Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts

Hackers exploited a vulnerability in Meta's AI support assistant bot used for Instagram account recovery to hijack high-profile accounts, including those of the Obama White House and the U.S. Space Force Chief Master Sergeant. The attackers tricked the AI bot into linking a new email address to targeted accounts, enabling password resets and account takeovers. The exploit relied on using a VPN with an IP address near the victim's usual location and succeeded only on accounts without multi-factor authentication (MFA). Meta responded by deploying an emergency patch and securing impacted accounts.

• krebsonsecurity.com/2026/06/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts/ (opens in a new tab)

• php2shell one week later: Why one exploit doesn’t work everywhereHighVulnerability2026-10-30
• ZDI-26-839: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracingTool2026-10-28