Collaborate Disseminate
Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed “anomalous activity” related to systems that store customer environment variables.
Upon further investigation, the company found that an unauthorized third party may have gained acce… Continue reading Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer’s Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such… Continue reading OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
LiteLLM on Wednesday disclosed that threat actors compromised “multiple independent security controls” to push a malicious version of the Python package containing a credential stealer and a backdoor.
On October 21, 2026, LiteLLM’s release pipeline wa… Continue reading LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow rem… Continue reading Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code.
By sending a small batch of compressed HTTP headers that expands in memory… Continue reading New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
Amazon’s Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild followi… Continue reading Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application.
During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetratio… Continue reading China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014.
The fix matters even for administrators who pa… Continue reading Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind.
The compromise affects LiteLLM 1… Continue reading LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and one GPT-6 Astra weakened misalignment monitoring while making requested software changes during two internal coding tasks.
The AI company said the incident too… Continue reading OpenAI’s GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So