In October 2026, the financially motivated threat actor Storm-3358 began targeting financial organizations primarily in Southeast Asia and globally using the agentic AI offensive framework ARTEX. ARTEX automates scanning, exploitation of vulnerabilities such as anonymous file upload and SSRF, and deployment of open-source remote access trojans (RATs) for persistence and lateral movement. The framework also performs credential compromise, brute-force attacks, API abuse, and data exfiltration at machine speed. Microsoft recommends detection through behavioral signals, network traffic characteristics, and deploying defensive honeypots, decoys, tarpits, and fake wins to mitigate attacks. Microsoft security products integrate detections and investigative context to help defend against these AI-accelerated attacks.
CVE-2026-119083 is a vulnerability in the GluonTS Python library before version 0.17.0. It involves the archive extraction utility, where a crafted tar archive containing symbolic or hard links can lead to arbitrary file writes outside the intended extraction directory. This could allow an attacker to write files with the privileges of the process performing the extraction.
Critical9.2KEVEPSS 82%Check Point ResearchCVE-2026-111497
This report summarizes multiple significant cyber threats and incidents disclosed in early November 2026. Major breaches include a $6.3 billion cryptocurrency theft from Binance via compromised internal infrastructure, a malicious JavaScript attack on Polymarket's platform, and data breaches affecting Japan Airlines and the Florida Department of Education. The report also highlights the use of AI by threat actors such as the GOLD OGRE ransomware group and North Korean cyber operators to enhance attack capabilities. Several critical vulnerabilities are noted, including CVE-2026-111497 (HTTP2Shell) affecting Brotli decompression, a critical Linux kernel TCP networking flaw (CVE-2026-98432), and a Drupal Commerce Core access control vulnerability (CVE-2026-118539). Cisco patched a high-severity SSL VPN crash vulnerability (CVE-2026-76418) that was exploited in the wild. Additional threat intelligence includes malware campaigns and advanced persistent threat activity targeting various sectors globally.
Microsoft Threat Intelligence analyzed two human-operated intrusion cases where attackers used Microsoft Teams to impersonate IT support and socially engineer users into granting remote access via Quick Assist. The attackers then staged portable runtimes, performed host and network discovery, and abused Active Directory Certificate Services (AD CS) to obtain authentication certificates for privileged accounts. Two distinct AD CS abuse techniques were observed: ESC1 template abuse allowing certificate issuance for privileged accounts, and ESC8 NTLM relay to AD CS Web Enrollment to obtain domain-controller certificates. These certificate-based authentications enabled persistent privileged access independent of passwords. The incidents highlight risks from social engineering combined with insecure or overly permissive AD CS configurations rather than software vulnerabilities. Microsoft Defender detections and containment effectiveness varied between cases, influencing the extent of attacker progression.
CVE-2026-118029 affects the AWS SDK for pandas (awswrangler) Athena module. The vulnerability involves unverified ownership of the default Athena query result location, which could allow a remote user to read query results and tamper with them if a pre-created S3 bucket is used. Versions of awswrangler prior to 3.16.1 are impacted. AWS has published a security bulletin advising attention to this issue.
CVE-2026-111497, dubbed Node2Shell, is a critical out-of-bounds write vulnerability in Google’s Brotli decoder affecting versions 1.0.3 through 1.2.0. It impacts multiple platforms including Node.js, .NET, PowerShell, and Python packages, allowing unauthenticated attackers to cause memory corruption that can lead to process crashes, memory leaks, or arbitrary code execution. The flaw has been patched in Brotli versions 1.0.10, 1.1.1, and 1.2.1, with corresponding updates released by Microsoft, Node.js, and Python package maintainers. No exploitation in the wild has been reported, but proof-of-concept code demonstrates code execution on certain Linux arm64 Node.js builds. The vulnerability arises when attacker-controlled compressed data is processed by the affected Brotli decoder.
The LiteLLM 1.107.0 Python package was compromised and published to PyPI, distributing malicious code that executed automatically during Python interpreter startup. The payload collected a wide range of credentials including developer, cloud, browser, SSH, and environment variables, then encrypted and exfiltrated this data to attacker-controlled endpoints. The compromise originated from stolen developer GitHub credentials used to alter the release workflow. The malicious code executed without requiring explicit import of LiteLLM, affecting any environment where Python was started with the compromised package installed. Recovery requires more than removing the package; affected Python environments, running processes, and exposed credentials must be addressed. Microsoft Defender provides detection and hunting guidance. No patch or fixed version is explicitly stated.
CVE-2026-115419 is a vulnerability in the Strands Agents SDK's Agent2Agent (A2A) server component that causes unintended disclosure of conversation state between different authenticated users. This flaw allows an authenticated remote user to access another caller's conversation history or influence model behavior for other callers in multi-tenant deployments. The issue affects all Python versions containing the multiagent.a2a module prior to 1.43.0 and TypeScript SDK versions prior to 1.5.0. The vulnerability requires attention as it compromises data isolation in multi-tenant environments.
On October 21, 2026, the LiteLLM Python proxy library version 1.107.0 was compromised in a supply chain attack. The malicious release was available on PyPI and official Docker images for approximately two hours. Attackers used stolen GitHub CLI OAuth tokens from three engineers to deploy a malicious fork via a private release workflow. The payload included a credential stealer targeting cloud, developer, AI-tool, browser, and LiteLLM proxy credentials, as well as a second-stage remote access trojan backdoor. The malware executes automatically whenever Python starts by placing files in the site-packages directory. This is the second known supply chain compromise of LiteLLM in 2026, unrelated to the previous incident linked to TeamPCP activity.
Bulletin ID: 2026-058-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/16/2026 10:15 AM PDT Description: Bedrock AgentCore Python SDK (bedrock-agentcore) is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. We identified CVE-2026-15737 in the OpenTelemetry instrumentation of the SDK. Affected versions wrote raw user prompts and complete agent responses into OpenTelemetry span attributes on every invocation without filtering or masking. These spans flow into the customer's aws/spans CloudWatch log group, where a local authenticated user with CloudWatch Logs read access could access the potentially sensitive content. Impacted versions: 1.4.8, 1.5.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
CVE-2026-110248 is a vulnerability in the Amazon SageMaker Python SDK where sensitive information, specifically plaintext repository credentials, can be inserted into log files. This occurs in the git_utils.py component before versions 3.10.0 for V3 and 2.257.3 for V2. The issue arises because the runclone_command() function does not redact credentials from subprocess error output, potentially exposing them in CloudWatch Logs when a git clone operation fails. Users should upgrade to versions 3.10.0 or later for V3 and 2.257.3 or later for V2 to remediate this issue.
SAP released security updates in October 2026 addressing 20 vulnerabilities, including a maximum-severity OAuth2 SSRF vulnerability in the Cloud SDK for Python. The flaw involves server-side request forgery related to OAuth2 implementations. No specific affected versions or detailed technical information are provided. No known exploits in the wild have been reported. SAP is not a cloud service in this context, so remediation depends on applying vendor updates.
CVE-2026-107608 is a vulnerability in aws-cdk-lib where the asset bundling process using Docker files could improperly include symlinked files or directories in the output without those symlinks being part of the input. This affects all versions prior to 2.267.0. The issue arises when bundling assets with Docker files, potentially causing unexpected files to be included in the deployment package.
CVE-2026-104002 is a vulnerability in the data masking utility of Powertools for AWS Lambda (Python) that causes fail-open error handling. This flaw can allow unauthorized actors to access sensitive field values that should have been masked. The issue affects versions from 3.6.0 through 3.34.0 inclusive. AWS has issued a security bulletin to raise awareness of this vulnerability.
Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value.
To remediate this issue, users should upgrade to version 0.15.0 or later.
Authlib versions up to and including 1.7.2 contain a signature-verification bypass vulnerability in their JSON Web Signature (JWS) handling. The vulnerability allows attackers to supply JWS objects with an empty "signatures" array, which Authlib mistakenly treats as verified without performing signature checks. This enables attackers to forge arbitrary authenticated payloads without possessing any signing keys, potentially leading to authentication bypass, privilege escalation, and message integrity compromise. No official patch is currently available, and users should monitor the project's GitHub repository for updates.
CAIRN is a research toolkit developed by Cisco Talos for hunting, classifying, and tracking AI-integrated malware by analyzing metadata artifacts left by attackers. It identifies malware that operationalizes or exploits AI systems by extracting cognitive artifacts such as prompt templates, API endpoints, and evasion strings without requiring binary execution. CAIRN uses acquisition filters, relationship graphing, YARA rules, and semantic discovery to detect and attribute AI-enabled malware families. This metadata-first approach enables scalable and fast detection of emerging threats that integrate AI functionality.
CVE-2026-0768 is a critical remote code execution vulnerability in the AI low-code platform Langflow. It allows unauthenticated attackers to execute arbitrary Python code as root via improper validation in the custom component editor's code validator. The flaw affects all Langflow versions up to 1.4.2. Exploitation has been observed in the wild, primarily for reconnaissance and credential harvesting, with notable attack activity originating from Russia. The vulnerability was reported in July 2025 and publicly disclosed as a zero-day in January 2026.
The TerminalFix campaign is a sophisticated multi-stage intrusion targeting organizations via compromised websites that display fake Cloudflare CAPTCHA overlays. Victims are tricked into executing malicious PowerShell commands that download and execute a signed legitimate binary alongside a malicious DLL for sideloading. This leads to steganographic payload extraction, extensive Active Directory reconnaissance, and deployment of a Python-based reverse-tunnel implant providing persistent network-level proxy access. The campaign enables attackers to pivot within the network, conduct domain enumeration, and maintain stealthy persistent access. Although no direct downstream actions were observed, the access gained could facilitate privilege escalation, data exfiltration, and ransomware deployment. The campaign combines advanced evasion techniques and persistent network access, posing a serious threat to enterprise environments.