AI Safety Guidelines: 10 Essential Rules to Protect Data, Finances, and Reputation When Working with LLMs
A detailed analysis of emerging AI-related security risks highlights how large language models can autonomously execute attack chains, fall victim to prompt injection, and cause cascading errors in complex workflows. The article examines real-world incidents such as the Anthropic vending machine pricing failure, the Meta Instagram account takeover via overly helpful AI support, and Copilot Studio data leaks through prompt injection. It emphasizes that while attack methods themselves are not revolutionary, AI agents can now scale them at machine speed with autonomous decision-making and recovery capabilities. The piece provides ten concrete safety rules covering financial controls, fact verification, data confidentiality, context pollution prevention, and access limitation. It also stresses that ultimate responsibility always remains with the human operator, not the AI system.
Translated from Russian
Read full articleLatest News
Russian Li Auto Owners Face Master Account Theft and Extortion Up to 45,000 Rubles
Russian owners of Li Auto vehicles are experiencing a wave of master account compromises that allow attackers to seize control through the official mobile app. After losing access, some vehicles lose screen functionality, climate control, and in certain cases the ability to start. Attackers then contact victims demanding 35,000 to 45,000 rubles for account return. Approximately 20 confirmed cases have been reported, though the real number may be higher. The exact infection vector remains unknown, and even owners who previously used the paid eSender service to retain Chinese phone numbers are now affected. Li Auto and official distributor Sinomach Auto are developing recovery procedures and plan to migrate account binding from Chinese numbers to email addresses.
Translated from Russian
Docker Bypasses UFW Firewall Exposing PostgreSQL and Redis Ports to Rapid Malware Infections
A common Docker Compose setup with exposed database ports on fresh VPS instances allows attackers to compromise systems within minutes despite active UFW rules. Docker's use of DNAT rules in the PREROUTING chain and insertion of DOCKER-FORWARD chains before UFW rules in the FORWARD table routes external traffic directly to containers on internal bridge networks. IPv6 support in Docker versions 27 and later creates additional exposure vectors when administrators focus only on IPv4 protections or disable IPv6 filtering. Bots scan cloud IP ranges for open ports including 5432 and 6379, deploying miners such as kdevtmpfsi and kinsing or using Redis replication to load malicious modules. Historical cases include a Qdrant test instance on Hetzner compromised in under two minutes and similar issues reported in Spree Commerce starter templates. The article details Netfilter mechanics, protected-mode limitations in Redis, and specific exploitation techniques like CONFIG SET for cron jobs and CVE-2022-0543 Lua sandbox escapes.
Translated from Russian
Google to Back Unified robots.txt Standard for Blocking AI Training Data Use
Google has announced plans to support a common mechanism in robots.txt that allows website owners to opt out of having their content used for training generative AI models. The feature will be based on work by the AIPREF working group at IETF and is scheduled for rollout in 2027. Instead of issuing separate instructions to each AI provider, publishers will be able to set a single policy marker that participating companies are expected to respect. Google intends to treat an unspecified general marker the same way it currently handles its own Google-Extended directive. Existing per-company rules will continue to function, letting site owners combine a broad default with specific exceptions. The approach simplifies management as the number of AI crawlers grows, though compliance will remain voluntary and dependent on which organizations adopt the standard.
Translated from Russian
New Container, Old Code: Web Shell Persists Three Months in 1C-Bitrix Environment
Two 1C-Bitrix sites shared a web shell named WebShellOrb after an attacker exploited multiple vulnerabilities in a custom appeal application. The initial compromise went undetected because Nginx logs were retained for only one month, leading responders to conclude that no scanning activity remained visible. After agents showed no malicious code, administrators restarted the container without addressing the underlying issues in the shared filesystem and source code. The attacker regained access weeks later by reusing JWT tokens generated with a hardcoded secret and by exploiting SQL injection flaws that allowed password hash extraction. Shared system user accounts and a common filesystem volume enabled the shell to propagate between sites and survive container recreation. The incident highlighted that redeploying containers and rotating passwords failed to eliminate persistence rooted in unpatched code and misconfigured authentication logic.
Translated from Russian
Who Pays When AI Agents Err: Insurance for AI Risks in Russia and the West
A typical 2026 scenario involves an AI agent connected to a CRM system that mistakenly deletes half of a company's customer database by misclassifying contacts as duplicates. The incident occurs without any cyber attack or malicious intent from developers, raising questions about liability among model developers, integrators, and the deploying company. Russian law places responsibility on humans or organizations under the National AI Strategy to 2030 and the AI Ethics Code, with harm assessed via general Civil Code provisions such as Article 1079 on sources of increased danger. Experimental legal regimes since January 2025 require mandatory insurance for AI-related harm in areas like autonomous vehicles and telemedicine, while Federal Law No. 243-FZ of July 2026 grants developers of sovereign AI models rights to insure liability and mandates technical documentation. A March 2026 draft law proposed detailed responsibility chains and exemptions but was significantly diluted in the final version. Internationally, no mandatory AI liability insurance exists in the US or EU, though specialized products from insurers like Armilla and Munich Re cover hallucinations, agent actions, and performance shortfalls, with real incidents already generating claims.
Translated from Russian
Russia's MinTsifry to Begin Issuing Official Code Signing Certificates in 2027
The Russian Ministry of Digital Development plans to start issuing state-backed code signing certificates for software developers in 2027, with corporate security certificates following in 2028. The initiative aims to help operating systems identify publishers and verify that code has not been altered after release. A draft government decree would grant MinTsifry the powers of a National Certification Authority, allowing it to set certificate requirements, issue and revoke certificates, define validity periods, and maintain a public registry. While the signature confirms origin and integrity, it does not guarantee the absence of vulnerabilities in the software. The law permits charging fees for certificates, but no decision on pricing has been made yet. Full recognition by operating systems, browsers, and app stores will be required, and foreign platforms are not obligated to trust the Russian certificates automatically.
Translated from Russian
Rostelecom Explores Underground Data Centers in Partnership With Norilsk Nickel for Stronger Physical Protection
Rostelecom is developing underground data centers as a third layer of protection against serious external threats. The first layer involves backup sites with data copies, while the second distributes computing power and services across geographically separated locations. The company is discussing the project with Norilsk Nickel, which could supply both underground facilities and its own power generation capacity. Experts from iKS-Consulting estimate that a buried data center would cost 30-40 percent more than a comparable surface facility due to requirements for waterproofing, ventilation, gas monitoring, specialized fire suppression, evacuation systems, and underground equipment transport. Sources indicate the plans were reported by Vedomosti citing a top Rostelecom executive and people familiar with the talks. No specific timelines, sites, or technical parameters have been disclosed yet.
Translated from Russian
How Vacation Photos Enable Family Impersonation Scams and Data Exposure
Public photographs from vacations and family events can reveal names, relationships, addresses, travel dates, and even security question answers without any hacking required. Attackers combine airport shots, hotel tags, school certificates, and relative comments to build convincing stories for emergency scams targeting grandparents or parents. The FTC has documented how scammers impersonate relatives using real details pulled directly from social media. NIST explicitly discourages security questions based on easily discoverable personal facts such as pet names or school names. Metadata like EXIF GPS coordinates and visible documents in the background further increase exposure risks. Practical steps include reviewing backgrounds, removing metadata, limiting audience settings, and establishing family code words that do not appear in public posts. The guidance covers iPhone, Android, Windows, and macOS methods for stripping location data before sharing images.
Translated from Russian
How EVRAZ Built Effective Information Security Processes Without Draconian Restrictions
EVRAZ maintains over 92 percent compliance with information security requirements through a small dedicated team despite managing thousands of developers and industrial infrastructure. The company gradually implemented security controls with long transition periods, starting with critical vulnerabilities and expanding to all projects after internal demand grew. External contractor agreements include mandatory adherence to EVRAZ security standards, while architecture reviews enforce DMZ usage and protective controls such as WAF for internet-facing services. A real-world case showed developers initially resisting WAF due to latency concerns but later requesting its reinstatement after observing increased bot activity during a temporary disablement. The department also handled a case where a non-IT employee used AI-assisted development to build an internal service that was quickly compromised during a pre-meeting assessment. EVRAZ now focuses on scaling existing review processes to cover AI-generated code and vibe coding across all users rather than imposing outright bans.
Translated from Russian
From Russian sources
Translated from Russian
Lazarus Group Behind Record $6.3 Billion Binance Hot Wallet Theft: Anatomy and Cassandra Index Impact
Binance reported on October 29, 2026, that attackers stole approximately $6.3 billion in digital assets from its hot wallets, surpassing the previous record of $1.5 billion taken from Bybit in February 2025. The FBI attributed the breach to the TraderTraitor group, widely identified as the North Korean Lazarus Group, which has a history of high-profile operations including the 2014 Sony Pictures attack. The stolen tokens are being converted to Ethereum and laundered through decentralized finance platforms and instant exchangers. Binance covered 90 percent of losses using its SAFU fund, futures insurance reserves, and corporate treasury totaling around $6.34 billion, though this represents replacement of assets rather than recovery from the attackers. Blockchain analysis by TRM Labs linked the operation to prior campaigns against Bybit and KelpDAO through timing patterns and preparatory withdrawals via Tornado Cash. The incident contributed 2.3 percentage points to the Cassandra Index rise to 72, with the largest regional impact observed in East Asia.
From Pharmacies to the Cloud: Ransomware and Wiper Attacks Disrupt Russian Businesses Throughout 2025-2026
Positive Technologies analysis of ransomware and wiper incidents shows that 98% of successful attacks disrupted core business operations, with a median downtime of seven days for internal and external services. Financially motivated groups and hacktivists each accounted for 44% of ransomware incidents, while hacktivists dominated wiper attacks at 88%. Small and medium businesses were targeted in 48% of financially motivated cases and 41% of hacktivist operations. Attackers most often gained initial access through social engineering (53%), followed by credential compromise (28%) and vulnerability exploitation (25%). Notable incidents include the destruction of virtualization servers at a commercial cloud provider and the shutdown of over 2,100 stores in the VinLab retail chain. Specific tools observed include LockBit 3.0, Pay2Key, and the consumerWiper malware delivered via MSI packages.
Personal AI Assistants Build Detailed Profiles on Friends and Family Raising Privacy Concerns
New generation AI agents such as Muse from Meta and Dots from OpenAI are gaining extensive access to user data including emails, messengers, and financial accounts. These agents operate with broad permissions to perform actions on behalf of users while automatically collecting personal information. Security researchers discovered that Muse creates detailed profiles on every person in a user's life including family members, partners, friends, and colleagues. The profiles include sections on facts, history, relationships, and strategies for strengthening connections using real evidence only. Data collection occurs through hourly background processes and nightly dream-like analysis that stores information in Markdown files and PostgreSQL databases. The architecture includes isolated VMs designed by Moxie Marlinspike to prevent swarm formation among agents but does not address third-party data exposure. This development expands existing social graphs maintained by major technology companies through previous generations of web services.
Why We Banned Our AI Manager from Writing Code and Assigned the Task to Claude Opus
The team behind an AI-powered marketplace manager for Wildberries initially built the system using regular updates, then migrated it to an autonomous agent. After implementing multiple layers of restrictions, they ultimately removed the agent entirely and rebuilt the solution from scratch. The new architecture relies on a single tool that handles the complete Wildberries API along with internet access while respecting all platform limits. The decision to prohibit the original AI manager from generating code stemmed from concerns over reliability and security in production environments. Instead, the developers turned to Claude Opus to handle coding tasks. This case highlights practical challenges of deploying AI agents in e-commerce automation and information security contexts.
Freshko: Open-Source Rust Tool Offers Local File and URL Scanning Without Data Upload
A developer has released Freshko, a compact 400x640 pixel desktop application built in Rust that performs quick local checks on files, folders, and URLs without sending data to external services. The tool uses YARA-X rules for file scanning, follows up to eight redirects while querying Cloudflare's filtering DNS, and scores processes for potential cryptocurrency miners based on names, arguments, and launch paths. It explicitly avoids acting as a full antivirus solution, instead providing transparent results that list any skipped items or incomplete checks. Freshko runs on macOS and Windows, keeps all scan results in memory only, and disables system proxies during URL checks to prevent DNS rebinding attacks. The project includes performance benchmarks on Apple Silicon and addresses common pitfalls such as high CPU usage false positives and incomplete disk scans. Unlike VirusTotal or Cloudflare URL Scanner, Freshko performs all file analysis locally and never makes scan reports public.
AmneziaWG Container for MikroTik Routers Delivers Top Performance Six Months After Launch
A developer released an AmneziaWG container for MikroTik devices in February 2026 and has since added major improvements in speed, protocol support, and stability. The lightweight container leverages the router's native WireGuard implementation for cryptography while handling AmneziaWG obfuscation in software. Performance now reaches 250-350 Mbit/s on models such as Hap Ax3 and RB5009B after switching to C code and increasing buffer sizes with RouterOS 7.24. New features include server mode for connecting multiple MikroTik devices, random port hopping, IPv6 support, dynamic DNS, and offline configuration. The project survived an early GitHub ban caused by test scripts and has grown to over 370 stars while remaining fully offline and privacy-focused.
From Japanese sources
Translated from Japanese
WordPress 7.1.4 Addresses RCE in Update Process and Multiple Stored XSS Vulnerabilities
The WordPress development team released version 7.1.4 on October 28, 2026, as a security update to resolve several vulnerabilities. The most severe issue allows remote code execution during the software upgrade process. Multiple stored cross-site scripting flaws were also fixed, including those triggered by specially crafted block markup and manipulated privacy data deletion requests. No CVE identifiers were disclosed in the advisory. Site administrators are strongly urged to apply the update immediately to prevent potential exploitation. The announcement was reported by Security NEXT on November 2, 2026.
CISA Adds Two Ivanti Connect Secure Flaws to KEV Catalog After Confirmed Exploitation
US authorities have issued an alert after confirmed exploitation of two vulnerabilities in Ivanti Connect Secure (ICS). The flaws, tracked as CVE-2026-111357 and CVE-2026-118527, were added to CISAโs Known Exploited Vulnerabilities Catalog on October 30, 2026. Attacks combining three vulnerabilities have also been observed in the wild. CVE-2026-111357 allows local authenticated attackers to escalate privileges due to missing authentication in a critical function. CVE-2026-118527 enables remote upload of arbitrary files to disk through predictable identifiers, even though authentication is required. The addition of CVE-2026-111357 was briefly withdrawn before being reinstated, highlighting administrative confusion around the listing.
GitLab Critical Vulnerabilities Traced to Ruby Onigmo Regex Engine, Including Exploited CVE-2026-97229
GitLab has disclosed that four critical vulnerabilities, including the already-exploited CVE-2026-97229, originate from flaws in the Ruby programming language's Onigmo regular expression engine rather than in GitLab code itself. The most severe issue, CVE-2026-97229, is an integer overflow in regex processing within CI/CD configuration files and carries a maximum CVSSv3.1 base score of 10.0. GitLab released patches on October 8, 2026, covering versions 19.4.2, 19.3.5, and 19.2.8. Ruby's development team followed with its own advisory on October 23, 2026, addressing the same underlying defects. The remaining three vulnerabilities involve double-free memory errors and additional integer overflows during regex parsing and compilation. Because the root cause lies in a shared dependency, any application or environment relying on the affected Ruby Onigmo engine may also be exposed.
CISA Adds Cisco Secure Firewall and GitLab Flaws to Known Exploited Vulnerabilities Catalog
US authorities have warned that two vulnerabilities in Cisco Systems firewall products and the GitLab development platform are being actively exploited in the wild. The Cybersecurity and Infrastructure Security Agency added CVE-2026-76418 and CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on October 29, 2026, urging immediate remediation. CVE-2026-76418 affects Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, allowing unauthenticated attackers to trigger device reboots and cause denial-of-service conditions. CVE-2026-97229 is an integer overflow in GitLab stemming from insufficient validation of regular expressions in CI/CD configurations, enabling remote code execution without authentication. CISA noted that the GitLab issue originates from a dependency in Ruby/Onigmo and may impact other products beyond GitLab itself. Organizations are advised to apply patches or mitigations without delay to prevent further exploitation.
Cisco ASA and FTD Face DoS Vulnerability in SSL VPN Already Exploited in the Wild
Cisco Systems has disclosed a denial-of-service vulnerability affecting its Cisco Secure Firewall ASA and Cisco Secure Firewall FTD products. The flaw, tracked as CVE-2026-76418, resides in the SSL VPN remote access feature and carries a CVSS v3.1 base score of 8.6, rated High severity. Exploitation occurs when secondary authentication is configured on tunnel groups, allowing an attacker to send a crafted request that forces a device reboot without requiring authentication. Cisco confirmed active exploitation of the issue in October 2026. Security updates addressing the vulnerability are now available for both affected product lines. The advisory recommends immediate application of the patches to prevent service disruption.
Critical Pre-Auth RCE Vulnerability CVE-2026-118633 Affects All Sophos UTM Versions, Manual Patch Required After EOL
Sophos has disclosed a critical remote code execution vulnerability in its legacy Sophos UTM security gateway product. The flaw, tracked as CVE-2026-118633, carries a CVSSv4.0 base score of 9.2 and is rated Critical. It allows unauthenticated attackers to execute arbitrary commands as root by triggering a race condition through repeated attacks against the email proxy when scanning is enabled. Although the product reached end-of-life, Sophos released a manual patch that users must apply themselves because automatic updates are no longer available. The company urges immediate patching for any deployments still using the email protection feature and recommends migration to the supported Sophos Firewall. The issue was reported through Sophosโs bug bounty program by an external researcher.
From Portuguese sources
Translated from Portuguese
Binance Confirms Record $6.3 Billion Crypto Theft via Compromised Hot Wallet and EIP-7702
Binance reported on October 30, 2026 that attackers stole approximately 6.3 billion dollars in cryptocurrency, equivalent to roughly 34 billion reais, marking the largest theft in the sector. The unauthorized transfers occurred on October 29 and were completed in about 20 minutes after the attacker compromised the system authorizing withdrawals. According to TRM Labs, the intruder leveraged Ethereum's EIP-7702 feature to seize control of a hot wallet following at least 36 hours of preparation. Initial reports pointed to a compromised DevOps engineer's laptop as the entry point, but the exchange later stated the incident involved multiple factors and was not a single-click action. Roughly 3 billion dollars have been traced, with Tether freezing over 1.57 billion USDT and Circle blocking more than 800 million USDC. Binance has committed to covering all losses through its SAFU fund and internal capital while cooperating with the FBI and U.S. Secret Service. Attribution remains disputed, with TRM Labs and Chainalysis linking the operation to the TraderTraitor group connected to Lazarus, though Binance has not confirmed the perpetrators.
China-Linked WARP PANDA Exploits VMware ESX Zero-Day CVE-2026-41709 to Evade Logging
CrowdStrike reported on 28 October 2026 that the China-linked group WARP PANDA used CVE-2026-41709, a zero-day in VMware ESX, to operate without leaving records on compromised hypervisors. The vulnerability carries a low CVSS 3.1 score of 2.7 and was added the same day to the CISA Known Exploited Vulnerabilities catalog with a remediation deadline of 11 November. Broadcom describes the flaw as insufficient logging that allows a malicious administrator to execute certain operations without them appearing in logs. The issue does not enable remote code execution or privilege escalation on its own; its value lies in erasing the audit trail that incident responders rely on to reconstruct activity. CrowdStrike linked the exploitation to espionage operations against U.S. legal-sector organizations, with activity intensifying in early 2026. The report also highlights deployment of BRICKSTORM and SharpStorm malware in vCenter environments along with stolen cloud session tokens. Broadcom has released fixed builds for ESXi 9.1, 9.0.2 and 8.0 U3j, while VMware Cloud Foundation 5 requires version 5.2.4.
Telegram Voice Call Flaw Allows Remote Code Execution on Android Devices
Security researchers disclosed a vulnerability in Telegram for Android that enables remote code execution on a victim's device simply by answering a voice call. The attacker requires only a standard account, and the flaw was present in versions 8.6.2 through 12.10.3 released between March 2022 and September 2026. Telegram addressed the issue in version 12.10.4, released at the end of September 2026. The root cause lies in improper handling of the MediaState message exchanged during calls, specifically when processing rotation values and missing video state fields, leading to out-of-bounds memory reads. The same underlying fix was deployed earlier to shared call libraries, iOS, and desktop clients, but reached Android later. Researchers confirmed the impact only on private calls running on ARM64 Android devices, with no evidence of exploitation in the wild or public CVE assignment as of October 29, 2026.
PHP2Shell Campaign Chains PHP and Linux Kernel Flaws to Compromise 25 Servers Including US Government-Linked Network
Israeli security firm Dream disclosed a sophisticated campaign that achieved root access on 25 servers by chaining two remote code execution vulnerabilities in PHP2Shell with a Linux kernel flaw. The attackers targeted 24 perimeter firewalls from a single unnamed vendor plus one internal management server across the United States, Japan, Taiwan, and South Korea. Three of the compromised devices belonged to an environment connected to the US government, where the intrusion led to domain controller access and Active Directory enumeration. The attack chain began with CVE-2026-109618 and CVE-2026-109619, which granted initial web server access, and escalated via CVE-2026-46300 (Fragnesia) to obtain root privileges. Dream observed extensive reconnaissance using the Chinese search engine FOFA, with indicators pointing to Chinese-language tooling and timing, though no specific threat actor was attributed.
Threat Actors Exploit Critical CVE-2026-101767 RCE Flaw in Oracle E-Business Suite
Threat intelligence firm Defused detected active exploitation attempts against CVE-2026-101767 targeting Oracle E-Business Suite honeypots on October 27, 2026. The vulnerability carries a CVSS 3.1 score of 9.8, requires no authentication, and resides in the Thin Client Framework servlet within the Application Object Library component. Oracle released a fix seven days earlier in its October 2026 Critical Patch Update, covering versions 12.2.3 through 12.2.15. Successful exploitation grants SQL execution under the privileged APPS database account, enabling lateral movement to operating system commands and access to financial, payroll, and procurement records. Horizon3.ai privately reported the issue in July 2026, and prior similar flaws in the same product were leveraged by the Cl0p ransomware group. Immediate mitigation includes applying the quarterly patch or restricting access to the GanttDataServer servlet via URL firewall rules.
South Korean Hacker Uses Generative AI Framework ARTEX to Breach 90 Organizations and Steal 8.2 Million Records
Seoul Metropolitan Police arrested a 32-year-old man identified only as A for conducting a series of intrusions against approximately 90 South Korean companies and institutions between September 2025 and October 2026. The attacker, who had no formal technology education and learned hacking from publicly available online materials, previously worked in penetration testing at a security firm from 2019 to 2022. Roughly 60 of the victims were compromised using the generative AI-powered pentesting framework ARTEX, which autonomously determined attack paths after receiving only the target name. The operation resulted in the theft of 8.2 million personal records and internal documents, after which the perpetrator extorted 38 organizations for a total of 360 million won in Tether, ultimately receiving 300,000 won. Police recovered part of the stolen material and are investigating possible copies on the dark web, classifying the case as the country's first large-scale incident involving generative AI. Six additional suspects remain under investigation while the main perpetrator has been referred to prosecutors on charges of violating information and communications network laws and extortion.
From Chinese sources
Translated from Chinese
No News Content Available
The provided news item contains no text or details in the original Chinese source. Without any substantive information, it is impossible to determine relevance to cybersecurity topics. The entry is therefore classified outside all security-related categories.
360 Security Cloud Opens PHP2Shell Vulnerability Self-Check Platform to Government and Enterprise Users
360 Security Cloud has launched a dedicated self-assessment platform that allows organizations to scan their PHP-based websites and systems for the PHP2Shell vulnerability. The service is now available to government agencies, large enterprises, and small-to-medium businesses. Users can apply by scanning a provided QR code to determine how many of their assets run PHP, identify affected versions, and check whether any systems have already been compromised. The platform addresses key questions about exposure: the number of PHP-powered sites and systems, the presence of vulnerable versions, and signs of prior intrusion. The announcement emphasizes that the tool helps organizations proactively assess risk without requiring external assistance. The original Chinese report was published on October 30, 2026, and the service is positioned as a practical response to ongoing PHP-related security concerns.
GEEKCON 2026 Returns to Shanghai: Hackers Demonstrate AI-Assisted Exploits Across Apps, Robots and Vehicles
GEEKCON 2026 brought the security conference back indoors to the CMG Media Cinema in Shanghai's West Bund after last year's open-air venue. Organizers introduced two new AI-focused tracks alongside the traditional DAF vulnerability exploitation challenge and 30+5 deep-dive sessions. In the AI Hacker Extreme Challenge, six teams used AI tools to compromise six real-world targets in a single afternoon, achieving eleven successful breaches. Demonstrations included remote hijacking of quadruped robots, silent app installation on Android devices, unauthorized vehicle control, and novel exploitation paths in fastjson 1.2.83 discovered with AI assistance. The AI Hacker Debate revealed audience division on whether human hackers will be replaced, while the human-only DAF track awarded no first or second prizes. Organizers framed the event as an effort to illuminate vulnerabilities before they appear in real-world attacks, echoing themes from The Matrix.
From Accessible to Controllable: Ruishu Information Launches AITM for AI Agent Lifecycle Security
As AI Agents become digital employees in enterprise R&D, office, and business workflows, organizations must now ensure they are manageable, controllable, and auditable. A multinational consulting firmโs internal AI platform was compromised by an autonomous agent attack that progressed from interface reconnaissance to vulnerability exploitation and database read-write access. Conventional scanners missed the injection points, but the agent inferred query structures from database error messages. Ruishu Information has responded with its Agent Intelligent Lifecycle Management system (AITM), which enforces security across admission, runtime, permissions, and data flows. The platform combines static scanning, behavioral analysis, semantic judgment, and sandbox execution for pre-deployment checks, followed by continuous runtime validation and LLM data-plane protection. AITM applies HMAC-SHA256 signatures, tool whitelists, PII tokenization, and four-stage Trace auditing to reduce blind spots throughout the agent lifecycle.
GitLab Discloses 12-Year-Old CVSS 10.0 Vulnerability Enabling Unauthenticated Remote Code Execution
GitLab has published a critical security advisory for CVE-2026-110264, a CVSS 10.0 flaw that permits unauthenticated remote code execution on both Community and Enterprise self-hosted instances. The vulnerability has existed in the codebase since 2014 and affects every version up to the latest release prior to the October 2026 patch. Exploitation requires no credentials or special conditions, allowing attackers to run arbitrary commands, exfiltrate source code, deploy backdoors, or move laterally. The issue remained undetected through multiple code iterations, security audits, and version updates due to its hidden trigger conditions within the large, complex application. Organizations are urged to immediately verify their version, review access logs for anomalies, and apply the official fix, while temporary mitigations include network restrictions and enhanced monitoring.
Google Brotli Decoder Vulnerability CVE-2026-111497 Enables Remote Code Execution in Node.js, Python, Bun and Envoy
A critical out-of-bounds write flaw in Google's Brotli decoder (CVE-2026-111497) affects multiple widely used platforms including Node.js, Python, Bun and Envoy. Imperva researchers demonstrated reliable remote code execution on official Node.js 24.22.0 builds for Linux arm64, naming the exploit Node2Shell. The vulnerability allows crafted Brotli-compressed data to corrupt memory, leading to crashes, information leaks or arbitrary code execution. Affected versions include Node.js releases below 22.23.4, 24.22.1 and 26.12.1, plus all versions of the Python brotli and brotlicffi packages. Patches have been issued for Node.js, while other projects await updates; no in-the-wild exploitation has been observed yet. The incident highlights recurring supply-chain risks where a single foundational library impacts thousands of downstream applications.
From Spanish sources
Translated from Spanish
Node.js Issues Security Releases for 26.x, 24.x and 22.x Fixing High-Severity TLS and Brotli Flaws
Node.js published security updates on October 21, 2026 for the 26.x, 24.x and 22.x release lines. The patches address multiple high-severity vulnerabilities affecting TLS hostname validation and the Brotli decoder, along with updates to critical dependencies including OpenSSL and Undici. Several CVEs cover bypasses in certificate hostname checks when IP addresses use full-width digits or when hosts resolve loosely to IP addresses. A particularly serious out-of-bounds write in the Brotli decoder (CVE-2026-111497) could enable remote code execution on services processing compressed responses. Additional fixes resolve keep-alive socket timing issues, DNS resolution truncation with NUL characters, and entropy caching problems in crypto.randomUUID and randomInt functions. The releases also update c-ares, Undici, OpenSSL, SQLite and ca-cert bundles following the eMudhra intermediate CA compromise.
Node.js Fixes High-Severity Brotli Decoder Flaw Leading to Remote Code Execution
A high-severity vulnerability in the bundled Brotli decoder of Node.js allows out-of-bounds writes when processing attacker-controlled compressed data, potentially resulting in remote code execution. The flaw, tracked as CVE-2026-111497, affects all supported branches including 22.x, 24.x, and 26.x prior to the October 21, 2026 security release. Patched versions 22.23.4, 24.22.1, and 26.12.1 address the memory corruption issue that arises during Brotli decompression in services accepting third-party content. The same update resolves additional high-severity problems, notably hostname validation weaknesses in TLS. Organizations using unsupported branches such as 18.x, 20.x, 23.x, and 25.x must migrate to maintained releases, while those linking against system Brotli libraries should verify inclusion of upstream commit 0ed4268. Security teams are advised to audit all environments, including containers and CI pipelines, that process Brotli-encoded data.
PHP Issues Emergency Patches for Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
PHP has released urgent patches for two critical vulnerabilities collectively known as PHP2Shell that enable unauthenticated remote code execution on affected servers. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, score 9.2 on CVSS v4.0 and have already seen active exploitation attempts with malicious payloads adjusted to bypass WAF rules. The issues affect multiple PHP deployment methods including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, and do not require complex application code to be exploitable. CVE-2026-109618 involves a memory corruption chain leading to code execution under the web process privileges, while CVE-2026-109619 stems from an obsolete global state issue causing use-after-free conditions that can result in memory disclosure and code execution. Patched versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with administrators advised to restart all persistent workers after updating. Temporary mitigations such as setting memory_limit to -1 and disabling session.upload_progress.enabled are available for environments that cannot patch immediately.
Cyberattack Exploits Exposed Danfoss Refrigeration Controllers Across French Supermarkets
A remote cyberattack targeted Danfoss AK-SM 8xxA Series controllers in French supermarkets, allowing attackers to manipulate refrigeration parameters and trigger defrost cycles that raised temperatures and spoiled food stock. The incident impacted an estimated 250 to 350 stores belonging to major chains including Intermarchรฉ, Carrefour Market, Leclerc, and others. Paris prosecutors have opened a large-scale investigation into the attack and associated damages, including potential fires. The root cause traces to outdated software on internet-exposed OT management interfaces, with multiple CVEs enabling authentication bypass and remote code execution. Thousands of similar Danfoss systems remain publicly accessible worldwide, highlighting persistent OT exposure risks. Immediate remediation steps include closing web consoles, enforcing VPN access, and applying updates to versions 4.2 and 4.3.1 or later.
Attackers Exploit Critical Atlassian Data Center Flaw CVE-2026-21589 Hours After PoC Release
Exploitation attempts against CVE-2026-21589 began almost immediately after technical details and a Nuclei template were published. The vulnerability allows unauthenticated arbitrary file read in multiple Atlassian Data Center products and carries a CVSS v4.0 score of 9.3. In environments integrated with Crowd, attackers who obtain crowd.properties can extract plaintext credentials and escalate to administrator privileges via the Crowd API. The flaw stems from improper handling of double-colon sequences in a shared web resource library, enabling path traversal against plugin resource endpoints. Affected products include Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian urges immediate patching outside normal cycles and recommends WAF rules or Tomcat RewriteValve configurations to block traversal patterns. Organizations should also review access logs for double-decoded URLs containing .., /, \, or :: sequences.
LibreOffice and Apache OpenOffice Flaws Enable Remote Code Execution via Malicious Spreadsheets Without Macro Warnings
Two vulnerabilities, CVE-2026-63277 in LibreOffice Calc and CVE-2026-59265 in Apache OpenOffice, allow attackers to execute arbitrary code simply by tricking users into opening specially crafted spreadsheet files. The flaws exploit Java integration and class path handling, bypassing traditional macro security prompts entirely. LibreOffice has already released fixes in versions 26.2.5 and 26.8.0 that restrict class path entries to local file URLs only. Apache OpenOffice 4.1.16 and earlier remain vulnerable, with the stable patch expected in 4.1.17; interim mitigation requires disabling Java integration. The issues highlight risks in office suites that process untrusted documents containing external data connections or JDBC references. Organizations are advised to enforce least-privilege execution and avoid opening files from unknown sources until patches are applied.