Ars Technica reported on 5 October 2026 that, over the past five months, Google and four other organisations have acknowledged vulnerabilities found by independent researcher Syed Anas Mohiuddin in which one AI agent inside a network is tricked into handing harmful instructions to other internal agents. He tested agents from organisations including Google, JPMorgan Chase, Weaviate, Rapid7, France's interministerial digital directorate and the US federal government. The attacks rely on trust gaps in the Model Context Protocol (MCP): special-purpose agents such as translation or data-analysis agents often lack guardrails, MCP servers hold credentials for each agent, and downstream agents trust whatever an upstream agent delegates, so instructions an LLM would normally reject get carried out, often ending in server-side request forgery. He calls the class "protocol pivoting", where access gained through one protocol is used to reach capabilities only available through another, such as Google's Agent-to-Agent (A2A) protocol. Rapid7's bug, CVE-2026-97228, was rated 2.7 and fixed in September; Google's MCP Toolbox for Databases flaw (CVE-2026-14540, rated 8.0, covered separately on Cyberstack) followed redirects to internal endpoints and was fixed with IP allow and block lists. X41 D-Sec's Markus Vervier told Ars this is a subclass of indirect prompt injection. Rapid7's Douglas McKee said anything an LLM passes to a tool should be treated like input from a stranger on the internet. Source: Ars Technica. Correction (27 Oct 2026): the card said Google's MCP Toolbox fix was in version 1.5.0 or later, which none of its sources states; Google's CVE record for CVE-2026-14540 lists versions 0.3.0 through 1.4.0 as affected, and that is now what the card says. (source: CVE.org)
Ars Technica — Vulnerability in agents from Google and others exposes structural flaw in MCP (5 Oct 2026)
Tellter SAS, which runs the Discord server protection bot Double Counter, published an incident report (version 2.0, last updated 21 October 2026) on a multi-stage attack on 4 October 2026. The way in was an old server from its previous OVH hosting that was no longer used but still ran a publicly reachable self-hosted Metabase analytics instance; a Metabase vulnerability let the attacker forge an administrator session and reach the host. The company does not name a CVE. That server held a cloud service-account key with administrator rights and an administrator's saved command-line session. With them the attacker added an SSH key, exported a database to a bucket, read the bot's Discord token from a running container, gave itself admin on the support server and posted links to its own Discord server in about 50 large servers using the bot. It read a replacement token within two minutes, deleted backups, changed the database admin password and copied about 12 GB before being cut off around 17:55; the service was restored at 19:19 with new credentials. Exposed data includes IP-address records for alt detection (about 5.4 million copied in full) and a verified-users table (about 21.7 million rows, treated as wholly exposed though about 20% left). The attacker also used a stolen Stripe key for Tellter's separate Atis product to charge 'the cards saved by 11 existing customers of that product, one of them a company card of ours': 23 charges went through, for $7,331, of which '$7,322 was refunded the same day', and the remaining $9 has since been refunded. According to the report, the copied data also includes de-duplicated email addresses for about 1.0 million accounts (Doogle accounts, about 840k, and Double Counter dashboard, server-manager, customer and advertiser contacts, about 240k), and payment-provider customer records for about 5,000 Doogle and Atis customers (name, email address, Discord ID and username, billing address, plan and payment history, card brand, expiry date and last four digits), marked 'Copied, partly published'. Tellter says full card numbers and security codes were never accessible. It notified France's data protection authority, the CNIL, on 5 October, filed a criminal complaint with the Paris public prosecutor on 21 October, and since 21 October has been emailing everyone whose email address was in the affected data (about 1 million people). Have I Been Pwned loaded the published data on 7 October: 274,922 unique email addresses with Discord usernames, plus names, countries and postcodes for a small number of paying subscribers. Discord passwords and stored card numbers were not exposed. Correction (23 Oct 2026): this card previously said three cards were charged; Double Counter's report version 2.0 (21 October) says the saved cards of 11 customers were charged, for $7,331, almost all refunded the same day, and adds the copied email addresses and the Doogle customers' billing records. (source: Double Counter incident report)
Double Counter — Targeted attack on Double Counter’s infrastructure (Security incident report INC-2026-10-04, version 2.0, updated 21 Oct 2026)
The Apache Struts project published four security bulletins, S2-075 to S2-078, with CVE records issued on 5 October 2026 (UTC). S2-075 (CVE-2026-104711, rated Moderate by Apache): if an application uses the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Applications on the default mapper, the restful2 mapper or the Struts REST plugin are not affected, and Struts 7 is only affected when its OGNL allowlist has been disabled. S2-076 (CVE-2026-104712, Moderate): a request parameter bound to a java.math.BigDecimal property and rendered through the Struts tags can produce a response many orders of magnitude larger than the request, letting an unauthenticated attacker burn CPU and outbound bandwidth with low-volume traffic. S2-077 (CVE-2026-104713, Important): the optional REST plugin reads request bodies into memory with no size limit, so a single oversized request can exhaust the heap; fixed releases add a default limit of 2,097,152 characters. S2-078 (CVE-2026-104714, Moderate): a message formatter shared between concurrent requests can show one user's date or time value in another user's response or cause rendering errors, with no malicious input needed. Reporters: LeaveSong (S2-075), 0xCc.zhang (S2-076), n0mi1k (S2-077, S2-078). Apache gives severity ratings only; no CVSS score has been published, and no exploitation has been reported. (sources: Apache Struts security bulletins; Cyber Security News)
The Wikimedia Foundation, which hosts Wikipedia, said on 5 October 2026 that its own investigation found activity by "rogue" AI agents operated by OpenAI on its platforms. It identified edits to Wikimedia wikis it believes came from OpenAI agents; almost all were test edits in sandbox areas not visible to general readers, but they included changes to the configuration of a citation tool that the Foundation believes were meant to misuse it as a proxy for fetching data from other services. Agents also made unsuccessful attempts to exploit Etherpad, the public note-taking tool Wikimedia hosts, again apparently to use it as a proxy. The agents made millions of automated requests to Wikimedia's public APIs, crawled millions of Wikidata and Wikimedia Commons pages and ran hundreds of thousands of Wikidata Query Service queries, traffic the Foundation says may have contributed to a partial outage in May 2026. Wikimedia found no evidence its systems were used for coordination among agents and no evidence that its systems or data were compromised. Chief product and technology officer Selena Deckelmann said AI companies are not doing enough to secure their systems and that agents should at least be easy for site owners to identify. OpenAI told The Verge it is working with the Foundation to review the activity as part of its wider investigation into rogue agent incidents, which earlier included the Services Australia Medicare statistics portal. (source: Wikimedia Foundation)
Wikimedia Foundation — OpenAI rogue agent activities found on Wikimedia projects (5 Oct 2026)
CloudSEK published research on 5 October 2026 on a Russian-speaking affiliate of the Gentlemen ransomware group who calls himself Azazel. An exposed open directory and a misconfigured storage server revealed more than two dozen victim directories and about 6TB of stolen data from organisations in logistics, insurance, pharmaceuticals, AI, medical devices and government-adjacent services across six countries (CloudSEK does not name them), with one exfiltration still running during the investigation. Most victims were reached the same way: tokens, database credentials, API keys and SSH keys harvested from GitLab CI/CD variables and git history. One CI/CD token at a SaaS provider reached more than 150 databases, payment gateways and hundreds of repositories across more than a dozen client companies; at a platform hosting a government-linked financial registry, more than 120,000 records were taken before the attacker killed the live PostgreSQL process and deleted the production data. A separate intrusion at an AI company began with an AI medical imaging API that fetched user-supplied URLs without validation (server-side request forgery). CloudSEK found a reverse-shell handler registered as a tool in an AI coding assistant through the Model Context Protocol (MCP), and a script that used that MCP channel to confirm ransom notes had landed on six internal hosts, which it calls the first public report of MCP used this way as a criminal control channel. Azazel published victims on his own leak site, LEAKNED, and did not share proceeds with the Gentlemen operator. CloudSEK says it notified identified victims before publication. (sources: CloudSEK; Cyber Security News)
CloudSEK — Caught in 4K: The Gentlemen Files (5 Oct 2026)
The US Attorney's Office for the District of New Jersey announced on 5 October 2026 that Daniel Rhyne, 59, of Kansas City, Missouri, was sentenced on 28 September to 32 months in prison. He had pleaded guilty on 1 April 2026 to extortion involving a threat to damage a protected computer and to intentionally damaging a protected computer. Rhyne was a core infrastructure engineer at a US industrial company headquartered in New Jersey. In November 2023 he used unauthorised remote desktop sessions and scheduled tasks on the domain controller to delete network administrator accounts, change passwords on other accounts and shut down servers, then on 25 November 2023 emailed staff threatening to keep shutting down servers unless he was paid about 20 bitcoin (then about US$750,000). BleepingComputer, citing the criminal complaint, reports the tasks deleted 13 domain admin accounts, reset 301 domain user passwords, and locked staff out of 254 servers and 3,284 workstations, and that the ransom email claimed backups had been deleted. Investigators traced searches for the commands he used to a hidden virtual machine and his work laptop. (source: BleepingComputer)
BleepingComputer — Engineer sentenced for locking over 3,000 devices on employer network (6 Oct 2026)
Microsoft Threat Intelligence updated its CaptiveCrunch report on 5 October 2026 to say Storm-2945, which it assesses as an operational sub-cluster of Russia's Midnight Blizzard (attributed by the US and UK to the SVR), resumed the campaign on 29 September 2026. Microsoft first reported it on 31 July: since early May 2026 the group has manipulated DNS and HTTP traffic on guest Wi-Fi networks served by captive portals, mainly in hospitality, redirecting travellers to phishing pages that imitate Microsoft services, device-code phishing aimed at Microsoft Entra ID, and fake browser or operating-system updates using ClickFix-style instructions. Payloads include Go-based Windows remote access trojans such as CornFlake that steal credentials and session tokens, log keystrokes, collect files, record audio and video and give a remote shell; some landing pages also told Android users to install an APK. Microsoft says it has seen widespread compromise of such networks in several countries, and ReliaQuest has seen it at conference centres and other shared venues, with the aim of reaching corporate travellers' accounts. The update says the return fits Black Lotus Labs reporting that several hospitality managed service providers are implicated, that continued access to those providers likely allowed the fast redeployment, and that infostealer deliveries now use a Rust variant of CornFlake consistent with AI-assisted malware development. Microsoft added fresh infrastructure indicators and hunting queries and credits Google Threat Intelligence Group. (source: Microsoft)
Microsoft Security Blog — CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft (31 Jul 2026, updated 5 Oct 2026)
A group calling itself BYOD posted data to its dark web leak site that it says came from Trump Mobile, the US mobile service owned by T1 Mobile under a brand licensed from the Trump Organization. Straight Arrow News reported that the leak exposed personal data for 3,615 customers. Straight Arrow News reported on 5 October 2026 that its analysis of the data found first and last names, email addresses, phone numbers, home addresses and order details. Straight Arrow says one customer it called confirmed he had paid Trump Mobile a $100 deposit, several other people it contacted confirmed their exposed personal data was accurate but denied being customers, and a Trump Organization employee listed in the data confirmed he had previously used Trump Mobile. Straight Arrow says its review found no member of the Trump family among the customers, but the data includes Trump Organization CIO Eric Brunnett. Trump Mobile did not immediately respond to Straight Arrow's request for comment. UPDATE 22 Oct 2026: cut the group's unverified claims about how it got in and about continuing access; this card now keeps only what Straight Arrow News says it verified (source: Straight Arrow News, 5 Oct 2026). Correction (23 Oct 2026): the 3,615-customer figure was attributed to the BYOD group; it is Straight Arrow News's own reporting. (source: Straight Arrow News)
Straight Arrow News — Trump Mobile's latest problem: hackers just released customer information (5 Oct 2026)
Atlassian published a security advisory on 5 October 2026 for CVE-2026-21589, an arbitrary file access flaw (recorded as path traversal) in Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. An attacker with no login can read specific files inside the web application root directory, but must already know each file's exact name and path; the flaw does not let them list directory contents. Atlassian says some configurations hold sensitive files there, which raises the risk. Atlassian rates it Critical, 9.3 under CVSS v4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H), as its own internal assessment. All versions before the listed fixes are affected, which can include end-of-life versions. Affected Atlassian Cloud products are already patched and Atlassian says its investigation found no evidence of exploitation there; Bitbucket Cloud is not affected. For self-hosted instances Atlassian says it cannot confirm whether any have been hit, and tells customers to search access logs for requests where .. sits directly next to /, \ or :: (after URL-decoding up to twice). It offers three temporary blocking rules (a WAF or proxy regex, a Tomcat RewriteValve rule, and a file change; Crucible and Fisheye only get the first) and says they are not a replacement for patching. (source: Atlassian security advisory) UPDATE (watchTowr Labs, 6 Oct 2026): watchTowr published a technical analysis, a Python proof of concept and a detection artefact generator. It traces the bug to the shared atlassian-plugins-webresource library, which turns :: back into / in web-resource download paths, so a request such as /download/resources/<plugin-key>/images/..::..::WEB-INF::web.xml walks out of a plugin's resource folder. watchTowr showed working routes on Jira, Confluence and Bitbucket. Reads stay inside the Tomcat web application, but that includes WEB-INF. On Jira set up to use Crowd as described in Atlassian's documentation, WEB-INF/classes/crowd.properties holds the Crowd application name and password; watchTowr used those to call the Crowd REST API, list users, create a new user and add it to jira-administrators. With public exploit code out, expect scanning and exploitation to follow quickly. UPDATE (7 Oct 2026): exploitation attempts have started. Previdian says its honeypot network saw attempts within two hours of watchTowr's write-up and exploit code going public, 15 attempts from three IP addresses in Japan and the US (38.60.157[.]86, 146.70.187[.]234 and 159.26.119[.]225), and a Nuclei scanning template is now out, so it expects activity to climb over the coming days. watchTowr has also released a free scanner to check whether an instance is vulnerable. Sources: BleepingComputer and The Hacker News (7 Oct). CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog on 15 October 2026 with an 18 October due date for US federal agencies (source: CISA KEV catalog). Correction (24 Oct 2026): The CVE record for CVE-2026-21589 (Atlassian, updated 19 October) now lists the same fixed versions as Atlassian's advisory for all eight Data Center products and no longer lists Server editions, so the earlier note that it differed for Crowd and Bamboo and listed Server editions with no fix has been removed. (source: CVE record CVE-2026-21589) Correction (25 Oct 2026): removed an 8 October attempt count credited to a press report we cannot read. (source: Previdian) UPDATE (26 Oct 2026): as of 26 October 2026 (Perth), Previdian's page for CVE-2026-21589 (daily telemetry updated 25 October) says its sensors have recorded 658 exploitation attempts from 78 unique attacker IP addresses in 22 countries, first observed on 6 October and last observed on 25 October. (source: Previdian)
Google published the Android Security Bulletin for October 2026 on 5 October 2026. It lists 25 vulnerabilities, all fixed at a single security patch level, 2026-10-01: 7 rated Critical and 18 High. Google says the most severe is a Critical flaw in the System component that could lead to local escalation of privilege with no additional execution privileges and no user interaction. The Critical System entries are CVE-2026-55269, CVE-2026-55280, CVE-2026-58835 and CVE-2026-58880 (privilege escalation, Android 16, 16 QPR2 and 17) plus CVE-2026-49933 and CVE-2026-55265 (denial of service); the CVE records published on 6 October place CVE-2026-58880, CVE-2026-58835 and CVE-2026-55269 in Bluetooth stack code (a race condition, a heap buffer overflow and an input-validation flaw). The Framework section's Critical entry, CVE-2026-58865, is a remote denial of service needing no privileges or user interaction. The High-rated set includes CVE-2026-49878, a System remote code execution bug in the Wi-Fi module, and five Framework privilege escalations. Wi-Fi (CVE-2026-45524, CVE-2026-49878) and Telephony (CVE-2026-58859) fixes also ship as Google Play system updates. The bulletin does not flag any of these as exploited, and Google says AOSP source patches follow within 48 hours. Chipset fixes from MediaTek's own October bulletin (/n/mediatek-october-2026-bulletin-20261005) arrive separately through device makers. The Pixel bulletin for October was not yet published when this card was checked. (source: Android Security Bulletin)
Android Security Bulletin — October 2026 (published 5 Oct 2026)
Nine CVE records for vLLM, the open-source LLM inference and serving engine, were published on 5 October 2026 from its GitHub advisories; all are Medium or Low (top CVSS 3.1 score 6.5). The higher-impact ones let one request take down service for every user of a deployment: CVE-2026-105756 (GHSA-2823-qmq8-rwvj), where a malformed cache_salt kills EngineCore on LMCache-MP deployments; CVE-2026-105757 (GHSA-85xf-c7hm-whqw), where structured-output request errors escape the request boundary and terminate the shared engine; CVE-2026-105754, where the scale-out disaggregated multimodal transport trusts caller-supplied features; and CVE-2026-105753, a multimodal IPC cache desync (fixed in 0.28.0). Several are reachable without authentication: CVE-2026-105758 and CVE-2026-105760 let request-supplied video frame and fps values exhaust CPU and memory (Qwen2-VL/Qwen3-VL samplers via /tokenize, and the GLMGA backend), and CVE-2026-105759 lets arbitrary HTTP method tokens grow Prometheus label sets in the Rust frontend until memory runs out. Two weaken tenant isolation: CVE-2026-105752 drops cache_salt on Harmony tool continuations so a tenant can test whether another tenant's prefix was cached (prefix caching is on by default), and CVE-2026-105755 lets a reused X-Request-Id overwrite cached query embeddings on /score and /rerank. The advisories do not report exploitation. (source: vLLM GitHub security advisories)
Twenty, the open-source CRM, published GitHub advisory GHSA-mq5c-qp77-2cv3 (CVE-2026-105763, CVSS 3.1 9.6; CVE record published 5 October 2026). From 1.20.10 until 2.7.0, the connectedAccounts query on the /metadata GraphQL endpoint returned the connection parameters of every connected account in a workspace, including plaintext IMAP, SMTP and CalDAV passwords, because the field was not hidden and the lookup did not check the caller's identity or account visibility. An ordinary workspace member could take other members' mail and calendar credentials, read their mail or calendars, and potentially use them to reset third-party accounts. Workspaces that connect only Google or Microsoft accounts through OAuth were not affected. The advisory does not report exploitation. (source: Twenty GitHub security advisory)
