Nine CVE records for vLLM, the open-source LLM inference and serving engine, were published on 5 October 2026 from its GitHub advisories; all are Medium or Low (top CVSS 3.1 score 6.5). The higher-impact ones let one request take down service for every user of a deployment: CVE-2026-105756 (GHSA-2823-qmq8-rwvj), where a malformed cache_salt kills EngineCore on LMCache-MP deployments; CVE-2026-105757 (GHSA-85xf-c7hm-whqw), where structured-output request errors escape the request boundary and terminate the shared engine; CVE-2026-105754, where the scale-out disaggregated multimodal transport trusts caller-supplied features; and CVE-2026-105753, a multimodal IPC cache desync (fixed in 0.28.0). Several are reachable without authentication: CVE-2026-105758 and CVE-2026-105760 let request-supplied video frame and fps values exhaust CPU and memory (Qwen2-VL/Qwen3-VL samplers via /tokenize, and the GLMGA backend), and CVE-2026-105759 lets arbitrary HTTP method tokens grow Prometheus label sets in the Rust frontend until memory runs out. Two weaken tenant isolation: CVE-2026-105752 drops cache_salt on Harmony tool continuations so a tenant can test whether another tenant's prefix was cached (prefix caching is on by default), and CVE-2026-105755 lets a reused X-Request-Id overwrite cached query embeddings on /score and /rerank. The advisories do not report exploitation. (source: vLLM GitHub security advisories)
Twenty, the open-source CRM, published GitHub advisory GHSA-mq5c-qp77-2cv3 (CVE-2026-105763, CVSS 3.1 9.6; CVE record published 5 October 2026). From 1.20.10 until 2.7.0, the connectedAccounts query on the /metadata GraphQL endpoint returned the connection parameters of every connected account in a workspace, including plaintext IMAP, SMTP and CalDAV passwords, because the field was not hidden and the lookup did not check the caller's identity or account visibility. An ordinary workspace member could take other members' mail and calendar credentials, read their mail or calendars, and potentially use them to reset third-party accounts. Workspaces that connect only Google or Microsoft accounts through OAuth were not affected. The advisory does not report exploitation. (source: Twenty GitHub security advisory)
CVE records published 5 October 2026 cover Langflow GitHub advisories on its Model Context Protocol (MCP) support. GHSA-w794-rj3p-xv45 (CVE-2026-105697, CVSS 3.1 9.9) and GHSA-7w94-79vh-5mr2 (CVE-2026-105740, 9.9) describe the same core flaw: when a user adds an MCP server with the stdio transport, or builds a flow with the MCP Tools component, Langflow launched the supplied command and arguments with no allowlist, wrapped in bash -c, so the command runs on the Langflow host as the Langflow process user as soon as Langflow connects to that server, even if the UI then says the server failed to start. The advisory notes that with the default LANGFLOW_AUTO_LOGIN=true, the auto-login endpoint hands out a token without credentials, so an exposed instance on the default setting can be exploited without an account; with auto-login off, any authenticated non-admin user can do it. The fix came in two steps: 1.9.0 added a command allowlist and argument/environment checks to the Add MCP Server API, and 1.10.3 applied the same policy at the point where the process is spawned (covering configs embedded in flows and tweaks) and removed the bash wrapper. A third advisory, GHSA-4f6c-2vvp-gw82 (CVE-2026-105741, 7.1), lets an authenticated user bypass the local-only check on the MCP config install endpoint by sending X-Forwarded-For: 127.0.0.1 and write an MCP client config file on the server (1.5.0 to before 1.10.3). The advisories themselves do not report exploitation. (sources: Langflow GitHub security advisories; CVE records) UPDATE 15 October: honeypot operator Previdian says its sensors have recorded 1,423 exploitation attempts against CVE-2026-105740 since 19 September 2026 from 27 attacker IP addresses in 15 countries, rising from 11 October (333 attempts that day) and still running on 15 October (66 by the time The Hacker News reported it). Previdian rates the exploitation as confirmed.
Langflow GHSA-w794-rj3p-xv45 — OS command injection via MCP stdio server configuration (CVE-2026-105697)
Ten CVE records for Docling, the open-source document conversion library widely used to feed PDFs and office files into RAG and other generative AI pipelines, were published on 5 October 2026 from its GitHub advisories. The most serious, CVE-2026-105744 (GHSA-x3q2-h9hx-4r4j, CVSS 3.1 7.5), affects callers that opt into the Tectonic engine for TikZ in LaTeX input (2.94.0 to before 2.132.0): crafted input can read files the converter can access and create or overwrite writable files, and turning on the shell-escape option also allows shell commands; the default configuration is not affected. CVE-2026-105751 (GHSA-4xhp-xg4w-8ppm, CVSS 4.0 6.9) lets an OpenDocument file's draw:image reference read local files that decode as images into the converted output (2.107.0 to before 2.120.3). Others cover an SSRF guard that can be bypassed with DNS rebinding or mixed address records when remote fetching is enabled (CVE-2026-105743), enable_local_fetch not enforced in HTML browser-rendering mode (CVE-2026-105750), plugin entry points imported before the allow_external_plugins check (CVE-2026-105745), configured HTTP headers sent to every remote image host (CVE-2026-105742), local images embedded via crafted DoclingDocument JSON (CVE-2026-105748), CPU or memory exhaustion from oversized tables or archives (CVE-2026-105747, CVE-2026-105749), and a KServe OCR remote-services setting not enforced (CVE-2026-105746). The advisories do not report exploitation. (source: Docling GitHub security advisories)
Docling GHSA-x3q2-h9hx-4r4j — file read/write via untrusted TikZ with opt-in Tectonic engine (CVE-2026-105744)
Two CVE records for Dify, the open-source LLM app development platform from LangGenius, were published on 5 October 2026 from its GitHub advisories. GHSA-8235-vv5j-mmvg (CVE-2026-105762, CVSS 3.1 8.3): before 1.13.0, the /console/api/remote-files/upload endpoint took an attacker-supplied URL without authentication and made the Dify server fetch it, so a remote attacker could use the server to send requests to internal services or cloud metadata endpoints and as a network pivot. GHSA-ccrj-frp2-c945 (CVE-2026-105761, 7.1): before 1.16.0, the PUT endpoint for an app's MCP server looked up the server by a client-supplied ID without checking that it belonged to that app and tenant, so an authenticated workspace member could change another app's MCP server status and settings, potentially redirecting data or disabling the service. The advisories do not report exploitation. (sources: Dify GitHub security advisories; CVE records)
Dify GHSA-8235-vv5j-mmvg — Unauthenticated SSRF in /console/api/remote-files/upload (CVE-2026-105762)
OpenAI said on 5 October 2026 how it will meet the EU AI Act requirement that generated text be machine-identifiable. Over the coming weeks it will add an invisible watermark, called textGrain, to eligible ChatGPT and Codex text output for users in the European Union across all plans; it is not a global default at launch. From 5 October, API customers anywhere can opt in to watermarked output for selected models, but it stays off by default in the API. textGrain nudges how the model samples between possible words so a keyed statistical pattern runs through a passage; it adds no hidden characters or odd spacing, and detection needs the passage plus OpenAI's secret key. Access to the detector starts with approved researchers and expert organisations only. OpenAI is candid about limits: in its 400-token tests, replacing 10% of words with synonyms cut detection from about 92% to 66%, and 25% replacement cut it to 17%; short, translated or heavily edited text may not be detected, and maths answers watermark poorly. A detected watermark does not identify the user, account or prompt, does not measure human contribution, and the absence of one does not prove human authorship. OpenAI says it plans to open-source textGrain. (sources: OpenAI post; BleepingComputer)
OpenAI — Our approach to EU text provenance rules (5 Oct 2026)
MediaTek published its October 2026 Product Security Bulletin on 5 October 2026, covering 31 vulnerabilities in its smartphone, tablet, IoT and automotive chipsets: 2 Critical, 9 High and 20 Medium. The two Critical bugs, CVE-2026-20519 and CVE-2026-20520, are out-of-bounds writes in the modem firmware caused by missing bounds checks; the CVE records say a device that connects to a rogue base station controlled by an attacker could suffer remote escalation of privilege with no user interaction and no extra execution privileges. Both affect a long list of 4G/5G modem chipsets (including the MT68xx and MT69xx Dimensity families and MT87xx/MT88xx parts) and were found internally. The High-rated issues include more modem out-of-bounds writes (for example CVE-2026-20526, which needs user interaction), out-of-bounds writes in the video decoder and encoder (CVE-2026-20586, CVE-2026-20589), a stack overflow in the Video HAL (CVE-2026-20521), and flaws in the NeuroPilot and APU AI-accelerator components. MediaTek says device makers received the patches at least two months before publication and that it is not aware of active exploitation. End users get the fixes only through their phone or tablet maker's security update, which often lands with or after the matching Android monthly patch.
MediaTek — Product Security Bulletin, October 2026 (published 5 Oct 2026)
Fortbridge published a working exploit chain on 5 October 2026 that turns an ordinary WordPress Media Library upload into code execution on the web server. WordPress hands uploaded HEIC images to ImageMagick, which decodes them with libheif. The chain first uses the derived-item and pixel-plane out-of-bounds read in libheif advisory GHSA-2jg2-4ch7-h545 (fixed in 1.23.2) to leak library and heap addresses through the JPEG thumbnails WordPress generates, then triggers the heap overflow in GHSA-x8r2-mggj-j6wr, a flaw in libheif's uncompressed (unci) decoder when the two chroma channels declare different bit depths, to hijack a C++ virtual call and run commands as the www-data PHP-FPM account. It needs a logged-in user with the upload_files capability (Author or higher by default); Fortbridge did not test guest uploads and validated it only on two exact Ubuntu and Debian stacks (6 of 8 and 22 of 24 runs succeeded). The libheif advisory, credited to Alex Thomas of Wordfence working with an agentic AI assessment framework, rates the overflow Critical (CVSS 3.1 9.8) and has no CVE yet. This is lab research, not an observed campaign. (source: Cyber Security News)
Fortbridge — WordPress libheif RCE research (5 Oct 2026)
Google has temporarily stopped accepting product vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP), which covers Google-maintained open-source projects such as Go, Angular, Bazel, Protocol Buffers and Fuchsia. Google says the pause is due to a significant rise in automated submissions, the vast majority of which are not valid. OSS VRP supply-chain reports (for example repository settings, GitHub Actions and access-control issues) and reports already in progress are not affected, and product vulnerabilities submitted before 1 October 2026 are still handled. Researchers can still use the Patch Rewards Program (up to US$15,000 for high-impact fixes) and the Cloud VRP for Google Cloud open-source repositories. Google says it will rework the programme and give an update in Q1 2027. Context from BleepingComputer: the OSS VRP launched in August 2022 with rewards from US$100 to US$31,337; curl ended its HackerOne bounty in January and Intel removed bounty payments in mid-September, both amid low-quality AI-generated reports. (source: BleepingComputer)
Google Bug Hunters — Open Source Software VRP rules (pause notice)
Denmark's Central Person Register (CPR) administration announced on 5 October 2026 that it had found a serious security incident: by misusing a Danish company's lawful access to search the CPR system, unauthorised parties obtained names, addresses, CPR (personal identity) numbers and other details for about 8.8 million people registered in CPR. The CPR administration says its review shows the unauthorised access does not include the names and addresses of people registered with name and address protection. It has stopped the company's access and is working with specialists and authorities to map what happened; it has reported the incident to the Danish Data Protection Agency (Datatilsynet), and police are investigating with the relevant authorities. The company, the attackers and how many records were actually extracted have not been named. Separate from the DTU incident on Cyberstack. CORRECTION (21 Oct 2026): a 12 October update naming the company whose access was abused, its owner and passwords used on its accounts has been removed until we can link a readable primary source for it. Correction (26 Oct 2026): a line quoting minister Christina Egelund to Ritzau on how long the access ran and an unlinked Cybersecurity News report credit have been removed, because no linked source carries them. (source: CPR administration) Correction (26 Oct 2026): the Ministry of Higher Education, Research and Digitalisation's press release link now redirects to the ministry's home page and can no longer be read, so it has been removed and the card now rests on the CPR administration's own notice (5 Oct 2026). Details that only the ministry's release gave have been removed: that the ministry co-announced the incident, that CPR staff noticed irregular activity on Friday 2 October covering a period in September, the briefing of the parliamentary digitalisation committee, the ordered security review of CPR, the explanation of why the figure exceeds Denmark's population, and the authorities' warning about passwords and codes. (source: CPR administration)
CPR administration — Omfattende uautoriseret adgang til borgeres CPR-oplysninger (5 Oct 2026, Danish)
AhsayCBS is the central management console for Ahsay's cloud backup software, used mainly by managed service providers (MSPs) and system integrators. Two flaws were published on 4 October 2026 (CNA VulDB, with public exploit code): CVE-2026-105133, an authentication bypass in the checkSysPwd function of the API (CVSS 3.1 7.3), and CVE-2026-105134, an OS command injection in the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do (CVSS 3.1 10.0, CVSS 4.0 9.3), where a random token can stand in for valid credentials. The CVE records list versions up to 10.3.2 and point to 10.3.4 as the fix, but Huntress said on 8 October that 10.3.4 is also vulnerable and that it has told Ahsay. Huntress first saw exploitation at 23:20 UTC on 7 October and had seen five organisations targeted by 8 October: attackers chained the two bugs to run code as NT AUTHORITY\SYSTEM, set up a malicious replication receiver, dropped a JSP webshell into the CBS web directory, ran reconnaissance, installed XMRig cryptominers disguised as Microsoft Edge, kept them running with a renamed NSSM service posing as Edge Update, loaded the vulnerable WinRing0x64.sys driver, and added an apparently AI-written PowerShell script that closes Task Manager if it stays open overnight. (sources: Huntress; SecurityWeek) UPDATE 14–15 October: Ahsay published an updated critical security alert saying its earlier patches, v9.15.2.59 and v10.3.4.0, did not fully fix CVE-2026-105133 and CVE-2026-105134. Partners on v10 should apply the AhsayCBS v10.3.4.45 hotfix and partners on v7, v8 or v9 the v9.15.2.70 hotfix (both behind the partner portal), then reboot the server. Huntress says it independently verified that 10.3.4.45 blocks the initial entry point of the attack chain. CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on 14 October with a 17 October deadline for US federal agencies.
Huntress — Threat actors exploit critical AhsayCBS flaws to drop webshells and XMRig cryptominer (8 Oct 2026, updated 8 Oct 6pm ET)
Nikkei Inc., the Japanese media group that owns the Financial Times, said on 4 October 2026 (English notice 5 October) that a Microsoft 365 account used by one of its employees was accessed by a third party and used on 30 September to send about 9,000 spoofed emails with links to malicious websites, to staff and to news sources and others who had been in contact with several Nikkei employees. Nikkei believes recipients' names and email addresses and the content of some emails were exposed. It changed the account password, has seen no unauthorised logins since, asked recipients to delete the emails, reported the incident to Japan's Personal Information Protection Commission and is still working out the scope and the number of records involved. Group company Nikkei BP said separately on 4 October that one of its employees handed over login details to a phishing email that came from a Nikkei staff address, exposing 26 names and email addresses. Updated 6 Oct 2026: BleepingComputer (5:25 pm Perth) reports Nikkei also disclosed that an employee's Google Workspace account was accessed in late July, exposing names and email addresses of 1,646 employees and business partners but not reader or interviewee data, which Nikkei found in early August after a Google notification. (source: BleepingComputer) No attacker has been named and Nikkei has not said whether the incidents are connected. (source: Nikkei Inc. notice)
Nikkei Inc. — Regarding information leaks and the sending of suspicious emails due to a cyberattack (5 Oct 2026; Japanese notice 4 Oct)
