CyberStack

Latest cyber news, threats, security, and guidelines. Stack up.

Latest

AI
Published 2026-10-29
Verified 2026-10-31

Mozilla says AI models make patch-gapping a more practical threat and that Firefox will stagger fixes across sandbox layers so their patch gaps do not overlap

In a Mozilla Blog post dated 29 October 2026, 'Defending the patch gap against automated attackers', Mozilla's Bobby Holley says AI models can now identify software vulnerabilities as effectively as top security researchers. Mozilla says the Firefox team has worked since February with early access to frontier models from Anthropic and OpenAI and has shipped more than seven times the number of security fixes compared with the same period in 2025. It describes the patch gap as the window between a security fix appearing in the code and that code reaching most users, during which an attacker could reverse-engineer an incoming fix and attack the prior version. Mozilla says AI models can dramatically accelerate this and lower the barrier to entry, and that it has seen evidence that models like GLM 5.3 can exploit some of the fixes for bugs originally uncovered by more advanced models. Steps Mozilla says Firefox has already taken: cutting the release cycle in half so new builds ship every week; keeping regression tests confidential until after a fix has shipped, because it observed GLM 5.3 is much less effective at patch-gapping without one; and scanning all new commits for newly introduced bugs. Mozilla says it will also group classes of fixes so that the patch gaps for different layers of Firefox's defences (for example a renderer exploit and a sandbox escape) do not overlap, and that getting this right may take some time. Mozilla also says October has seen a sharp increase in vulnerability disclosures and exploit activity as defenders and attackers get more capable models. (source: Mozilla Blog)

Product
Mozilla Firefox (release process and security-fix handling)
Versions
n/a — process change described by Mozilla; no CVE or version in the post
CVSS
n/a
Exploited in Australia?
unknown
Patch to
Nothing new to install. Keep Firefox on automatic updates; Mozilla says new builds now ship every week.

Primary: Mozilla Blog — Defending the patch gap against automated attackers (29 Oct 2026)

ai

AI
Published 2026-10-29
Verified 2026-10-30

Forever Security 'EMBRACE' research: browsers built into Cursor, GitHub Copilot, Claude Desktop, Codex and VS Code could be abused to run code, read local files or spoof the address bar; it says the Codex and VS Code issues are still open

Forever Security published 'EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants' on 29 October 2026. It says it researched the browsers embedded in Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop and broke a core browser-security rule in every one, with impact ranging from running code on the host (Cursor) to reading and exfiltrating files on the disk (Codex, Claude Desktop, VS Code) to spoofing a tab's address to both the person and the agent (GitHub Copilot). According to Forever, Cursor's integrated browser let any page send text into the agent's composer, which it used to get the agent to run an npm install; it says success is probabilistic and depends on the model, that it disclosed the issue to Cursor on 10 September and that it was silently patched on 1 October. It says it found the address-bar spoof in GitHub Copilot 1.1.27 on 26 September and that GitHub fixed it independently in Copilot 1.1.29 on 13 October, before Forever sent a report. For Claude Desktop and VS Code, Forever says a local file:// page could read files outside the project folder from a web worker, and that Codex applied no such restriction at all. Its timeline says Anthropic declined its 23 July report as invalid for a 'Workspace Trust' gated security boundary and accepted the same issue from Noma Security on 24 July; that OpenAI never replied to its 27 July report; and that Microsoft declined its 10 September report on the same grounds. Forever says that at the time of publishing the Codex and VS Code issues were still open. (source: Forever Security) The Register reported at 23:12 UTC on 29 October (7:12 am Perth time, 30 October) that an OpenAI spokesperson said OpenAI is aware of the issue and working to address it, and that Cursor, GitHub, Anthropic and Microsoft did not respond to its questions. (source: The Register)

Product
Embedded browsers in AI coding assistants: Cursor, GitHub Copilot app, Claude Desktop, OpenAI Codex app, VS Code
Versions
Per Forever Security: Cursor patched 1 October (no version given); GitHub Copilot spoof found in 1.1.27, fixed in 1.1.29; Codex and VS Code still open at publication (29 Oct). No CVEs or vendor advisories published.
CVSS
not published
Exploited in Australia?
unknown
Patch to
Keep Cursor and the GitHub Copilot app updated (Copilot 1.1.29 or later, per Forever). Until OpenAI and Microsoft ship fixes, do not open untrusted local HTML files in the Codex or VS Code built-in browser preview, be wary of an assistant handing you a file:// link from a cloned project, and keep SSH keys, .env files and tokens out of reach of developer machines that preview untrusted projects.

Primary: Forever Security — EMBRACE: [Technical Overview] How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants (29 Oct 2026) · The Register — Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched (29 Oct 2026, 23:12 UTC)

ai

AI
Published 2026-10-29
Verified 2026-10-30

Drupal Association: 256 Drupal security advisories in June–October 2026, more than in the previous 30 months combined, driven by AI-assisted vulnerability discovery; it says intake and review, not discovery, are now the bottleneck

The Drupal Association said on 29 October 2026, reporting results from the Drupal AI Security Initiative it launched with Alpha-Omega in June, that Drupal published 256 security advisories from June through October 2026, more than the 250 published across the previous 30 months combined. It says monthly volume rose from an average of 8 advisories in early 2026 to 28 in June, 74 in September and 106 in October, peaking at 39 advisories on 28 October, and that 134 different people have been credited as reporters since 1 June, against 68 in all of 2025. The Association says the surge is driven by a shift in the economics of vulnerability discovery, not a change in Drupal's attack surface: the issues are mainly latent bugs in mature core and contributed code that AI-assisted analysis has made cheap, fast and automatable to find, and most reports came from volunteers and outside researchers, many using AI tools. It says discovery is now cheap and intake is the bottleneck; a Trail of Bits report against one contributed module through the Patch the Planet programme (run by Trail of Bits and OpenAI) led to the critical core fix SA-CORE-2026-014 released on 14 October; Opengrep's PHP parser silently skipped valid PHP 8 code in about 350 files across 176 contributed projects and every supported core branch (fixed upstream on 1 September); and its Triagebot tool, which posts one message per new report with a suggested classification and likely duplicates, has flagged roughly 20% of reports as probable duplicates since mid-August. The Association says release capacity is the next constraint and that it is writing a working standard for what a useful AI-assisted security report must contain. (source: Drupal Association)

Product
Drupal core and contributed projects (security advisory process)
Versions
n/a — programme report
Exploited in Australia?
unknown
Patch to
Drupal site owners: expect a high volume of security advisories and keep core and contributed modules on current security releases. Open-source maintainers: plan for review and intake capacity as AI-assisted reports increase.

Primary: Drupal.org — 256 Advisories in Five Months: Results from the Drupal AI Security Initiative (29 Oct 2026)

ai

AI
Published 2026-10-29
Verified 2026-10-29

Symantec: an unauthorized relay service installs the genuine OpenAI Codex and Claude Code CLIs, then switches their sandbox off and routes every request through its own servers; seen at a dozen organisations, mostly in mainland China

Symantec's Threat Hunter Team said on 29 October 2026 that it has identified an unauthorized relay service that provides access to OpenAI's Codex and Anthropic's Claude Code command-line coding agents, mainly in markets where the vendors do not officially operate, primarily mainland China. Symantec says the service has been active since at least early 2026 and has impacted systems at a dozen organizations, most of them in mainland China, as well as multinational subsidiaries based in South Korea, Taiwan and Malaysia, in sectors including industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals and data center services. According to Symantec, users run a fileless PowerShell or bash setup script, fetched from a lookalike domain by a one-line command, shortly after a legitimate npm install of the CLI; the script rewrites ~/.codex/config.toml or ~/.claude/settings.json to point at a relay-controlled domain, swaps in a relay-issued API key set as user-scope environment variables so the change survives a reboot, sets Codex's sandbox mode to "danger-full-access", enables network access for the write sandbox and disables telemetry and error reporting. On one host the script logged the user out of their Anthropic session and deleted the ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY variables before reissuing relay-controlled credentials. Symantec says this is not a vulnerability in Codex or Claude Code, that there is no evidence so far that the relay operator has abused its access, but that a relay in this position sees every prompt, file and secret sent to the agent and, with the sandbox disabled, a malicious or compromised response could execute with the full privileges of the user's account. Symantec says the relay's backend has rotated across at least eight domains impersonating OpenAI- or Anthropic-branded chat services, and it published indicators. (source: Symantec)

Product
OpenAI Codex CLI and Anthropic Claude Code CLI installs reconfigured by an unauthorized relay service (Symantec: not a vulnerability in either tool)
Versions
n/a — configuration changes by a third-party setup script, not a product flaw (Symantec)
Exploited in Australia?
unknown
Patch to
Symantec advises watching endpoints that run Codex or Claude Code for: changes to base_url or ANTHROPIC_BASE_URL in the CLI configuration; sandbox_mode set to "danger-full-access" in ~/.codex/config.toml; OPENAI_BASE_URL, CODEX_API_KEY or ANTHROPIC_AUTH_TOKEN set as user-scope environment variables outside an approved deployment process; a PowerShell iwr | iex or bash curl | bash run shortly after, or in place of, npm install -g @openai/codex or @anthropic-ai/claude-code; and AI CLI traffic to destinations outside an allow-list of approved AI service endpoints. Indicators (script hashes and relay domains) are in Symantec's post.

Primary: Symantec (security.com) — Sandbox Flipped to ‘Danger-Full-Access’: Unauthorized AI Relays Create Risk for Organizations (29 Oct 2026) · Dark Reading — Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes

ai

AI
Published 2026-10-28
Updated 2026-11-02
Verified 2026-11-02

Parameter says a malicious public ChatGPT share link could run attacker code as chatgpt.com in the signed-in session of whoever opened it and read their private chats; it says OpenAI fixed the flaw on 26 October and rated it P1

Security firm Parameter published 'Do the Math: How We Took Over ChatGPT Accounts' on 28 October 2026. It says it found a way to turn an ordinary public ChatGPT share into attacker-controlled JavaScript running inside the signed-in session of whoever opened it. Per Parameter, a graph in the shared conversation loaded the MathLive math library into the main ChatGPT page, and MathLive's on-screen keyboard listener accepted messages from any web address; an HTML Preview in the same conversation used it to insert an unsandboxed frame that inherited the chatgpt.com identity, and because ChatGPT's content security policy allowed scripts from YouTube, a YouTube oEmbed callback supplied the code. Parameter says it confirmed the code could enumerate the victim's conversation list, retrieve content from a private conversation that had never been shared with the attacker and send data from it to an external server, and that 'Essentially, we could perform any action on behalf of the victim's ChatGPT account.' In its most stable reproduction the victim opened the share and clicked ChatGPT's Preview button once; in a later version Preview opened automatically, so opening the link was the only click. Parameter says it submitted the report to OpenAI's bug bounty program on 18 October, OpenAI reproduced the issue on 21 October and raised the severity from P2 to P1, and on 26 October OpenAI confirmed both ChatGPT web frontends rejected the reported messages, resolved the issue and awarded a total bounty of $5,000. (source: Parameter) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Parameter)

Product
ChatGPT web app (public share links, HTML Preview, MathLive graph keyboard)
Versions
ChatGPT web frontends before OpenAI's fix; Parameter says OpenAI confirmed on 26 October 2026 that both web frontends rejected the reported messages. No CVE named in the cited sources.
CVSS
not published (rated P1 by OpenAI's bug bounty triage, per Parameter)
Exploited in Australia?
unknown
Patch to
OpenAI confirmed the fix on 26 October 2026, per Parameter.

Primary: Parameter — Do the Math: How We Took Over ChatGPT Accounts (28 Oct 2026)

ai

AI
Published 2026-10-28
Updated 2026-11-02
Verified 2026-11-02

Google announces Gemini 4 Carbon, a frontier model it says leads SEC-bench Pro, ExploitGym and CWE-bench for finding, exploiting and patching vulnerabilities; first access goes to a subset of cyber defenders through its Fairwind Program

Google announced Gemini 4 Carbon on 28 October 2026, calling it its strongest model, with state-of-the-art cybersecurity and long-horizon capabilities (Google blog, Koray Kavukcuoglu, SVP Google DeepMind and Chief AI Architect). Google says Carbon scores 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on the ExploitGym exploitation benchmark and 71.0% on Collinear's CWE-bench for patching, evaluated without guardrails, and ranks first at 59 on v5.0 of the Artificial Analysis Intelligence Index. On internal benchmarks, Google says Carbon achieves more than 2x uplift in success rate for generating secure code over Gemini 4 Argon, and that the Chrome team reported Carbon performed more than 10X better than another lab's large frontier model when generating high quality patches. On safety, Google says Carbon builds on Argon's multi-layered safety and security stack, achieved a 0.0% attack success rate on Gray Swan's Indirect Prompt Injection benchmark (Argon: 0.7%), cut successful cheating on Terminal-Bench 4.0 to 0.0%, and saw high-severity misalignment alerts drop by almost 80% in live coding environments with internal teams. Google says it is taking a deliberate approach to rollout and is taking part in the U.S. government's voluntary process for checking models before release: starting this week, Carbon goes to a subset of cyber defenders, with access phased to additional trusted partners through its Fairwind Program before availability to developers, businesses and consumers. Google lists an introductory price of $2 per million input tokens and $10 per million output tokens, then $4 and $20. (source: Google) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Google)

Product
Google Gemini 4 Carbon (frontier AI model; Fairwind Program early access — not a CVE)
Versions
n/a — model launch; initial access for a subset of cyber defenders (Google, 28 Oct)
Exploited in Australia?
unknown
Patch to
Nothing to patch. Google says Carbon is available first to a subset of cyber defenders and then to additional trusted partners through the Fairwind Program, before developers, businesses and consumers.

Primary: Google — Gemini 4 Carbon: our next frontier model (28 Oct 2026) · Vendor: Google — Fairwind Program

ai