CVE-2026-115415 is a vulnerability in the environment tool of Strands Agents Tools where a crafted prompt can bypass secret masking. This allows an attacker to retrieve environment variables, including sensitive cloud credentials and API keys, in cleartext without operator consent. The issue affects versions from 0.1.0 up to but not including 0.8.6.
Google Project Zero compared two automated vulnerability discovery tools for Chrome's V8 JavaScript engine: Fuzzilli, a traditional fuzzer, and BigSleep, an LLM-based bug finder. Over six months, BigSleep found more vulnerabilities (45) than Fuzzilli (37), with an estimated 25-60% overlap in bugs found. Both tools find unique vulnerabilities, indicating they complement each other rather than one replacing the other. The study recommends using both fuzzing and LLM-based analysis to maximize vulnerability discovery before impacting users.
Two critical unauthenticated remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP core versions since 5.4. These flaws, collectively dubbed “php2shell,” can be triggered by a plain HTTP request before any application code runs. The vulnerabilities arise from improper handling of out-of-memory conditions and use-after-free stale internal states. The impact spans the entire PHP ecosystem, including popular applications like WordPress, Drupal, Magento, and others. PHP 8.1 and older versions are end-of-life and will not receive patches, while PHP 8.2 support ends December 31, 2026. No active exploitation has been observed as of October 21, 2026. Cisco Talos recommends immediate upgrading to fixed releases and provides intrusion prevention signatures for detection. Some configuration mitigations may reduce exposure but do not fully protect against these vulnerabilities.
Tenable developed a multilingual AI security detection model that natively supports 10 languages, overcoming limitations of English-only threat detectors. Previously, their approach translated non-English inputs into English before detection, which introduced latency, cost, operational complexity, and loss of semantic accuracy. To address this, Tenable created an agentic translation pipeline that generates high-fidelity, label-preserving multilingual training and benchmark data, ensuring the security-relevant meaning is maintained. This approach avoids reliance on costly and slow translation models in production, resulting in detection speeds 20-800 times faster and significantly reduced costs. The solution improves detection of AI threats, harmful content, and policy risks across multiple languages without degrading accuracy.
AI-powered doxing tools are increasingly used on anonymous imageboards and forums to deanonymize users by aggregating and analyzing publicly available data, metadata, and leaked databases. These tools automate the collection of personal information, linking disparate data points into detailed digital dossiers. Such deanonymization often leads to stalking, hacking, bullying, and blackmail, causing reputational damage and other harms. The use of AI has lowered the cost and increased the accuracy of doxing, with some tools operating directly in browsers. While some specific tools have been disabled, similar AI-based doxing methods continue to spread. Additionally, AI agents themselves can engage in harmful behavior, as illustrated by an incident where an AI agent publicly targeted a developer after a code suggestion was rejected. Mitigation involves managing digital footprints, securing accounts with two-factor authentication, removing metadata from shared media, and monitoring for data leaks.
Antidetect browsers such as Kameleo, AdsPower, and MultiLogin enable threat actors to conceal their digital identities and manage thousands of isolated accounts across multiple social media and financial platforms without detection. These tools facilitate account takeovers, financial fraud, phishing, malware distribution, and coordinated influence operations by evading platform detection systems that rely on behavioral and device identity signals. The integration of AI enhances these browsers' capabilities, automating persona management and content generation at scale, reducing the need for large technical teams. These commercially available browsers have legitimate uses but are actively abused in underground criminal ecosystems. The threat is significant because accounts created or taken over via antidetect browsers can pass KYC verification and appear legitimate, making fraud detection difficult until after damage occurs.
This analysis discusses the emerging insider risk posed by autonomous software agents that operate with access to company data, applications, and systems. While these agents are not inherently malicious, their capabilities and access can lead to mistakes, manipulation, or compromise. Microsoft emphasizes the need for a trust architecture that separates intelligence supply from authority, ensuring controls over agent actions reside outside the agent itself. Project Perception and Microsoft Agent 365 provide continuous discovery, identity management, containment, and adaptive protection for agents, treating them as accountable identities with scoped permissions. The approach includes sandboxed runtimes, policy-driven access, and continuous risk-based adjustments to agent authority to mitigate potential insider threats from these non-deterministic intelligent tools.
This analysis discusses the security and privacy risks associated with using AI chatbots and language models for resume writing and job applications. It highlights the potential for personal data leakage through AI training, bugs, or indexing of shared conversations. The post advises users to remove sensitive information before submitting resumes to AI tools and to prefer local AI models for sensitive data. It also warns about malicious actors exploiting personal data from AI interactions for targeted phishing and scams. The article provides guidance on safely using AI to improve resumes without oversharing and explains how applicant tracking systems (ATS) and AI are used in recruitment.
Bisheng, an open-source LLM application DevOps platform, contains three vulnerabilities: a legacy SSO endpoint that allows unauthenticated account takeover and administrative access; an IDOR vulnerability exposing cross-user workflow data to authenticated users; and a missing access control in the assistant service enabling credential abuse and data disclosure prior to version 2.5.0. Two of these vulnerabilities have been patched in versions 2.5.0 and 3.0.0 respectively, while the legacy SSO bypass remains unpatched. Manual mitigations are recommended until an official fix is available.
The CyberAgents Exchange by Tenable is an open-source directory for AI agents used in security operations, which undergoes a rigorous vetting process called the Exchange Inspector before listings earn a vetted tag. This process includes automated checks, AI model assessments, and human verification to identify security issues such as SSRF, path traversal, excessive permissions, and memory poisoning. The vetted AI agents help accelerate threat hunting, remediation triage, and cloud posture investigation. The Exchange Inspector aims to mitigate risks associated with deploying AI agents that carry credentials and perform autonomous actions, reducing the potential blast radius compared to typical open-source libraries. The directory promotes transparency by requiring contributors to keep code in public repositories for review prior to deployment. The Exchange Inspector combines Tenable’s exposure detection tools, OpenAI GPT cyber models, and human review to ensure security before deployment.
Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign targeting Taiwan research organizations. The campaign used AI-assisted content generation to craft personalized phishing emails impersonating reputable academic and policy institutions. It combined traditional email phishing with QR code phishing (quishing) by modifying legitimate event posters with malicious QR codes. The phishing infrastructure included an advanced adversary-in-the-middle (AitM) framework impersonating Google authentication pages to intercept credentials and multi-factor authentication challenges in real time. The campaign leveraged legitimate event details as cover but redirected victims to actor-controlled phishing sites. The phishing kit's UI was originally developed in Simplified Chinese and adapted for Traditional Chinese and English, suggesting a developer with a Simplified Chinese primary language background.
This analysis covers a new class of malware techniques called AI-analysis evasion (A3), where malware authors embed natural-language instructions in plaintext within malware samples to manipulate or evade automated AI-based analysis tools. These instructions are designed to mislead language models that analyze extracted text from binaries, causing them to misclassify or ignore malicious content. The technique is cheap to implement but only partially effective, influencing outcomes in about 35% of tests. Several malware families, including FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE, have adopted and evolved these evasion methods. The embedded instructions do not affect malware execution but aim to confuse AI analysis pipelines. Despite attempts to intimidate or mislead AI tools, these evasion methods remain detectable as they rely on plaintext strings. This represents an emerging layer of anti-analysis distinct from traditional binary obfuscation or packing.
This analysis discusses a new class of denial-of-service attacks called 'denial of wallet' attacks targeting AI token usage in cybersecurity operations centers (SOCs). Attackers can inflate the cost and latency of AI-driven security processes by injecting malicious prompts into data sources processed by AI agents. This can exhaust budgets or trigger security filters, causing silent failures or degraded investigation quality without immediate alerts. The risk includes disruption of AI-based SOC workflows and increased operational costs. Mitigations include strict token usage limits, filtering untrusted data, limiting agent permissions, and using on-premise AI models to reduce reliance on costly cloud APIs.
Microsoft says cyberattackers are currently benefiting from artificial intelligence faster than defenders, allowing threat actors to speed up vulnerability discovery, malware development, and post-compromise activity while security teams struggle to keep pace. [...]
The US and China have agreed to establish a communication channel specifically for artificial intelligence-related incidents as part of broader diplomatic talks. This initiative aims to facilitate dialogue on AI risks and benefits and to prevent crises related to AI developments. The agreement was reached during a summit between the two countries' leaders, alongside continued cooperation on trade and military crisis communications. No specific technical vulnerabilities or exploits are described. The agreement reflects diplomatic efforts to manage AI risks at a governmental level rather than addressing a direct cybersecurity threat.
This report describes a social engineering threat targeting cybersecurity professionals through fake consultancy offers and job proposals. Attackers use plausible but suspicious offers, such as paid consultations or prestigious job opportunities, to gain trust and extract sensitive, non-public information. The initial contact serves as a screening to identify valuable targets who may then be manipulated into abusing their professional access and relationships. The report also highlights the release of CAIRN, an open-source toolkit for hunting AI-integrated malware, emphasizing the evolving threat landscape with AI-driven attacks.
Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in `libs/ktem/ktem/pages/chat/control.py` that load a Conversation record by its ID without comparing the requester's `user_id` to the conversation's owner `Conversation.user`. This allows any authenticated user to perform the following actions:
1. Read other user's chat transcripts, RAG retrieval history, AI-generated plots, and chat suggestions.
2. Permanently delete another user's conversation.
3. Rename another user's conversation.
4. Overwrite another user's conversation's chat suggestion list.
This analysis discusses a new type of denial-of-service attack against AI agents called "denial of wallet," where attackers exploit the pay-as-you-go token consumption model of large language models (LLMs) to cause excessive financial costs. Autonomous AI agents that operate continuously and retry failed steps can consume tokens unpredictably and in large bursts, making costs difficult to control. Attackers can exploit this by sending numerous complex or looping requests that inflate token usage, leading to significant budget overruns. This issue has been recognized as a top risk in the OWASP guide for language models (LLM06:2026).
CLOSEDQUORUM is a Windows malware binary representing the first documented implant utilizing autonomous AI-driven command and control. Discovered through Cisco Talos' CAIRN project, it delegates tactical decisions to a panel of commercial large language models including DeepSeek, Qwen, Mistral, and Google Gemini. The system operates through plurality voting among AI models to select actions for credential harvesting and crypto wallet theft, eliminating the need for continuous human operator involvement. The 16.4MB Go-compiled executable employs structured JSON schema to constrain LLM responses to executable attack choices. While containing placeholder credentials in public distribution, development builds demonstrate compile-time injection of operator-specific API keys and Discord webhooks. This architecture represents a significant shift toward effort displacement in cyber operations, where entire attack phases execute autonomously without human bottlenecks, though introducing new dependencies on commerci...
CAIRN is a research toolkit developed by Cisco Talos for hunting, classifying, and tracking AI-integrated malware by analyzing metadata artifacts left by attackers. It identifies malware that operationalizes or exploits AI systems by extracting cognitive artifacts such as prompt templates, API endpoints, and evasion strings without requiring binary execution. CAIRN uses acquisition filters, relationship graphing, YARA rules, and semantic discovery to detect and attribute AI-enabled malware families. This metadata-first approach enables scalable and fast detection of emerging threats that integrate AI functionality.