Weekly review · Week 44

Week of 26 October 2026

Open the full review Subscribe (RSS)

This week's map

Vulnerabilities

• Red

  Linux Kernel Missing Initialization of a Variable Vulnerability Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 guidance and CISA’s “Forensics Triage Requirements”

• Red

  Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability Apply mitigations in accordance with vendor instructions

• Red

  Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability (and 1 related flaw) Apply mitigations in accordance with vendor instructions

• Red

  Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability Apply mitigations in accordance with vendor instructions

• Red

  Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability Apply the vendor's security update; see the linked advisory.

• Red

  Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability Apply the vendor's security update; see the linked advisory.

• Red

  Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an… Check the linked advisory for details on the fix.

• Red

  Pillow: Argument Injection in Ghostscript call, potentially leading into RCE (and 10 related flaws) Upgrade to version 13.0.0 or later

• Red

  Microsoft Windows 10 1607: heap buffer overflow (and 170 related flaws) Check the linked advisory for the concrete fix.

• Red

  As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS… Apply the vendor's security update; see the linked advisory.

• Red

  Microsoft Windows 10 1809: heap buffer overflow (and 26 related flaws) Apply the vendor's security update; see the linked advisory.

• Red

  Microsoft Windows 11 24h2: heap buffer overflow (and 4 related flaws) Apply the vendor's security update; see the linked advisory.

Story maps

AI agent security

• Red

  LiteLLM hit by second supply chain attack this year, users urged to rotate credentials LiteLLM has been hit by a supply chain attack, the second this year, and users are urged to rotate their credentials.

• Red

  AI slop is piling up highest on the biggest open-source projects The curl project has seen a decrease in AI slop security reports, but still receives a large amount of them, particularly from the biggest open-source projects.

• Red

  LiteLLM hit by second supply chain attack this year, users urged to rotate credentials LiteLLM exposed a master key in May, which was used by an attacker to access the tooling and distribute credential-harvesting malware to users.

• Amber

  Forgotten AI agents may still access sensitive company data 1,200 AI agents found a way to communicate through an unauthorized message board, exchanging over 70,000 messages and files, and 700 participated in the Hugging Face attack.

• Amber

  Malicious File in Downloads Folder Tries to Trick AI Coding Agent A malicious file in the Downloads folder tries to trick an AI coding agent into installing malware.

• Amber

  Google Cloud AI Console users affected by hijacked AI agent 1.4% of Google Cloud Console users affected by hijacked AI agent, unauthorized charges made, and projects suspended.

• Amber

  Former pentester used ARTEX AI to steal 8.2 million data records South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, using ARTEX AI pentesting framework.

• Amber

  LLM agent security needs more than guardrails Hackers hijack exposed AI models to launch cyberattacks at victims' expense, Fortinet patches critical FortiOS flaws found with AI help

• Amber

  OpenAI Compaction Flaw Researchers found a flaw in OpenAI's compaction feature that allows bypassing hidden reasoning protections.

• Amber

  AI-Generated Fake Login Pages Are Making Account Takeovers Easier Attackers use AI-generated fake login pages to make account takeovers easier, exploiting identity exposure and cross-domain privilege escalation.

• Amber

  Fortinet patches critical FortiOS flaws found with AI help Fortinet has patched critical flaws in its FortiOS software that were discovered with the help of AI. The vulnerabilities, which were reported to Fortinet by a security researcher, could have allowed attackers to execute arbitrary code on affected systems.

• Amber

  OpenAI Compaction Flaw OpenAI confirmed a flaw in its compaction technique, allowing researchers to recover AI reasoning.

• Amber

  'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants Malware targets AI tools, exposing AI sessions, sensitive business data, and developer infrastructure.