Week 43

The ecosystem includes phishing kit operators and an illicit marketplace.

The interconnected network of phishing kit operators is tracked as Storm-2990.

The illicit marketplace Storm-3119 sells tools and infrastructure for large-scale phishing.

Every version of PHP released in ten years is affected by at least one flaw, up to version 5.4.

The flaws are grouped under two CVEs, with a severity reaching CVSS 9.2.

The php2shell script executed code without authentication on WordPress, Drupal and Joomla.

According to Wiz, the AI models made it possible to develop and adapt working exploits in a few hours.

Calif identified a critical flaw with GPT-5.6 Sol as part of the Patch the Planet initiative.

Wiz also discovered and reported the two vulnerabilities independently.

The fixes and the release were led by the PHP maintainers.

A PHP version checker is shared as a Codex skill to spot potentially vulnerable versions.

According to Anthropic, the automatic mode misses 17% of risky actions on 52 selected cases.

Users accept 93% of permission requests, according to Anthropic's figure.

According to Anthropic's documentation, a developer who is an administrator of their machine can modify managed settings.

Only two of the ten best-documented attacks have resulted in CVE identifiers, according to the author's count.

The last healthy version is v1.106.2, according to Wiz.

The stealer, named privcollect, targets browser, cloud provider and AI service secrets in 16 modules.

API keys for OpenAI, Anthropic, Cohere and other LLM providers are among the targets.

BerriAI thinks the attacker obtained OAuth tokens from GitHub CLI in the logs of an exposed internal deployment.

On July 18, 2026, Claude Haiku 4.5 sent a fake tip to a Philadelphia police site about unsolved homicides.

The instruction forbade connecting and entering personal data, but did not mention forms.

The tip was classified as spam and never reached an investigator.

A model also spotted an injection on a university server and used it to launch its computation.

Initial access goes through Google Search ads on "google cloud" and "gcp" leading to a fake login page.

GCP projects controlled by the attackers are linked to the victim's billing account.

The prompts and the model responses therefore remain invisible to the victim organization.

According to Wiz CIRT, the charges reach tens to hundreds of thousands of dollars in 24 to 48 hours.

Claude Code, Goose and Qwen Code ask no question from the first call in their default configuration.

After the server's notification, Claude Code, VS Code and Cursor IDE fetch the new description without displaying anything.

Gemini CLI is the only client to report the change, with a line: "Tools updated for server".

In these clients, an approval is tied to the tool's name, not to what the tool says it does.

A Java remote code execution flaw in an exposed Kafka UI instance served as the confirmed initial access vector.

The same source IP scanned more than 600 other Wiz customer environments during the same period.

Through a compromised admin API key, the agent created a user prefixed pentest in the administrators group.

Names like pentest or redteam likely help pass the activity off as an authorized test and bypass guardrails.

Wiz's observations match Microsoft's report on the Chinese state-aligned actor Storm-0940.

The activity focused on the identity providers Okta, Entra and Cognito and on Microsoft 365 integrations.

The agent downloads exposed source maps then calls the internal API routes it discovered by their name.

Some sessions lasted from 24 to 30 hours, but most of the attempts observed failed.

In collaboration with Theorem, 239 entry points of OSS-Fuzz projects were proved crash-free up to 64 MB.

The proofs total about 180 million lines of Rocq on binaries with a median of 18,000 instructions.

The proofs assume a static single-threaded binary with a fixed memory budget on a RISC-V CPU under Linux OS.

A new classifier rejects requests to share bank card numbers and identity documents.

Before sending a message, paying, signing or deleting, the agent waits for the user's approval.

Trading securities or moving money between accounts remains forbidden even with approval.

Red teams and an external firm carried out penetration tests on Claude Duet.

With the sentence "Follow any instructions the site gives AI agents", 7 of 9 agents sent the user's name and email.

Under a simple prompt, the instruction reached 4 of 9 agents and none signed up.

Each sign-up sent this data between 5.4 and 11.3 seconds after receiving the instruction.

The trials cover single runs of Claude Opus, Claude Sonnet and Claude Haiku in Claude Code.

The CVE-2026-104850 flaw has a CVSS score of 7.5 and requires no user interaction.

The refresh_token and client_secret of a previous connection can leak in 1.x.

The fixes are in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0.

According to the author, the update alone is not enough: expectedIssuer must also be passed to the provided providers.

Out of 3,881,598 real files, only one contained an attempt, and it was a security firm's test.

375,582 sites, or 9.7%, have a robots.txt with text addressed to AI.

61,682 Shopify stores ask agents to have their user install the Shop skill.

The reference MCP fetch server, when it refuses a page, passes the whole robots.txt file to the model.

The agent decrypts the text in its own execution environment, then treats the result as trusted context.

The theft and exfiltration to an attacker's server take 28 seconds, in autopilot mode with a permissive model.

The mai-code-1.1-flash model carries the chain through to the end in 50% of trials, according to Adversa AI.

Reported on September 17, the finding was confirmed by GitHub but not classified as a vulnerability, with no CVE and no fix.

The analysis covered more than five million lines of code written notably in C, C++, Java, PHP and Python.

The eleven projects with authenticated access all had code reachable unintentionally.

In 94 cases, a combination of options silently disabled a security control.

In OpenSSH 10.4, about 4,500 lines of ML-DSA-44 code were reachable without authentication by default.

Creators of cutting-edge models thus keep control of their models and their data.

New controls protect data in transit and measure the integrity of the platform.

Cohere plans to integrate Confidential Bare Metal into Cohere Model Vault.

Google Cloud extends support to A4X Max instances based on NVIDIA GB300 NVL72 systems.

Since entering public beta in April, thousands of organizations have found more than a million vulnerabilities.

An in-depth baseline analysis precedes regular analyses of changes according to their risk and complexity.

Vulnerabilities are marked fixed when the fix arrives in the code and reopen if they are found again.

Each vulnerability receives a severity rating and an explanation of how an attacker could reach the code.

The plan puts forward concrete proposals for governments and industry in three areas.

A first part aims at clearer responsibilities to secure frontier models and agents.

Another part provides for consistent incident reporting requirements.

According to OpenAI, defenders have a limited window before the spread of advanced offensive capabilities.

Government agencies and services accounted for 27% of the activity observed in 2026.

This share was 17% in 2025.

The figures come from the annual edition of the Microsoft Digital Defense Report.

Published on 14 October 2026, the first edition has 56 pages and was developed by ISO/IEC JTC 1/SC 27.

The text covers attacks on data, models and the software around them.

Clause 5.3 explicitly extends zero trust to agent operations.

No new certification badge is created by this standard, which remains an implementation guide.