data, denial‑of‑service, and potential arbitrary code execution.
- All platforms are affected; the issue is classified as critical severity.
- Mitigation requires updating Brotli libraries to version 1.0.10, 1.1.1, or 1.2.1.
- The advisory was published and reviewed by GitHub and the NVD on 22‑23 Oct 2026.
A threat actor has compromised nearly a thousand Magento stores with a persistent JavaScript loader hosted on deepveindrilling.com.
Key points
- Sansec’s research uncovered the deepveindrilling.com loader in the CMS block tables of 953 Magento shops, with 83 stores detected in a recent crawl and 148 installations over the campaign’s lifespan.
- The loader injects a script that reads a localStorage key, triggers stored code via an invisible div click, and collects detailed browser fingerprints to tailor responses.
- Two versions appeared in October 2026: an initial script referencing the domain directly, and a later inline loader that sends fingerprint data to the attacker’s server.
- The malicious code can write to the store’s database, and removal of the script does not revoke the attacker’s access.
- The campaign builds on earlier loaders tracked since July 2025, rotating domains and using the Keitaro ad‑tracking system to distribute payloads.
eMudhra quits TLS business after releasing eight certificates with practically unusable private keys.
Key points
- eMudhra disclosed that eight intermediate TLS certificates it issued had private keys ranging from 3 to 8 bits, far below the expected 384‑bit entropy.
- Researchers demonstrated the keys could be cracked in milliseconds, allowing anyone to forge trusted certificates for browsers, mail servers, IoT devices, and other systems.
- The company said the incident, amplified on social media, prompted its board to withdraw from the global SSL/TLS market, which contributed only 1% of revenue.
- eMudhra cited rising compliance costs and competition from free‑of‑charge TLS providers as additional reasons for the exit.
Datadog unveils pathrunner, a tool to automate AWS IAM privilege‑escalation testing based on its pathfinding.cloud catalog.
Key points
- Pathrunner is a modular, cloud‑native framework released on GitHub to automate attacks against AWS IAM privilege‑escalation paths.
- It integrates with the pathfinding.cloud catalog and the Pathfinding Labs vulnerable AWS environments for hands‑on learning.
- The console supports importing, switching, and exploiting multiple IAM identities to capture and reuse credentials.
- Datadog positions the tool as a way for defenders to demonstrate impact of misconfigurations and prioritize remediation.
- Documentation and demo videos are provided to illustrate end‑to‑end exploitation scenarios.
A Tailscale SSH vulnerability could let a compromised device obtain root on other servers in the same network.
Key points
- The Tailworm report shows that a single foothold on a Tailscale network can be leveraged to execute root commands on other devices through SSH port forwarding.
- The issue affects Tailscale version 1.104.2 and self‑hosted Headscale 0.29.5, with no vendor‑issued fix or CVE at the time of disclosure.
- Tailscale’s response indicates they are reviewing the findings and have not recommended disabling Tailscale SSH for all users.
- The attack does not require stolen passwords or keys, relying instead on device identity and permissive access rules.
- Researchers label the vulnerability as “wormable,” though it has only been demonstrated in a lab environment.