Weekly Threat Intelligence Summary

Top 10 General Cyber Threats

Generated 2026-10-19T05:00:06.254672+00:00

1. Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (www.cisa.gov, 2026-10-06T16:22:53)
   Score: 16.712
   Advisory at a Glance Title Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data Original Publication October 8, 2026 Executive Summary Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including US critical infrastructure sectors. Thes
2. Update Windows: Record Patch Tuesday fixes flaw already under attack (www.malwarebytes.com, 2026-10-14T11:26:09)
   Score: 10.411
   Microsoft’s October updates address a record 1,413 vulnerabilities, including a Windows flaw attackers are already exploiting and two other zero-days.
3. October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities (www.crowdstrike.com, 2026-10-13T05:00:00)
   Score: 9.7
4. Is this link safe? Find out with Malwarebytes Scam Link Check (www.malwarebytes.com, 2026-10-15T12:55:00)
   Score: 7.588
   Not sure if a link is safe? Malwarebytes Scam Link Check scans suspicious links for signs of phishing, scams, malware, and other online threats before you click.
5. Sextortion “help” firm took $60 million from victims, FTC alleges (www.malwarebytes.com, 2026-10-15T11:48:26)
   Score: 7.581
   The FTC accuses Digital Forensics Corporation and affiliated companies of exploiting people seeking help with intimate-image blackmail.
6. Malware Indicators of Compromise (IoCs) | Recorded Future (www.recordedfuture.com, 2026-10-13T00:00:00)
   Score: 7.165
   Learn what malware indicators of compromise (IoCs) are, common types, how they’re collected, and best practices for detection and response.
7. Update Chrome: Google fixes 37 security flaws, including seven critical bugs (www.malwarebytes.com, 2026-10-15T14:15:03)
   Score: 7.098
   Some flaws could let attackers run malicious code on your device through a crafted webpage.
8. September 2026 CVE Landscape (www.recordedfuture.com, 2026-10-13T00:00:00)
   Score: 6.965
   In September 2026, Insikt Group® identified 94 high-impact vulnerabilities that should be prioritized for remediation, 59 of which had a Very Critical Recorded Future Risk Score. This represents a 29% increase from last month.
9. CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage (www.crowdstrike.com, 2026-10-08T05:00:00)
   Score: 5.867
10. Japan Adopts Proactive Cyber Defense Strategy (www.recordedfuture.com, 2026-10-08T00:00:00)
    Score: 5.832
    Learn about Japan's Active Cyber Defense (ACD) strategy, mandatory reporting rules, and key impacts on critical infrastructure.

Top 10 AI / LLM-Related Threats

Generated 2026-10-19T06:00:23.196924+00:00

1. Stealthy Poisoning Attacks via Reused KV Cache of Reasoning (arxiv.org, 2026-10-19T04:00:00)
   Score: 21.78
   arXiv:2610.22873v1 Announce Type: new
   Abstract: Modern large language model (LLM) systems reuse key-value (KV) caches to accelerate inference. Recent work has shown that reusing KV caches from reasoning traces can also improve task performance, similar to retrieval-augmented generation (RAG). We demonstrate that this form of KV cache reuse introduces new poisoning vulnerabilities. We propose R$^2$ECAP (Reused Reasoning-Cache Poisoning), a black-box attack that plants poisoned reasoning traces s
2. The Infinite Mutation Engine? Measuring Polymorphism in LLM-Generated Offensive Code (arxiv.org, 2026-10-19T04:00:00)
   Score: 19.78
   arXiv:2605.03619v3 Announce Type: replace
   Abstract: Malware authors traditionally rely on polymorphic techniques to produce variants within a malware family, complicating detection. Generative AI enables attackers to automatically synthesize structurally diverse payloads with identical behavior, raising the question of how much evasion Large Language Models (LLMs) actually provide. Recent work has assumed that LLMs can produce highly polymorphic payloads, leaving unquantified the variation that
3. MobileInject: Evaluating Reasoning-to-Action Security of MLLM-Based Mobile Agents under Cross-Modal Consistency Injection (arxiv.org, 2026-10-19T04:00:00)
   Score: 18.78
   arXiv:2610.23307v1 Announce Type: new
   Abstract: Multimodal large language model (MLLM)-based mobile agents are rapidly evolving from conversational assistants into autonomous systems that perceive, reason over, and act on smartphone environments. This capability also exposes a new security risk: adversaries can embed malicious objectives in cross-application mobile content and steer agent behavior through indirect multimodal injection. Although prompt injection has been studied in desktop and w
4. ACE: An AI-Orchestrated Intrusion Detection and Compliance Mapping Engine (arxiv.org, 2026-10-19T04:00:00)
   Score: 17.78
   arXiv:2610.22702v1 Announce Type: new
   Abstract: This study proposes the Automated Compliance Engine (ACE), an AI-orchestrated framework that links intrusion detection, regulatory control mapping, and automated countermeasure deployment for security operations environments. ACE integrates Suricata IDS, a LangGraph five-stage workflow, retrieval-augmented generation, NIST SP 800-53 Rev. 5 control retrieval, large language model-based control ranking, and SSH-based Suricata rule deployment. The fr
5. SciIntBench: Measuring LLM Compliance with Research Integrity Norms Under Adversarial Framing (arxiv.org, 2026-10-19T04:00:00)
   Score: 17.78
   arXiv:2605.29468v2 Announce Type: replace
   Abstract: Large language models (LLMs) are increasingly used to support scientific work, but it is unclear whether they uphold responsible conduct of research (RCR) norms or help undermine them. We introduce SciIntBench, an adversarial benchmark of 1350 prompts across 270 scenarios, ten RCR categories, and three scientific domains. Each scenario appears in five gradations, from Most Overt to Most Covert adversarial prompts, and an additional Benign vers
6. The October 2026 Security Update Review (www.thezdi.com, 2026-10-13T19:34:30)
   Score: 17.606
   Another month of patches equals another new record for Microsoft patches. It’s a good thing I survive Pwn2Own Ireland , because between these and the Adobe patches, there’s much to discuss. I’m also looking at different ways I can represent the bugs at this level of volume, so let me know if you have ideas. (Seriously – I’m out of ideas). If you’d rather watch the full video recap covering the entire release, you can check it out here: Adobe Patches for October 2026 For the first part of the Oct
7. Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents (arxiv.org, 2026-10-19T04:00:00)
   Score: 17.48
   arXiv:2610.23254v1 Announce Type: cross
   Abstract: Tool-using agents read untrusted external content, which exposes them to indirect prompt injection (IPI), where hidden instructions hijack the agent's tool calls. Benchmarks measure IPI security by the attack success rate (ASR), which treats every failed attack as a successful defense. To test this assumption, we audit 33,000 trajectories from eleven open-weight agents (2-14B parameters) on InjecAgent and AgentDojo. A label-blind LLM judge
8. Identify, Classify, Act: Per-Instruction Controlled Compliance for LLMs over External Data (arxiv.org, 2026-10-19T04:00:00)
   Score: 16.48
   arXiv:2610.22874v1 Announce Type: cross
   Abstract: LLMs over external data face a per-instruction tension: a single document or tool return often interleaves legitimate directives with adversarial prompt injections, and the model must follow the former while rejecting the latter. Existing defenses suppress or trust all external instructions, collapsing the safety-utility frontier and forcing a choice between over-refusal and over-compliance. We argue the missing capability is \textbf{per-instruc
9. Run multi-node inference workloads using Ray LLM Deep Learning Containers (aws.amazon.com, 2026-10-12T15:50:14)
   Score: 16.131
   Learn how to deploy one large language model across two GPU nodes on Amazon EKS using the multi-node Ray LLM Deep Learning Containers, with separate prefill and decode nodes behind one OpenAI-compatible endpoint. The pre-built container ships the full inference stack, so you configure the deployment instead of assembling it.
10. Monitor-Validity Failures: LLM Safety Evidence Paths at Evolving Framework Boundaries (arxiv.org, 2026-10-19T04:00:00)
    Score: 15.48
    arXiv:2610.23362v1 Announce Type: cross
    Abstract: Modern LLM applications rely on runtime monitors that inspect tool calls, traces, streams, detector outputs, and verifier inputs. This creates an interface-reliability problem: a framework path may remain operational while policy-relevant evidence never reaches its decision point. In one representative case, a regex detector returned a positive match, but the framework stranded the result before the block decision. This differs from jailbreaks a
11. Veil-Then-Reveal: Protecting PII Privacy via Reversible Pseudo-Anonymization in Zero-Trust User–LLM Interaction (arxiv.org, 2026-10-19T04:00:00)
    Score: 14.78
    arXiv:2610.22800v1 Announce Type: new
    Abstract: Large language models (LLMs) increasingly process sensitive documents and personal information, yet sending prompts containing personally identifiable information (PII) to remote providers exposes data subjects and organizations to risks from logging, retention, model training, and unintended disclosure. Existing anonymization methods often mask or remove PII, while conventional encryption eliminates the lexical and structural cues needed for effe
12. GRAD: Graph-Structured Antibody Defense for LLM Agents (arxiv.org, 2026-10-19T04:00:00)
    Score: 14.78
    arXiv:2610.22828v1 Announce Type: new
    Abstract: Memory poisoning and decomposition attacks distribute malicious evidence across the operations of large language model agents. Existing request-level defenses can miss such attacks because they assess individual inputs without connecting earlier information to later actions. Moreover, detectors must adapt as task contexts change, while updates to shared parameters can impair previously learned detection capabilities. To address these challenges, w
13. When Core-Network Elements Become Reachable: Field-Level Exploitability Analysis in Diameter (arxiv.org, 2026-10-19T04:00:00)
    Score: 14.78
    arXiv:2610.22943v1 Announce Type: new
    Abstract: The increasing exposure of cellular core-network elements to public networks has turned Diameter signaling interfaces into a practical attack surface. While large language models (LLMs) show promise for protocol exploitability analysis, we find that their judgments on Diameter can be unreliable because they may deviate from the tacit analysis discipline followed by security experts and reach conclusions without considering complete protocol eviden
14. SAFE-Mem: Secure Agentic Memory with Fine-Grained Authority and Governance-Aware Retrieval (arxiv.org, 2026-10-19T04:00:00)
    Score: 14.78
    arXiv:2610.22959v1 Announce Type: new
    Abstract: Large language model (LLM) agents increasingly rely on persistent memory to support long-term reasoning and personalized interactions. However, information collected from external sources can introduce security risks when untrusted claims (i.e., atomic statements) are later treated as authorized preferences, policies, or permissions. Existing defenses typically rely on content-based filtering or coarse-grained provenance tracking, which either fai
15. ECHO: Replacing the Compliance Proxy with Response Harmfulness in Optimization-Based Jailbreak Attack (arxiv.org, 2026-10-19T04:00:00)
    Score: 14.78
    arXiv:2610.23030v1 Announce Type: new
    Abstract: Despite extensive safety alignment, large language models remain vulnerable to jailbreak attacks. Existing optimization-based attacks share a single objective: maximize a token-level proxy of victim compliance—such as the likelihood of an affirmative prefix—computed on the prompt rather than the decoded reply. This proxy cannot distinguish a cautious hedge from a fully actionable harmful answer, leaving the search blind to what the model actua
16. Token-Level Attribution of Multi-Mode LLM Watermarks: Optimal Rule and Belief Weighting (arxiv.org, 2026-10-19T04:00:00)
    Score: 14.78
    arXiv:2610.23601v1 Announce Type: new
    Abstract: A watermark verifier may hold many modes, i.e., secret keys, and a document may mix spans of different modes with unwatermarked text. Directly reporting the mode with the largest pivotal statistic (pivot) inflates the Type I error, and restoring the nominal level reduces power as candidate modes are added. We formulate token-level multi-mode attribution for the Gumbel-max watermark as maximizing correct-label power under a Type I error constraint
17. VulnSAGE: Adjudicating SAST Reports by Connecting LLM Reasoning to Program Structure (arxiv.org, 2026-10-19T04:00:00)
    Score: 14.78
    arXiv:2610.23035v1 Announce Type: cross
    Abstract: Static Application Security Testing (SAST) reports flag operations whose safety depends on project-specific context, and maintainers must decide which reports describe real defects. Large language models (LLMs) can interpret this context, but adjudicating a report with them requires the decisive code, which often lies far from the reported line, and a decision basis that program analysis can check. We present VulnSAGE, an adjudication system for
18. From GAN-Based Models to GPT-5: A Taxonomy-Guided Study of Human Performance in Detecting Deepfake Face Images (arxiv.org, 2026-10-19T04:00:00)
    Score: 14.78
    arXiv:2610.23144v1 Announce Type: cross
    Abstract: Generative models for deepfakes have rapidly evolved from GAN-based architectures to diffusion models and multimodal large language models (MLLMs). However, empirical research on human performance in detecting deepfake face images has not kept pace. It remains unclear if (and how) detection performance varies across generative models and whether model-specific training improves detection more effectively than general-purpose training. In this pa
19. Every Model Cheats: Prompt-Level Mitigation of Cheating on Offensive Cyber Tasks (arxiv.org, 2026-10-19T04:00:00)
    Score: 14.78
    arXiv:2607.21763v2 Announce Type: replace
    Abstract: Large language model (LLM) agents routinely cheat on cybersecurity benchmarks, inflating reported pass rates far beyond genuine capability. Prior audits of Cybench found cheating in 0.3-3.4% of traces, implicating only a handful of models. We present a controlled prompt-ablation study across 22 frontier models from 7 providers on 23 Cybench capture-the-flag (CTF) challenges under three prompt conditions (no anti-cheat, standard, severe). All 1
20. BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition (arxiv.org, 2026-10-19T04:00:00)
    Score: 14.78
    arXiv:2610.21565v2 Announce Type: replace
    Abstract: On-device deployment of large language models (LLMs) is increasingly adopted due to latency and privacy requirements, but exposes proprietary models to reverse engineering and intellectual property theft. Trusted Execution Environments (TEEs) provide hardware-enforced isolation for on-device inference, yet most TEE-based parameter obfuscation relies on unilateral matrix transformations that obfuscate only the output side. We identify a vulnera
21. Rethinking Quality in Large Language Model Routing: Security-Conditioned Model-and-Budget Selection (arxiv.org, 2026-10-19T04:00:00)
    Score: 14.78
    arXiv:2610.18566v2 Announce Type: replace-cross
    Abstract: Large language model (LLM) routers reduce serving cost by choosing which model to call and how many output tokens to grant it for each query. Existing routers rank model-budget actions using a single quality metric. This does not work for mixed workloads. For ordinary queries, a good answer is correct and useful (utility); for security-sensitive queries, a good answer refuses harmful requests or resists malicious instructions (security).
22. AgentLoupe: Kernel-Resident Semantic Causal Labels for AI Agent Observability (arxiv.org, 2026-10-19T04:00:00)
    Score: 12.48
    arXiv:2610.23233v1 Announce Type: new
    Abstract: AI agents translate user intents into system actions via tool invocations. Accurately attributing these actions to their originating LLM interactions is essential for security auditing, yet existing methods, such as AgentSight, fail for delayed execution and cross-process-lineage behaviors. We present AgentLoupe, an application-transparent eBPF-based observability tool. The core insight of AgentLoupe is to embed causal identity into kernel resourc
23. MobileJailBench: Red Queen Jailbreak Benchmarking for Mobile Agents (arxiv.org, 2026-10-19T04:00:00)
    Score: 12.48
    arXiv:2610.23303v1 Announce Type: new
    Abstract: MLLM-based mobile agents are rapidly gaining autonomy in perception, planning, and closed-loop execution in dynamic mobile environments. However, this autonomy also broadens the attack surface and amplifies the risks of malicious misuse, including privacy leakage, device compromise, and large-scale phishing. Existing jailbreak evaluations leave three critical gaps for mobile agents: they focus on conversational attacks instead of mobile workflows,
24. RedDarwin: Evolving Jailbreak Skills against Frontier LLMs (arxiv.org, 2026-10-19T04:00:00)
    Score: 12.48
    arXiv:2610.23726v1 Announce Type: new
    Abstract: Red teaming must continually adapt as frontier LLM safeguards evolve, yet existing approaches largely search for adversarial prompts or optimize within fixed attack procedures. We observe that even when an attack becomes ineffective, its underlying mechanisms can remain useful and can be revised or recombined to construct stronger attacks. Based on this insight, we introduce RedDarwin, an agentic framework that shifts the unit of jailbreak evoluti
25. Recoverability-Controlled Safety Miscalibration in Large Language Models (arxiv.org, 2026-10-19T04:00:00)
    Score: 11.78
    arXiv:2610.22425v1 Announce Type: new
    Abstract: Safety-aligned language models are expected to refuse harmful requests while remaining useful for benign ones. However, because many evaluations score only the final response, they often conflate intent understanding with response-level safety behavior. To address this, we introduce RiskCueBench, a recoverability-controlled benchmark that separates these two stages by first measuring whether a model can successfully recover a high-level intent and

Auto-generated 2026-10-19