OS command injection vulnerability in boks_autoregisterd service allowing unauthenticated remote attackers to execute arbitrary commands with elevated privileges. CVSS 9.8 with widespread scanning and exploitation attempts observed.
Apply vendor patches immediately. Disable boks_autoregisterd service if not required. Implement network segmentation to restrict access to PAM systems. Monitor for indicators of exploitation.
Source: NVD • Published: 2026-10-04
Improper restriction of operations within memory buffer bounds vulnerability in NetScaler systems. Added to CISA KEV catalog October 4, 2026 with evidence of active exploitation.
Apply vendor security patches by October 7, 2026 deadline. Review system logs for indicators of compromise and implement memory protection controls.
Source: CISA • Published: 2026-10-04
Elevation of Privilege vulnerability in Microsoft Exchange Server with CVSS 8.8. Only CVE in October 2026 Patch Tuesday affecting Exchange Server 2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM. No active exploitation reported.
Apply October 2026 cumulative updates for affected Exchange Server versions. No emergency patching required as no active exploitation reported, but prioritize in regular patch cycle.
Source: MSRC • Published: 2026-10-01
Multiple critical vulnerabilities in AI coding agents enabling arbitrary code execution before approval prompts, silent plugin substitution during updates, sandbox escapes, and unintentional leakage of 13,000+ screenshots containing source code, credentials, and API keys to public GitHub repositories.
Disable auto-update for AI coding plugins. Review and sanitize git settings. Implement screenshot capture controls. Audit public repositories for leaked credentials. Apply workstation security policies restricting AI agent file system access.
Source: GTIG • Published: 2026-10-03
Largest AI supply chain breach of 2026 affecting 434,000 CI/CD pipelines across 2,500+ organizations. Malicious packages live for 40 minutes on PyPI before quarantine, impacting technology, industrial, financial, and telecommunications sectors.
Audit all LiteLLM dependencies and update to verified clean versions. Implement package integrity verification. Use private PyPI mirrors with security scanning. Review CI/CD pipeline logs for indicators of compromise during exposure window.
Source: GTIG • Published: 2026-10-04
GlassWorm supply chain attack targeting developers through malicious VS Code theme extensions. Four Marketplace extensions and six Open VSX identities identified, with two confirmed malicious showing high-confidence technical connection to GlassWorm threat actor.
Audit installed VS Code extensions and remove suspicious themes. Only install extensions from verified publishers. Enable VS Code Marketplace security features. Implement workstation EDR to detect extension-based malware.
Source: Cycode • Published: 2026-10-05
Translation file injection vulnerability discovered via LLM-assisted research. Angular compiler accepts i18n-onerror and i18n-on* attributes, allowing tampered translation files to inject JavaScript into event handlers.
Update Angular to patched version. Implement Content Security Policy headers. Validate and sanitize all translation files before deployment. Use translation file integrity verification.
Source: NVD • Published: 2026-10-01
AI inference and serving software had 212 vulnerabilities disclosed in 2026. Nearly 25% stem from unauthenticated API endpoints or SSRF, enabling attackers to bypass firewalls, consume GPU resources, or extract model checkpoints.
Implement authentication for all AI inference API endpoints. Deploy API gateway with rate limiting. Use network segmentation for inference infrastructure. Enable model checkpoint encryption. Monitor GPU resource consumption for anomalies.
Source: GTIG • Published: 2026-10-03
Cache key collision vulnerability discovered via LLM-assisted research where repeated parameters with commas allow cache poisoning. Requests with different parameter arrays can collapse onto identical cache keys, enabling privilege escalation.
Update Angular to patched version addressing cache key generation. Review and regenerate cache keys using secure hashing. Implement cache validation controls.
Source: NVD • Published: 2026-10-01
File transfer system breach affecting 3.1 million people (2.8M current/former military, 300K deceased) over October 2025-July 2026 period. Unencrypted data includes names, DOB, SSN, demographic details, and military service information.
Implement encryption for all data at rest and in transit. Deploy DLP controls on file transfer systems. Enable multi-factor authentication. Conduct counterintelligence review for affected personnel. Offer identity monitoring services to impacted individuals.
Source: BleepingComputer • Published: 2026-10-05
Unauthorized access to 8.8 million Danish residents' personal data including names, addresses, and identification numbers through misuse of legitimate private company access to CPR database.
Revoke and revalidate all third-party access credentials. Implement just-in-time access provisioning. Deploy query monitoring and anomaly detection. Conduct audit of all CPR access logs. Implement rate limiting on database queries.
Source: BleepingComputer • Published: 2026-10-05
Car-sharing service breach exposing 6.6 million user accounts over nearly one month. Data includes full names, addresses, DOB, phone numbers, emails, driver's license info, identity documents, passwords, and linked service IDs.
Force password reset for all users. Implement multi-factor authentication. Encrypt sensitive data including license images. Deploy intrusion detection systems. Notify affected users and offer identity monitoring. Review access logs for full breach timeline.
Source: BleepingComputer • Published: 2026-10-04
Handala Hack, identified as Iranian MOIS state-directed front, conducted destructive operation against US medical technology company Stryker. Part of doubled nation-state and hacktivist attacks in 2025 over 2024, with 5 of 14 clearly linked to Ukraine conflict.
Implement network segmentation for critical medical systems. Deploy backup and disaster recovery procedures. Monitor for Iranian threat actor TTPs. Coordinate with FBI and CISA for threat intelligence. Implement OT security controls.
Source: GTIG • Published: 2026-10-03
EU AI Act full implementation effective August 2, 2026 requires foundation model providers to publish comprehensive training data summaries, demonstrate EU copyright compliance under Article 53, and implement opt-out mechanisms per Directive 2019/790.
Publish detailed training data documentation. Implement copyright compliance tracking systems. Establish rights holder opt-out mechanisms. Conduct AI Act compliance audit. Designate compliance officers for GPAI provisions.
Source: OWASP • Published: 2026-10-02
UK Financial Conduct Authority warns frontier AI models with cyber capabilities are accelerating vulnerability discovery faster than firms can respond. Firms with strong foundational cyber resilience, clear accountability, and effective oversight best positioned to manage frontier AI challenges.
Accelerate vulnerability response cycles to match AI discovery speeds. Strengthen foundational cyber resilience practices. Establish clear AI governance and accountability frameworks. Implement continuous monitoring for AI-discovered vulnerabilities. Document AI risk management procedures.
Source: Web • Published: 2026-10-04
OWASP DevSecOps project exploring cybersecurity implications of AI throughout SDLC. Build 2 demonstrates human-directed generative AI; Build 3 scoped for agentic AI capabilities to autonomously develop, build, and test code.
Participate in OWASP DevSecOps AI security framework development. Implement security controls for agentic AI in development pipelines. Establish governance for autonomous code generation. Test AI agent security boundaries before production deployment.
Source: OWASP • Published: 2026-10-05
CVE-2026-9862: OS command injection vulnerability in boks_autoregisterd service allowing unauthenticated remote attackers to execute arbitrary commands with elevated privileges. CVSS 9.8 with widespread scanning and exploitation attempts observed.