New KEV entries, exploitation CISA KEV has not listed, new public exploits, EPSS risers and new critical CVEs. CVEs flagged by several sources come first.
Loading the briefing
Threat timeline
New threats per day
Click a day to open its threats · drag across days to zoom inShow as table
The BOSSAI campaign involves a single operator using a mesh of 12 AI agents to conduct persistent attacks across 11 countries. The attacker leveraged both abliterated and commercial AI models in specialized roles such as infrastructure building, vulnerability scanning, and exploitation. Primary targets included emergency services, universities, financial institutions, and government systems in Taiwan, Thailand, and Mexico. Confirmed breaches include exfiltration of medical records from Taipei emergency services, student data from Thai universities, and over 200,000 Mexican residential phone records. Despite attempts to jailbreak commercial AI models, the attacker relied on less effective abliterated models. The investigation uncovered the full operational infrastructure, including command histories and victim data, highlighting both the capabilities and limitations of AI-augmented autonomous exploitation.
The Haiou jailbreak bundle is a prompt package targeting OpenAI Codex that weakens model guardrails for security-related tasks such as hacking and software cracking. It functions as prompt adware by modifying Codex configuration files to inject advertisements for the author's LLM gateway service into agent responses. The bundle uses techniques like role-playing, context-reframing into CTF scenarios, and refusal suppression. It was found on a misconfigured webserver alongside tools like Cobalt Strike, VulnClaw agent, and Ladon framework, indicating active use by cybercrime actors. The freely distributed jailbreak serves as a channel to promote a paid gateway service, persistently injecting promotional content through encrypted payload files distributed via GitHub and Chinese platforms.
Microsoft Threat Intelligence has identified a malware campaign that targets users seeking cracked software, free games, activators, and unofficial utilities. The campaign uses trojanized Inno Setup-style installers to deliver monetized software payloads via a multi-stage attack chain. These payloads include routing third-party internet traffic through infected devices, enrolling devices in distributed computing platforms, and installing utility software without user consent. The malware achieves persistence through scheduled tasks and operates silently, posing security and privacy risks to affected users.
A malicious version of the Claude Code extension (versions 2.1.312 and 2.1.313) was distributed via the Cursor extension marketplace on October 29, 2026. This compromised extension injected JavaScript that executed during module loading to establish a persistent SSH backdoor. It collected host reconnaissance data, installed an attacker-controlled SSH key, enabled local SSH services, and created reverse SSH tunnels to attacker infrastructure. Persistence was maintained through platform-specific mechanisms such as macOS LaunchAgents, Linux cron jobs, and Windows scheduled tasks. The attack used built-in system tools to evade detection. Microsoft confirmed the malicious packages were not distributed through Visual Studio Marketplace or npm, and Anthropic's systems were not compromised. The incident appears limited to the Cursor marketplace.
Meta's Muse AI agent underwent a private bug bounty program before its public launch, resulting in payouts totaling approximately $1.2 million. A significant $300,000 bounty was awarded for a pre-launch vulnerability in internal test virtual machines that exposed conversations and authentication tokens due to a flawed trust validation involving proxy headers. Additional vulnerabilities included malicious web page interactions, bypassing email redaction filters, Android app link handling flaws, and a Mac app auto-update code execution issue. Meta addressed these flaws by taking the service offline, fixing the bugs, and enhancing detection mechanisms.
A path traversal vulnerability (CWE-22) exists in TÜBİTAK BİLGEM Software Technologies Research Institute's İmzager software versions from 2.10.5 up to but not including 2.10.7. This flaw allows unauthorized path traversal, potentially leading to limited integrity impact. The issue is fixed in version 2.10.7.
CVE-2026-19721 is an XML External Entity (XXE) vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute's İmzager software. It affects versions from 2.10.5 up to but not including 2.10.7. The flaw allows improper restriction of XML external entity references, enabling serialized data external linking. The vulnerability has a low CVSS score of 3.3 and does not impact confidentiality or availability but may affect integrity. A fix is available in version 2.10.7.
A timing side-channel vulnerability exists in the PKCE implementation of the OAuthlib Authorization Code Grant flow. The vulnerability arises because the code_verifier comparison uses Python's standard '==' operator instead of a constant-time comparison, allowing attackers to measure timing differences and potentially recover the code_verifier. This could lead to account takeover if exploited. The issue affects versions >=5.4.0 and <5.5.0 of the confluence-markdown-exporter product and has been fixed in version 5.5.0.
Oauthlib's RevocationEndpoint has a vulnerability when JSONP support is enabled via enable_jsonp=True. The endpoint reflects the user-supplied callback parameter directly into JavaScript responses without validating it as a safe JSONP callback name. This allows an attacker who can influence the callback parameter to inject arbitrary JavaScript code into the response, which executes in the context of the client application's origin. This affects deployments that explicitly enable JSONP support for token revocation, commonly used for older browsers or cross-origin JavaScript clients.
CVE-2026-62126 is a high-severity vulnerability in miniOrange SAML SP Single Sign On versions prior to 6.2.0. It involves allocation of resources without limits or throttling, which can be exploited to cause an HTTP denial of service (DoS). The vulnerability does not impact confidentiality or integrity but affects availability. A fix is available in version 6.2.0.
