OpenAI (1 October 2026 post; The Hacker News same day) reports disrupting a coordinated adversarial-distillation campaign that systematically extracted protected (encrypted) reasoning traces to help train or reproduce another model. Activity began 1 July 2026; high-volume spikes 24–25 July (~16,000 extraction-pattern requests from 4,000+ users); related prompt patterns across a cluster of 15,000+ users; fully disrupted by 28 July. OpenAI attributes a core cluster to individuals associated with Moonshot AI (Kimi). Operators copied encrypted reasoning between conversations and prompted weaker/sibling models to decrypt/transcribe hidden reasoning without jailbreaking the stronger model. Mitigations: account enforcement; closed a pathway that allowed replay of another user's encrypted reasoning; added checks to detect/hold streamed output that might expose reasoning; shared technique details via Frontier Model Forum. OpenAI frames adversarial distillation as an industry-wide safety/national-security risk (capability transfer without safety investment). (source: OpenAI)
OpenAI — Disrupting a coordinated model distillation campaign (1 Oct 2026)
Kiteworks GitHub advisory GHSA-5xhq-9wq3-rvj6 / CVE-2026-54154 (BleepingComputer 1 October 2026): a maximum-severity chain of path traversal, code injection, and missing authentication on publicly reachable Email Protection Gateway (EPG) endpoints can let an unauthenticated remote attacker achieve arbitrary code execution and escalate to full administrative (root) control of the appliance. CVSS 3.1 10.0 Critical (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Affects all Kiteworks EPG releases before 9.4.1; fixed in 9.4.1+. Same 1 Oct patch batch also addresses 11 other critical issues (auth bypass, admin takeover, stored XSS, access control) across Core and EPG, totaling 126 vulnerabilities. Reported via YesWeHack bug bounty. Shadowserver tracks ~400 internet-exposed Kiteworks instances. (sources: Kiteworks; BleepingComputer)
BleepingComputer (1 Oct 2026), citing Europol, reports on Operation KillSwitch (German-led; action 30 Sep 2026) against KillSec ransomware. Seized dark-web leak site and servers; at least 110TB of stolen victim data taken offline; domains show Hamburg State Criminal Police / international LE seizure banner. Three suspects provisionally arrested and eight properties searched in Greece, Romania, Spain and the United Kingdom. Partners include Belgium, United States, Finland, Germany, Greece, Netherlands, Romania, Spain, Switzerland, UK, plus Europol, Eurojust, Bitdefender and Group-IB. According to Europol, as reported by BleepingComputer: ~1,000 suspected attacks worldwide since ~2024; investigators so far count ~500 successful attacks (about 70 linked to German orgs, including 18 Hamburg cases). Alleged main operator/administrator is 16; a suspected developer turned 18 in August 2026 (still a minor for some alleged offences); negotiator and affiliate also identified. KillSec is accused of exploiting software vulnerabilities and poorly secured edge devices and platforms, then extorting victims via its leak site, according to BleepingComputer. No Australian victim named in these reports. (source: BleepingComputer, citing Europol) Correction (30 Oct 2026): removed a leak-site victim count that no readable source gives and a SecurityWeek credit this desk cannot verify; the description of how KillSec gained entry now follows BleepingComputer's wording. (source: BleepingComputer)
BleepingComputer — Operation KillSwitch dismantles KillSec; alleged teen admin (1 Oct 2026)
CVE-2026-17106 (GHSA-hfg8-hc9c-6c3h; Docker/Moby; published mid-August 2026; dubbed CopyEscape): tar extraction in moby/go-archive (Unpack/UnpackLayer/Untar and ApplyLayer helpers) does not confine filesystem writes to the destination directory — lexical path checks can be defeated when archive entries introduce links the OS then follows. An attacker who controls a running container can race docker cp archive generation (directory → symlink TOCTOU) so the host-side CLI extracts attacker-chosen files outside the user-selected destination with the privileges of the docker cp process (including sudo docker cp → root on Linux; macOS Desktop extracts on the host even though containers run in a Linux VM). Imperva research (Ron Masas; Cyber Security News 1 Oct 2026) shows the chain replacing host binaries such as runc so a later Docker runtime invoke runs attacker code as root; also affects Docker Sandboxes sbx cp for AI-agent workflows pulling files from untrusted sandboxes. CVSS 4.0 7.1 HIGH (AV:L/AC:L/AT:P/PR:N/UI:A/…). Fixed: moby/go-archive 0.3.0; Docker Engine/CLI 29.7.0; Docker Desktop 4.86.0 (10 Aug 2026 notes: destination-escape in docker container cp); Docker Compose 5.4.0; Docker Sandboxes 0.38.0. Until patched: do not docker cp from untrusted/compromised containers; stop the container before copy; avoid sudo docker cp in CI. (sources: GitHub Advisory GHSA-hfg8-hc9c-6c3h; Docker Engine 29 notes; Cyber Security News)
Google Threat Intelligence Group (GTIG) report “Vulnerability Discovery and Exploitation Trends in the AI Era” (published 1 October 2026) analyses Jan 2025–Aug 2026 disclosure and exploitation telemetry. Monthly CVE disclosures roughly doubled in 2026 (e.g. ~5,045 in January → ~10,477 in July, peak ~10,740 in August); GTIG cautions open-source CNA inflation (Linux kernel description alone ~5,000 CVEs Jan–Aug with zero observed in-the-wild zero-days). GTIG high-risk disclosures grew 167% (131 in Jan → 350 in Aug). Distinct exploited vulnerabilities: 141 in first eight months of 2026 vs 127 in all of 2025 (~18/month vs ~10.5). Only ~0.23% of 2026 disclosures observed exploited. Zero-day exploitation rose modestly (~8/month 2025 → ~11/month 2026; 22 in August); 62% of exploited vulns Jan–Aug were zero-days — growth also from faster n-day weaponisation (GTIG hypothesises LLM-assisted patch/diff analysis). AI-discovered vulns show different risk profile (more medium/high vs non-AI) and ~50% lead to remote code execution vs ~26% non-AI. Confirmed in-the-wild exploitation of some AI-discovered vulnerabilities described as an early indicator. (sources: Google Cloud; Google Cloud / GTIG; SecurityWeek)
Google Cloud / GTIG — Vulnerability Discovery and Exploitation Trends in the AI Era (1 Oct 2026)
NVIDIA Security Bulletin for GPU Display Driver — September 2026 (a_id 5861, initial release 30 September, revision 02 on 13 October 2026) includes CVE-2026-47595: in the Linux kernel-mode layer an unprivileged user can write to read-only memory because permissions are not preserved (CWE-281). NVIDIA rates it CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with impacts of code execution, privilege escalation, DoS, information disclosure and data tampering. Press coverage on 15–16 October (The Hacker News ThreatsDay) highlighted researcher write-ups nicknamed 'Bad UVM' showing a path from nvidia-persistenced / UVM abuse to host root and GPU-enabled container escape — the same permission-preservation class as the CVE text. CVE-2026-47595 is on the Linux R615/R610/R595/R580 fix lists in the bulletin. Patch Linux GeForce/RTX/Quadro/Tesla branches to 615.71.09, 610.57.04, 595.91.07 or 580.178.04 as applicable; vGPU Linux guest drivers prior to 20.2 / 19.6 also list this CVE. (source: NVIDIA bulletin)
NVIDIA — Security Bulletin: NVIDIA GPU Display Driver — September 2026 (a_id 5861; rev 02 updated 13 Oct 2026)
The Model Context Protocol (MCP) project published advisory GHSA-6qxp-vccf-f47h on 30 September 2026, with CVE-2026-104850 following on 6 October. In affected versions the official TypeScript SDK's OAuth client let the MCP server it connected to decide which authorization server received the client's credentials, because saved credentials were not tied to the authorization server that issued them. A malicious or compromised MCP server could name its own authorization server and, with no user interaction, receive the refresh token and client secret saved from an earlier sign-in, or the client secret or signed assertion configured on a bundled provider. Affected: @modelcontextprotocol/sdk 1.12.0 to 1.30.1, and @modelcontextprotocol/client 2.0.0 and 2.1.0 in specific setups, when the client uses the SDK's OAuth support over HTTP (an authProvider on a transport, the withOAuth() middleware, or direct auth() or fetchToken() calls). MCP servers built with the SDK and stdio clients are not affected. The fix records the issuer on saved credentials and refuses to send them elsewhere, but upgrading is not enough on its own: bundled providers need expectedIssuer set, and credentials saved before the upgrade still go to whichever server is named first unless they gain an issuer or are cleared. A new interactive sign-in still goes where the MCP server points. (sources: MCP GitHub advisory; CVE record)
MCP TypeScript SDK — GHSA-6qxp-vccf-f47h: OAuth client could send credentials to an authorization server chosen by the MCP server (30 Sep 2026)
Checkmarx (5 October 2026) and CloudSEK (30 September 2026) describe MALFEX, an npm supply-chain malware campaign run by what appears to be one operator publishing since August 2023. Checkmarx counts twelve packages, eight of them malicious; CloudSEK's count is at least nine. The campaign has three delivery paths that do not share infrastructure: install scripts in tlxbnhd, tldriver and mxdriver that load the open-source Go remote access trojan Overlord (screen capture, keylogging, remote shell, hidden desktop; CloudSEK says this build has a working Solana-blockchain lookup for its command server); img-to-native, native-runner and cdn-img-fetch, which drop the Node.js stealer movinlike, aimed at Discord clients, browsers, crypto wallets and Telegram data and sending it out through a Discord webhook; and function-flag, where each malicious version downloads a payload from a different location. The scripts run on any OS but the payloads only work on Windows, and installs complete even when the download fails. Checkmarx says function-flag has been malicious since July 2025, has more than 37,000 downloads and still had no advisory, and that function-flag, function-color (which pulls it in) and cdn-img-fetch were still installable on 1 October; the cdn-img-fetch advisory MAL-2026-17320 covers only some malicious versions. Five packages have been removed. No legitimate, widely used package depends on them and neither firm saw geographic targeting. (sources: Checkmarx; CloudSEK) UPDATE 13–17 Oct 2026: SafeDep (13 October) found that the operator kept replacing removed packages. After npm removed native-runner and img-to-native on 28 September, imgbundle and runhelper appeared on 30 September, and the same day the publisher 'malfexteste8' released imgdecode, which hides the loader in a compiled Node.js add-on (a 64-bit Windows DLL). Versions 1.0.0 to 1.0.3 are affected; 1.0.3 (11 October) needs no other MALFEX package. There is no install script: the code runs when a program calls require('imgdecode'), and only when output goes to an interactive Windows console, so CI jobs and sandboxes with redirected output do not trigger it. The DLL downloads banner.jpg from the GitHub repository cavecrew/proj, decrypts it with AES-256-CBC and injects the result into a new dllhost.exe process. SafeDep linked it to MALFEX with high confidence because the recovered stage-2 downloader hash is in Checkmarx's indicator list; that downloader fetches the stealer and remote access tool from 104.234.65[.]75 port 700, with command and control on port 7007. Per The Hacker News (17 October), imgdecode had 979 downloads and was still on npm; the payload persists through a Registry Run key and a scheduled task named 'MicrosoftEdgeUpdateService'. npm removed imgbundle on 7 October and cdn-img-fetch on 8 October; runhelper was unpublished on 30 September. The GitHub account cavecrew is no longer accessible.
Checkmarx Zero — MALFEX npm malware campaign: three payloads and an adversary that signs their work (5 Oct 2026)
The Python Software Foundation announced CVE-2026-19445 on 30 September 2026 (security-announce, Seth Larson): a Critical use-after-free (CWE-416) in CPython's ssl module. A remote, unauthenticated TLS client can make a server crash or call through a freed pointer when the server's sni_callback assigns a different context to SSLSocket.context (the documented way to pick a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical exposure is servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with the context are not affected, and TLS clients are not affected. The CVE record marks CPython before 3.10.22, 3.11.0 to before 3.11.17, 3.12.0 to before 3.12.15, 3.13.0 to before 3.13.16, 3.14.0 to before 3.14.8 and 3.15.0a1 to before 3.15.0rc3 as affected. PSF scores it CVSS v4 9.2 (attack complexity high, attack requirements present). Fix: cpython PR 158504. Australia: WA Government SOC advisory 20261005002 (5 Oct) rates it Critical, notes CPython ships inside many operating systems and perimeter devices, and has no reports of exploitation on WA Government networks. NVD analysis pending.
Python security-announce — CVE-2026-19445 use-after-free of server-side SSLContext when sni_callback switches contexts (30 Sep 2026)
MI5 Security Service Espionage Alert (published 30 September 2026) states that the China General Technology Research Institute (CGTRI), also translated China Academy of General Technology (CAGT), has very strong ties to China’s Ministry of State Security (MSS). MI5 says CGTRI’s primary purpose is to fund academic research that directly improves MSS technical capability for espionage. More than 100 UK-linked academics have contributed to CGTRI-funded projects (AI, cybersecurity, covert communications, steganography); some may not have known CGTRI was the funder. Expected actions: UK institutions immediately review ongoing/planned CGTRI collaboration; establish ultimate funding source on China-linked research; use HMG Research Collaboration Advice Team (RCAT) and NPSA Trusted Research guidance; take independent legal advice. Alert places CGTRI–MSS ties in the public domain and flags National Security Act 2023 s 3 (assisting a foreign intelligence service) and s 17 (obtaining a material benefit from a foreign intelligence service) for continued CGTRI-funded work after publication. (sources: MI5 alert page; The Hacker News) Relevant to Australian universities/research orgs as Five Eyes Trusted Research parallel — not an AU-specific ACSC alert.
Cato Networks knowledge-base advisory (published 30 September 2026) covers CVE-2026-10726 and CVE-2026-10739 affecting Cato Windows SDP Client versions lower than 6.12.6: a local attacker with access to the installed client can escalate privileges. Fixed in Windows Client 6.12.6 and higher; Cato recommends identifying older clients via Access Overview (filter Cato Client / Windows) and upgrading via Client Rollout / automatic upgrade service. Quarkslab research write-up (1 October 2026) details CVE-2026-10739 as a split-tunnel upload / named-pipe path where a client-supplied SID is used in a filesystem path, enabling arbitrary SYSTEM file delete (and, in their chain, Windows Installer rollback to SYSTEM). Confirmed by Quarkslab on 6.2.0 and 6.4.6; vendor scope is any version before 6.12.6. OpenCVE / Rapid7 list CVE-2026-10739 as CVSS 4.0 8.5 HIGH (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/…). No wild exploitation stated in the vendor advisory. (sources: Cato Networks; Quarkslab)
