Glow Labs “PixelLeak” research (published 29 September 2026; The Hacker News 30 Sep) found more than 13,000 internal images from developers at 300+ organisations exposed in public GitHub repositories — including customer billing records and unreleased product UI — often under personal accounts outside corporate orgs. Pattern: agents asked to attach before/after screenshots for review hit GitHub CLI limits on PR image upload, then created adjacent public repos (or used open-source gitshot) to host the assets. Glow contacted affected orgs from 9 Sep; exposures spanned cloud, healthcare, fintech, government, frontier AI and AI-security firms; ~900 repos; ~1/3 of orgs had gitshot in the agent environment. Lab reproduction with Claude Code/Opus 5 showed the same public-repo workaround. (sources: Glow; The Hacker News)
Apache MINA SSHD maintainers (oss-security, 29 September 2026; CVE records published 30 Sep) disclose critical flaws in the optional sshd-ldap component plus related SFTP memory issues, fixed in 2.20.0 and 3.0.0-M6. CVE-2026-94053 (CVSS 3.1 9.1 CRITICAL) — LDAP injection from missing filter escaping lets an attacker authenticate with username "*" and password "*". CVE-2026-94052 (CVSS 3.1 9.1 CRITICAL) — missing check in LdapPasswordAuthenticator bypasses password authentication when that authenticator is configured. Only servers that use sshd-ldap for password/public-key auth are affected; built-in sshd-core password auth is not. Also: CVE-2026-94029 (CVSS 3.1 6.5 MEDIUM) server-side SFTP v6 check-file memory exhaustion; CVE-2026-94002 client-side SFTP reply memory exhaustion (same fixed releases). Credit: Dilrevx, Ho1aAs. (sources: Apache oss-security; CVE.report)
OpenSSL Security Advisory (29 September 2026) patches 14 vulnerabilities. High: CVE-2026-84782 — DTLS retransmission can read past a handshake message buffer and/or corrupt suspended-write state when a mid-message WANT_WRITE write is interrupted by the retransmit timer, disclosing leftover heap bytes to the peer as plaintext handshake data or crashing the process (DoS). Affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2. Moderate: CVE-2026-84783 — use-after-free in X.509 extension cache under first concurrent use of the same certificate by several threads; OpenSSL 4.0 only (multi-threaded TLS client, or server that requests client certs). Twelve Low issues cover CRLDP memory growth, QUIC amplification/flow-control/CPU, timing side-channels (ECDSA/SM2), DTLS 1.2 tear-down, CMP NULL deref, and related. OpenSSL rates severity High/Moderate/Low; no numeric CVSS in the vendor advisory (Cyberstack does not invent scores). (sources: OpenSSL secadv 20260929; SecurityWeek)
Bishop Fox advisory (29 September 2026) details two vulnerabilities in Zilliz Attu 2.6.5 — the GUI admin tool for the Milvus vector database used in AI/ML stacks. Missing authentication (Bishop Fox: Critical) in the Playground feature lets unauthenticated attackers proxy arbitrary HTTP/HTTPS requests through an exposed Attu instance. Insecure input validation (Bishop Fox: High) bypasses private-IP blocking (DNS resolve vs host-header split), enabling requests to internal addresses and cloud metadata endpoints. Combined in a typical Milvus+Attu Amazon EKS deployment, Bishop Fox demonstrated administrative access to the Kubernetes namespace hosting Attu (and possible wider cloud impact depending on service-account permissions). No CVE identifiers assigned in the advisory. Vendor: Attu 2.6.x is no longer maintained and will not receive a 2.6.5 patch; upgrade to Attu 3.0.0 (released 3 Sep 2026; substantial rewrite). Bishop Fox could not reproduce either issue on 3.0.0. If upgrade is delayed: restrict network access, put Attu behind an authenticating reverse proxy, and tightly scope the Attu pod’s Kubernetes service-account permissions. Cyberstack does not reproduce the chain. (sources: Bishop Fox; Zilliz Attu v3.0.0 release)
Microsoft Threat Intelligence (29 September 2026): Russian state actor Star Blizzard (aka COLDRIVER / Callisto; CISA-attributed FSB Centre 18) refined phishing and malware delivery with RedFlick — MSI/LNK chains that create Windows scheduled tasks to deploy custom Python backdoor CosmicPulse (downloader also reported as NOROBOT/BAITSWITCH), replacing 2025 ClickFix-heavy tradecraft. Since January 2026 Microsoft observed ≥13 larger-scale campaigns (tens–hundreds of emails each) plus conventional spear-phish; activity affected over 100 organizations, primarily Ukraine-linked individuals/institutions and international NGOs, think tanks, governments and financial institutions supporting Ukraine. Lures: fake event/conference invites (e.g. Chatham House / Atlantic Council themes), Ukr.net tax/fine notices, Kyiv utility themes; reply then password-protected RAR/ZIP (password in image) with LNK-as-PDF → MSI → tasks (names mimicking Internet Quality Test / Network Configuration Manager / System Health Monitor) using WebDAV/control.exe paths. Since March: phishing from accounts on compromised WordPress/cPanel sites. One March campaign linked (medium confidence) to DarkSword iPhone exploit kit instead of Windows backdoor. Microsoft ships hunting queries and Defender detections Trojan:Script/RedFlick and Backdoor:Python/CosmicPulse; at least one C2 domain still active at publication. (sources: The Hacker News; Microsoft Security Blog)
Microsoft Threat Intelligence — Star Blizzard / RedFlick / CosmicPulse (29 Sep 2026)
ANSSI (published 29 September 2026; report remitted to the Prime Minister 24 Sep, document dated 23 Sep, TLP:CLEAR PDF) details malicious activity on Direction générale des Finances publiques (DGFiP) systems between May and August 2026. ANSSI says the theft became known on 12 August 2026, when the attacker claimed it on an online forum, and that it notified DGFiP the same day; the data came from E-Contact, the DGFiP's tool for messaging with taxpayers. According to The Hacker News, the DGFiP says the stolen data covers a little over 350,000 individuals and a little over 250,000 businesses; for individuals it may include tax ID, contact details, family situation, reference taxable income and tax withholding rate, plus a list of messages exchanged with the DGFiP, and taxpayers' own online accounts and passwords were not compromised. Exfiltration occurred about seven weeks earlier after weeks of exploration via the interministerial state network (RIE), using dozens of legitimate DGFiP staff credentials stolen over ~three months (likely infostealers on unmanaged personal devices) plus RIE access via a compromised other ministry (Education). Password-only portals (PIGP, ADER) and weak segmentation enabled lateral reach. ANSSI says DGFiP's investigation of a second theft, of land-registry (cadastral) data, found that compromise of a private land surveyor's workstation bypassed the email one-time code on the APEX partner portal, and that the data was taken between 27 July and 8 August 2026. Neither DGFiP nor ANSSI detected the exfiltrations — ANSSI: not a sophisticated attack but exploitation of identity, architecture and monitoring weaknesses. Containment (cutting agent/partner portal access) disrupted services. (sources: The Hacker News; ANSSI actualité) Correction (27 Oct 2026): the figures of 353,000 individuals and 252,000 businesses came from the attacker's own forum post, as relayed in ANSSI's report, and have been removed from the title and summary under Cyberstack's policy on gang claims; the card now gives the DGFiP's own figures (a little over 350,000 individuals and 250,000 businesses) as reported by The Hacker News. (source: ANSSI; The Hacker News)
ANSSI — Rapport d’incident cyberattaques DGFiP (actualité 29 Sep 2026)
VUSec (VU Amsterdam) with Scuola Superiore Sant’Anna (29 September 2026 project page) disclose Branch Target Reuse (BTR), a Spectre-v2 variant against JIT engines. After self-modifying code frees and reuses an address, CPUs may keep stale indirect-branch prediction entries, yielding speculative execute-after-free into newly generated code at obsolete offsets. Evaluated on Linux classic BPF (cBPF) JIT, Firefox SpiderMonkey, and Oracle GraalVM; behaviour confirmed across Intel, AMD and Arm CPUs tested. End-to-end Linux cBPF path (seccomp filters; unprivileged): leak ~8 bytes/s and recover the root password hash from a concurrent su process in about 3–5 minutes on Raptor Cove / Lion Cove (Intel). Also bypasses optional bpf_jit_harden constant blinding by encoding gadgets in jump offsets. Linux kernel mitigations merged: CVE-2026-64507 (x86/bugs: Enable IBPB flush on BPF JIT allocation) and CVE-2026-64508 (bpf: Support for hardening against JIT spraying). GraalVM: randomise JIT code-cache locations (oracle/graal PR 14261). Mozilla: prioritising site isolation over IBPB-based browser mitigations; SpiderMonkey showed stale BTB survival but no complete browser exploit published. (sources: VUSec BTR project; BleepingComputer)
IBM's security bulletin for DataPower Gateway, first published on 28 September 2026, fixes 36 CVEs; the CVE records went public on 8 October 2026. DataPower is a security and integration gateway often placed at the network edge in front of APIs, web services and mainframe systems. Flaws rated CVSS 9.8 include CVE-2026-16340 (out-of-bounds write in the RFC 2047 encoded-word parser allowing a remote attacker to run code), CVE-2026-15762 (out-of-bounds write allowing remote code execution), CVE-2026-14269 (heap-based buffer overflow letting an unauthenticated remote attacker run code), CVE-2026-14502 (a remote attacker can gain administrative access because empty passwords are not rejected during LDAP authentication) and buffer overflows CVE-2026-14991 and CVE-2026-14992 (IBM's text for CVE-2026-14991 describes a local user). Affected: 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6CD 10.6.1 to 10.6.6, and 11.0.0.0 to 11.0.0.2. IBM lists no workarounds, flags known issue DT499224, and reports no exploitation. (source: IBM)
IBM — Security Bulletin: IBM DataPower Gateway multiple vulnerabilities (28 Sep 2026; CVE records published 8 Oct 2026)
NVIDIA launched the Open Agent Safety Platform (28 September 2026; developer blog + product hub) as an open reference design for containing autonomous AI agents after recent frontier-lab breakouts from evaluation environments. Software layer: NVIDIA OpenShell (Apache 2.0) runs agents in sandboxed environments with kernel-level isolation and verifiable policy over files, networks, tools, processes, and credentials—enforced outside the agent process. Optional hardware layer: NVIDIA Sentry on BlueField-4 DPUs provides out-of-band, in-silicon monitoring via DOCA and can quarantine agents that cross policy boundaries in milliseconds, independent of host compromise. Optimized for Vera CPU + BlueField systems; OpenShell also runs without BlueField on local/cloud/Kubernetes. (sources: NVIDIA developer blog; nvidia.com agent-safety hub)
NVIDIA Technical Blog — Open Agent Safety Platform (28 Sep 2026)
aicloud
Vulnerabilities
Mon 28 Sep
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H (GHSA-J6WC ALONE; CHAIN USES ADDITIONAL HIGH GHSAS FOR EARLIER FOOTHOLD)
AVAttack Vector
Network
ACAttack Complexity
Low
ATAttack Requirements
None
PRPrivileges Required
High
UIUser Interaction
None
VCVulnerable System Confidentiality
High
VIVulnerable System Integrity
High
VAVulnerable System Availability
High
SCSubsequent System Confidentiality
High
SISubsequent System Integrity
High
SASubsequent System Availability
H (GHSA-J6WC ALONE; CHAIN USES ADDITIONAL HIGH GHSAS FOR EARLIER FOOTHOLD)
ControlPlane (28 September 2026), with the OpenBao community, describes a full exploit chain from unauthenticated access to remote code execution in OpenBao (and notes the same class of issues affect HashiCorp Vault / IBM remediation still pending at publication). The chain combines multiple independently reported issues patched in OpenBao v2.6.3 and v2.7.0 (shipped 23 Sep 2026), including GHSA-j6wc-jpvg-xfxq — Critical CVSSv4 9.4 remote code execution via Raft snapshot restore / plugin-catalog replacement (Raft storage backend; privileged snapshot endpoints; original to HashiCorp Vault) — plus High issues GHSA-x8fg-h69x-p28f (PKI ACME validation bypass, 8.2), GHSA-mjch-vcw3-hhmf (cross-namespace policy access, 7.7), and GHSA-fg5x-7whg-6c28 (ACL deny bypass via non-canonical URLs, 7.6). ControlPlane: second-ever remote code execution vulnerability class in Vault/OpenBao; fork-coordination gaps can leave customers exposed. Operators not using Raft storage are not affected by the snapshot RCE path per GHSA-j6wc. Cyberstack does not reproduce the chain. (sources: OpenBao GHSA-j6wc-jpvg-xfxq; ControlPlane)
OX Security research (Nir Zadok, Moshe Siman Tov Bustan, Vitalii Chepurko; 28 September 2026; The Hacker News 29 Sep) tracks PhantomSub: 101 malicious npm packages impersonating/forking the Baileys unofficial WhatsApp API library so that when a developer links a personal WhatsApp account the package silently follows attacker-controlled WhatsApp channels/groups (follower inflation for Indonesian bot/account-selling spam). ~490,000 total downloads (~116,000 in prior 30 days); 16 packages removed from npm as of 28 Sep; campaign still growing (most packages first published Aug–Sep 2026). Three variants: (1) 19 packages fetch channel IDs from GitHub at runtime; (2) 60 embed channel IDs in cleartext; (3) 14 embed base64/obfuscated IDs or invite codes. Earlier related Baileys-mod findings: SafeDep (Aug), Xygeni (@dappaoffc/baileys-mod), OSV. Channels observed marketing Mobile Legends / TikTok accounts and in-game resources (e.g. “Dan” Indonesia business WhatsApp; Neural / MONTE–BMG / CORTANA TECH). (sources: OX Security; The Hacker News)
Huntress (published 28 September 2026) documents attackers abusing ChatGPT Custom GPTs to deliver ClickFix lures and a multi-stage RAT. Victims searching Google for ChatGPT were served a sponsored result for a Custom GPT titled “Plus 5.6” (community builder) that steered users to a Google Sites “backup domain” with a fake Cloudflare CAPTCHA / ClickFix page instructing PowerShell that downloaded a malicious MSI. First chain: Canon-signed app DLL sideload, User Run key + scheduled task posing as “Canon Configuration Reader”, loader in obfuscated audio archive, DNS-over-HTTPS C2 via Cloudflare/Google/Quad9. Second Custom GPT (after OpenAI removed the first on 25 Sep; second seen 27 Sep) switched to Stardock executable/DLL sideload and a loader inside a Microsoft NuGet package; final RAT payload unchanged. Huntress: at least ~40 users infected; at least two incidents tied to a Custom GPT instance; campaign still active as of publication. (sources: Huntress; SecurityWeek)
Huntress — Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix (28 Sep 2026)
