Two vulnerabilities were found in the open-source tool projen affecting versions before 0.101.37 and 0.103.0. CVE-2026-89065 is a relative path traversal vulnerability that may allow deletion of files outside the project directory. CVE-2026-89066 is an OS command injection vulnerability that could enable arbitrary command execution on developer workstations or CI runners. Fixes are available in versions 0.101.37 and 0.103.0 respectively. Users should upgrade and re-synthesize projects for CVE-2026-89066 to ensure safe task definitions.
CVE-2026-89049 is a server-side request forgery (SSRF) vulnerability in the AWS Systems Manager Agent's Session Manager port forwarding feature. An authenticated user with port-forwarding permission can bypass the remote destination denylist due to improper validation of equivalent address representations. This allows the user to reach link-local endpoints and potentially obtain the managed instance's temporary IAM role credentials, enabling actions with those permissions from outside the instance. The vulnerability affects all versions prior to 3.3.4851.0. AWS has released version 3.3.4851.0 to fix this issue. Until upgrading, it is recommended to restrict the use of the AWS-StartPortForwardingSessionToRemoteHost document by scoping IAM permissions.
CVE-2026-87912 and CVE-2026-87913 refer to missing S3 bucket ownership verification vulnerabilities in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server. The vulnerabilities relate to improper validation of S3 bucket ownership, which could potentially lead to security issues. No specific affected versions or detailed technical information are provided. No known exploits are reported in the wild. No patch or remediation information is available at this time.
CVE-2026-85787 is a vulnerability in the SQL validation component of Amazon awslabs postgres-mcp-server versions prior to 1.1.7. It allows an unauthenticated actor to modify data beyond the intended read-only scope by injecting crafted SQL through content submitted by an authenticated user. The issue is fixed in version 1.1.7. Mitigation includes upgrading to version 1.1.7 or later and running the MCP server with a minimal-privilege Postgres role to enforce database-level access controls.
CVE-2026-111943 is a key-generation flaw in the external certificate authority eMudhra/emSign that made intermediate CA private keys recoverable. Three root certificates—AAA Certificate Services, emSign Root TLS CA - G3, and emSign ECC Root CA - G3—were included in AWS trust bundles. This exposure allows soft-fail TLS clients to be vulnerable to man-in-the-middle attacks. AWS is actively removing these affected roots from their trust bundles. Customers using CloudFront custom origins or Application Load Balancer OIDC/JWT authentication should verify if their certificates chain to any of the affected roots and reissue certificates from a different CA before enforcement occurs.
The LiteLLM 1.107.0 Python package was compromised and published to PyPI, distributing malicious code that executed automatically during Python interpreter startup. The payload collected a wide range of credentials including developer, cloud, browser, SSH, and environment variables, then encrypted and exfiltrated this data to attacker-controlled endpoints. The compromise originated from stolen developer GitHub credentials used to alter the release workflow. The malicious code executed without requiring explicit import of LiteLLM, affecting any environment where Python was started with the compromised package installed. Recovery requires more than removing the package; affected Python environments, running processes, and exposed credentials must be addressed. Microsoft Defender provides detection and hunting guidance. No patch or fixed version is explicitly stated.
Aokigahara is a newly observed infostealer malware that targets a wide range of sensitive data on Windows systems. It steals traditional credentials such as browser passwords, cookies, cryptocurrency wallets, VPN and FTP client data, email profiles, and password manager files. Uniquely, it also targets AI applications and developer tools including Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, collecting authentication files, session tokens, and configuration data. The malware additionally targets cloud environment credentials for AWS, Azure, and Google Cloud, as well as developer environment secrets like Git credentials and SSH private keys. Stolen AI and cloud credentials could enable unauthorized access to paid AI services, cloud resources, and source code repositories. The malware includes capabilities such as screenshot capture, clipboard theft, and a clipper component for cryptocurrency manipulation. There is no confirmed information on how the stolen data is monetized. No patch or remediation guidance is provided.
Railway, a cloud platform hosting developer applications and services, detected suspicious activity on its environment variable storage systems, potentially exposing decrypted secrets such as API keys and credentials. The company warns users to immediately rotate all stored secrets and credentials due to possible unauthorized access. The incident is linked to a series of attacks targeting AI inference providers. Railway has paused deployments during the ongoing investigation and will notify affected users directly.
CVE-2026-115417 is a vulnerability in the aws-c-mqtt library's MQTT 3.1.1 compatibility adapter that involves memory allocation with an excessive size value. This flaw could allow a remote actor to cause a denial of service (DoS) of the client process. The affected versions are aws-c-mqtt versions from 0.9.1 up to but not including 0.16.2. The vulnerability was disclosed by AWS in an important security bulletin requiring attention. No information about available patches or exploits in the wild is provided.
CVE-2026-115419 is a vulnerability in the Strands Agents SDK's Agent2Agent (A2A) server component that causes unintended disclosure of conversation state between different authenticated users. This flaw allows an authenticated remote user to access another caller's conversation history or influence model behavior for other callers in multi-tenant deployments. The issue affects all Python versions containing the multiagent.a2a module prior to 1.43.0 and TypeScript SDK versions prior to 1.5.0. The vulnerability requires attention as it compromises data isolation in multi-tenant environments.
Shadow AI refers to the unauthorized and ungoverned use of AI tools and models within enterprise environments, spanning from simple chatbots to complex autonomous agents and local AI models. This phenomenon has grown significantly, creating blind spots in security and increasing risks such as data loss, operational disruption, and regulatory fines. Shadow AI incidents have more than doubled recently, with associated breach costs exceeding the global average. Enterprises face challenges detecting and controlling shadow AI due to its diverse forms and rapid adoption outpacing governance. Mitigation involves employee training, establishing AI usage policies, and integrating shadow AI management into exposure management programs.
The Onamae Desktop Cloud, a VPS service provider in Japan, suffered a security breach where attackers compromised its infrastructure and installed malware on up to 26,739 customer servers. This incident impacts a significant number of virtual private servers hosted by the provider. No specific technical details or remediation status are provided in the available information.
Storm-0940, a China-state aligned threat actor, has used the AI-driven ARTEX penetration testing framework since September 2026 to automate large-scale attacks targeting hundreds of organizations globally across multiple industries. These attacks have enabled the actor to gain privileged access to cloud infrastructures rapidly, sometimes within three hours of initial targeting. The actor leveraged ARTEX to accelerate scanning, reconnaissance, password spraying, and OAuth application abuse, notably in the ConnectWise supply chain compromise. The activity involved abuse of Microsoft 365 OAuth applications to access customer environments without interactive user sign-in, followed by reconnaissance and privilege escalation attempts via Microsoft Graph. Microsoft confirmed that these attacks did not stem from vulnerabilities in Microsoft corporate systems or products. Microsoft Defender XDR provides detections and hunting queries to identify suspicious activity related to this threat. Customers are advised to review service principal sign-ins and investigate unexpected credential or privilege changes while following published containment guidance.
Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities. watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging. The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version numbers reported before the release point to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches are not expected to receive fixes. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two critical vulnerabilities in PHP that were announced on October 20, 2026. FAQ When were these PHP vulnerabilities first disclosed? On October 20, 2026, the CVE identifiers circulated on Hacker News and social media. Later that day, the PHP security team published an advance notice of a security release scheduled for October 21 at 14:00 UTC (10:00 AM ET) to address two critical vulnerabilities. The notice said the team could release earlier if details became public or if exploitation appeared in the wild. CERT-EU also published an advisory (2026-018) naming both CVEs. According to watchTowr , the vulnerabilities were originally set to be disclosed on Thursday, October 22, under embargo. A video shared by researcher Kirill Firsov demonstrates the exploit chain, dubbed php2shell. Firsov credited the video and exploit to researcher LCFR and Calif.io. The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence. — The PHP Foundation (@ThePHPF) October 20, 2026 What are CVE-2026-109618 and CVE-2026-109619? CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. Public reporting describes both as remote code execution vulnerabilities. The PHP security team has not published technical details before the patch release. CVSS scores differ across sources. The PHP security team rates both vulnerabilities as CVSSv4.0 9.2. Some early reports, including watchTowr and a Hacker News post, describe them as CVSS 10.0. We will update this blog once PHP publishes its advisory. Which PHP versions are affected? CERT-EU says these vulnerabilities could affect all PHP versions from PHP 5 onwards, and the demonstration video references PHP 5.4.0 and later. PHP will publish the official list of affected and fixed versions with the release. Before the release, security researcher Kevin Beaumont reported the following fixed versions: Affected Versions Fixed Version (expected) PHP 8.5.x 8.5.12 PHP 8.4.x 8.4.27 PHP 8.3.x 8.3.36 PHP 8.2.x 8.2.35 PHP 5.x through 8.1.x End-of-life, no fix expected Linux distributions that ship older PHP packages may backport fixes, so organizations using distribution packages should check their vendor's advisories. How widespread is PHP, and how many hosts are potentially affected? According to W3Techs , PHP is used by 69.3% of websites whose server-side language is known. Platforms such as WordPress, Drupal, Joomla, Laravel and Magento all run on PHP. Security researcher Silas Cutler's rough estimate is that over 1.3 million internet-exposed hosts are potentially vulnerable. A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP. Has exploitation been observed in the wild? On October 21, Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging" and is updating its miti…
OVHcloud's open-source CLI tool was compromised on GitHub, with attacker-modified versions 0.11.0 through 0.15.0 containing malware designed to steal developer secrets. The compromise occurred via a hijacked developer GitHub account, allowing malicious releases to be published without CI/CD pipeline interference. The incident was detected and blocked within hours, and OVHcloud has enabled GitHub's release immutability feature to prevent recurrence. Users who downloaded affected versions are urged to revoke all secrets and perform system cleanup. The attack is linked to the GlassWorm threat actor group, known for targeting software development ecosystems. Source builds and Docker images were unaffected.
CVE-2025-4318 is a code injection vulnerability in the Amazon @aws-amplify/codegen-ui-react package. The fix for this vulnerability was incomplete, indicating that the issue may still pose a risk. No specific affected versions or detailed technical information are provided.
Bulletin ID: 2026-058-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/16/2026 10:15 AM PDT Description: Bedrock AgentCore Python SDK (bedrock-agentcore) is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. We identified CVE-2026-15737 in the OpenTelemetry instrumentation of the SDK. Affected versions wrote raw user prompts and complete agent responses into OpenTelemetry span attributes on every invocation without filtering or masking. These spans flow into the customer's aws/spans CloudWatch log group, where a local authenticated user with CloudWatch Logs read access could access the potentially sensitive content. Impacted versions: 1.4.8, 1.5.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Bulletin ID: 2026-054-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/14/2026 13:00 PM PDT Description: AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with AWS HealthLake FHIR datastores. We identified CVE-2026-15643, a server-side request forgery in the pagination handling component in AWS awslabs.healthlake-mcp-server before 0.0.14 on all platforms might allow a remote authenticated user to exfiltrate AWS temporary security credentials to an arbitrary endpoint via a crafted next_token parameter. The server does not validate that pagination URLs point back to the expected HealthLake endpoint, allowing an actor to redirect subsequent requests to an actor-controlled server. Impacted versions: < 0.0.14 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Bulletin ID: 2026-052-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/06/2026 13:45 PM PDT Description: Amazon mcp-gateway-registry is an open-source gateway and registry for Model Context Protocol (MCP) servers, providing centralized discovery, authentication/authorization, and proxying of MCP tools for AI agents. We identified CVE-2026-14471, an issue in the metrics-service retention policy management component where a caller-supplied table_name value is interpolated into SQL statements in identifier position without proper neutralization. An authenticated remote user is able to supply a crafted table_name value to execute arbitrary SQL queries against the metrics database. This allows the user to read stored data (including API key material) and to delete or alter stored data. Impacted versions: >=1.0.3 AND <=1.0.12 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.