Weekly Threat Intelligence Summary
Top 10 General Cyber Threats
Generated 2026-10-26T05:00:06.475177+00:00
- #StopRansomware: SafePay Ransomware (www.cisa.gov, 2026-10-19T19:18:07)
Score: 17.733
Advisory at a Glance Title #StopRansomware: SafePay Ransomware Original Publication October 20, 2026 Executive Summary This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using p - Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (www.cisa.gov, 2026-10-06T16:22:53)
Score: 15.546
Advisory at a Glance Title Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data Original Publication October 8, 2026 Executive Summary Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including US critical infrastructure sectors. Thes - PHP2Shell Exploitation: Two Critical PHP Flaws Explained (www.recordedfuture.com, 2026-10-21T00:00:00)
Score: 8.832
Two critical PHP remote code execution flaws (PHP2Shell) are reportedly being exploited. See who’s exposed, how the exploits work, and how to remediate now. - October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities (www.crowdstrike.com, 2026-10-13T05:00:00)
Score: 8.533 - Crime Stoppers chapter freezes tips after breach breaks anonymity promise (www.malwarebytes.com, 2026-10-23T09:57:48)
Score: 8.234
A Crime Stoppers chapter has stopped accepting tips after a breach exposed information about anonymous tipsters. - Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation (www.crowdstrike.com, 2026-10-23T05:00:00)
Score: 7.7 - AOMEI Backupper update servers hijacked to push malware: Check your PC (www.malwarebytes.com, 2026-10-19T14:21:22)
Score: 7.098
Attackers tampered with AOMEI Backupper’s update system to deliver malware that could give them remote access to users’ PCs. - PHP2Shell: Why many websites had to go offline (www.malwarebytes.com, 2026-10-21T16:14:18)
Score: 6.945
Many sites were taken offline so admins could patch two critical PHP flaws that could have let attackers run malicious code on their servers. - Malware Indicators of Compromise (IoCs) | Recorded Future (www.recordedfuture.com, 2026-10-13T00:00:00)
Score: 5.999
Learn what malware indicators of compromise (IoCs) are, common types, how they’re collected, and best practices for detection and response. - September 2026 CVE Landscape (www.recordedfuture.com, 2026-10-13T00:00:00)
Score: 5.799
In September 2026, Insikt Group® identified 94 high-impact vulnerabilities that should be prioritized for remediation, 59 of which had a Very Critical Recorded Future Risk Score. This represents a 29% increase from last month.
Top 10 AI / LLM-Related Threats
Generated 2026-10-26T06:00:23.279453+00:00
- On Task, Off Track: Benchmarking LLM and Agent Robustness to Near-Target Prompt Injection (arxiv.org, 2026-10-26T04:00:00)
Score: 18.78
arXiv:2610.32531v1 Announce Type: new
Abstract: Prompt injection benchmarks assess whether large language models (LLMs) and agents resist malicious instructions embedded in external content. However, a system could perform well by rejecting attacks that obviously abandon the user's request, while still accepting changes that retain most of a legitimate answer but make it incorrect or harmful. Testing more instructions for unrelated outcomes would not necessarily reveal this weakness. We ca - Omni-UBench: Benchmarking Omni-Modal LLM-based Guardrails Across Safety, Utility, and Reliability (arxiv.org, 2026-10-26T04:00:00)
Score: 17.78
arXiv:2610.31713v1 Announce Type: new
Abstract: Advances in Omni-modal Large Language Models (OLLMs) have enabled increasingly seamless human-AI interaction, but their unified processing of heterogeneous modalities also expands the attack surface, allowing adversaries to exploit richer input compositions to circumvent safety alignment. To counter such risks, omni-modal guardrails have been proposed to detect and filter unsafe queries across arbitrary modalities. However, their capabilities and - Your Next Insider Threat Won’t be Human: Securing AI Agents From the Outside in (www.rapid7.com, 2026-10-19T16:34:43)
Score: 17.238
Why the controls on an AI agent have to live outside of it, and what a security operations team can do to implement and maintain those controls. The new privileged user in your environment Security teams spent two decades learning how to work with the people they trust most. Domain admins, DBAs, finance approvers and contractors with VPN access all get a mature playbook: verified identity, scoped access, logged activity and a fast way to revoke it all. Today, we’re navigating the same kind of ac - TRACE: Data-Free Text Reconstruction Attacks against Approximate Unlearning in LLMs (arxiv.org, 2026-10-26T04:00:00)
Score: 16.78
arXiv:2610.31995v1 Announce Type: new
Abstract: As large language models (LLMs) face growing demands for data removal driven by regulatory compliance, copyright concerns, and privacy protection, approximate unlearning has emerged as a practical alternative to expensive full retraining. In practice, pre- and post-unlearning model snapshots are often maintained for auditing and rollback, introducing a previously overlooked side channel. This paper demonstrates that approximate unlearning in LLM c - The October 2026 Security Update Review (www.thezdi.com, 2026-10-13T19:34:30)
Score: 15.939
Another month of patches equals another new record for Microsoft patches. It’s a good thing I survive Pwn2Own Ireland , because between these and the Adobe patches, there’s much to discuss. I’m also looking at different ways I can represent the bugs at this level of volume, so let me know if you have ideas. (Seriously – I’m out of ideas). If you’d rather watch the full video recap covering the entire release, you can check it out here: Adobe Patches for October 2026 For the first part of the Oct - LocalAlign: Enabling Generalizable Prompt Injection Defense via Generation of Near-Target Adversarial Examples for Alignment Training (arxiv.org, 2026-10-26T04:00:00)
Score: 15.78
arXiv:2605.01462v2 Announce Type: replace
Abstract: Large language models are increasingly embedded into systems that interact with user data, retrieved web content, and external tools, creating a new attack surface: prompt injection, where malicious commands embedded in untrusted data override the trusted command and induce unintended behavior. Existing defenses mainly rely on fine-tuning the model to preserve an explicit boundary between trusted commands and the untrusted data portion, so tha - Label-Budgeted Attribute Inference from Protected Features in Edge-Cloud Split Multimodal LLMs (arxiv.org, 2026-10-26T04:00:00)
Score: 14.78
arXiv:2610.32079v1 Announce Type: new
Abstract: Edge-cloud split inference runs the early layers of a multimodal large language model (MLLM) on a device and sends intermediate features to a server to complete the task. While keeping raw images local is often perceived as a privacy benefit, an honest-but-curious server can still infer sensitive attributes, such as age, gender, and race, from the received features. Existing protections intervene at the input, transmitted representation, or model& - Trusting the Tool: Asymmetric Deference of LLM Vulnerability Auditors to Static-Analysis Evidence (arxiv.org, 2026-10-26T04:00:00)
Score: 14.78
arXiv:2610.32876v1 Announce Type: cross
Abstract: Pipelines that combine large language models (LLMs) with static analysis let the model consume the analyser's output as evidence, but whether the model distinguishes true from false evidence, and whether its scrutiny depends on what the evidence claims, has not been measured. We built an intraprocedural analyser for C/C++ that produces proof obligations and audited vulnerable and patched functions from PrimeVul under six evidence conditions - TensorCommitments: A Lightweight Verifiable Inference for Large Language Models (arxiv.org, 2026-10-26T04:00:00)
Score: 14.78
arXiv:2602.12630v3 Announce Type: replace
Abstract: Most large language models (LLMs) run on external clouds: users send a prompt, pay for inference, and must trust that the remote GPU executes the LLM without any adversarial tampering. We critically ask how to achieve verifiable LLM inference, where a prover (the service) must convince a verifier (the client) that an inference was run correctly without rerunning the LLM. Existing cryptographic works are too slow at the LLM scale, while non-cry - From One Query to Many: A Critical Survey of Privacy Accounting in RAG (arxiv.org, 2026-10-26T04:00:00)
Score: 14.78
arXiv:2610.21245v2 Announce Type: replace
Abstract: Retrieval-augmented generation (RAG) enables large language models to leverage external knowledge but introduces privacy risks when the retrieved corpus contains sensitive information. Differential privacy (DP) offers formal protection, yet interpreting and comparing privacy guarantees across existing DP-RAG methods remains challenging. In particular, a privacy budget reported for a single response does not directly characterize privacy loss o - Agentic AI Defense: Decode-Time Provenance Binding for MCP (arxiv.org, 2026-10-26T04:00:00)
Score: 14.48
arXiv:2610.31974v1 Announce Type: new
Abstract: Agentic AI systems using the Model Context Protocol (MCP) are vulnerable to indirect prompt injection through untrusted tool outputs. We demonstrate cross-modal trust laundering, in which instructions concealed in an email-signature image using least-significant-bit (LSB), discrete cosine transform (DCT), or metadata steganography bypass text scanners and enter a multi-agent workflow when decoded by a tool. To counter this threat, we propose decod - WebAgentGuard: A Reasoning-Driven Guard Model for Detecting Prompt Injection Attacks in Web Agents (arxiv.org, 2026-10-26T04:00:00)
Score: 12.78
arXiv:2604.12284v2 Announce Type: replace
Abstract: Web agents powered by vision-language models (VLMs) enable autonomous interaction with web environments by perceiving and acting on both visual and textual webpage content to accomplish user-specified tasks. However, they are highly vulnerable to prompt injection attacks, where adversarial instructions embedded in HTML or rendered screenshots can manipulate agent behavior and lead to harmful outcomes such as information leakage. Existing defen - Metasploit Wrap Up: Langflow, MongoDB, and More (www.rapid7.com, 2026-10-23T15:38:56)
Score: 11.881
This release adds multiple new modules, and 6 of those modules point at a single target: Langflow , the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 and CVE-2026-93674), spanning Langflow releases from 1.0.0 through 1.11.4. Thanks to the work of rmhowe425 , with research credit to Peter Girnus - Safe at One Loop, Risky at Another: Aligning Safety Across Recurrent Depths in Looped Language Models (arxiv.org, 2026-10-26T04:00:00)
Score: 11.78
arXiv:2610.10625v2 Announce Type: replace
Abstract: Looped Language Models (LoopLMs) provide a parameter efficient approach to scaling model capabilities through repeated use of shared parameters across recurrent steps. Since each recurrent depth can be read out independently, a single LoopLM exposes a broader output space across inference depths, raising an important question: whether safety is preserved throughout recurrent computation. Prior evaluations suggest that deeper recurrence can imp - Scaling Laws for Safety Probes (arxiv.org, 2026-10-26T04:00:00)
Score: 11.78
arXiv:2610.30678v2 Announce Type: replace-cross
Abstract: Safety probes trained on a model's activations are a standard tool for monitoring language models in real time. Each time a new model is released or a new harm area needs to be monitored, the probe must be retrained, which requires new labels and a choice of probe architecture. Yet neither the model nor the labels tell us in advance how well the resulting probe will perform. Finding out requires training and comparing many probe con - How IskayPet unified corporate knowledge with Amazon Bedrock Managed Knowledge Bases (aws.amazon.com, 2026-10-22T18:01:53)
Score: 11.567
Learn how IskayPet, a leading pet care company in Iberia, built a multilingual corporate knowledge assistant on Amazon Bedrock Managed Knowledge Bases. The assistant answers employee questions across retail, veterinary, onboarding, and procurement in four languages and three countries, with no RAG infrastructure to manage. - SynMark: Semantic-Coordinate Multi-Bit Watermarking during LLM Code Generation (arxiv.org, 2026-10-26T04:00:00)
Score: 11.48
arXiv:2610.32017v1 Announce Type: new
Abstract: LLM-generated code is increasingly reused across downstream applications and often undergoes identifier renaming or structural refactoring, making robustness to functionality-preserving edits essential for generative multi-bit code watermarking. Existing methods commonly derive message routes from surface-token prefixes, so such edits can desynchronize routing and degrade watermark recovery. We propose SynMark, which replaces surface-dependent rou - Embedding Large PQC KEMs in IKEv2 (arxiv.org, 2026-10-26T04:00:00)
Score: 11.48
arXiv:2610.32356v1 Announce Type: new
Abstract: Post-quantum key encapsulation mechanisms carry public keys far larger than the established VPN handshake protocol IKEv2 was designed for. At the same time, its initial exchange comprising the public keys cannot be fragmented. In response, the IETF discusses a range of protocol adjustments, yet these proposals have never been compared in terms of their performance and stability under identical conditions. We systematically screened the IETF docume - Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks (www.microsoft.com, 2026-10-23T18:12:19)
Score: 10.907
Microsoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations. The post Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks appeared first on Microsoft Security Blog . - Constitution-Guided Watermarking (arxiv.org, 2026-10-26T04:00:00)
Score: 10.78
arXiv:2610.09552v2 Announce Type: replace
Abstract: Regulation such as the EU AI Act requires providers of language models to mark generated text in a machine-readable way. Watermarking meets this requirement by embedding a secret-key signal during generation, so the provider can later detect its model's text. A watermark should stay detectable, preserve quality and survive paraphrasing, but a stronger signal survives more paraphrasing and distorts more text. Providers resolve this trade-o - Adaptive agentic intelligence framework using Strands Agents (aws.amazon.com, 2026-10-21T21:23:26)
Score: 10.662
The Adaptive Agentic Intelligence Framework (AAIF), built with Strands Agents, handles routine tasks locally with small language models and routes complex requests to cloud models through Amazon Bedrock. This post walks through building AAIF with local SLMs through Ollama and Amazon Bedrock, using an Internet of Things monitoring scenario. - LiteLLM Compromised in Fresh Supply Chain Attack (www.securityweek.com, 2026-10-23T08:10:46)
Score: 10.507
Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker. The post LiteLLM Compromised in Fresh Supply Chain Attack appeared first on SecurityWeek . - From data to decisions: Conversational supply chain intelligence with Amazon Quick and Amazon Bedrock AgentCore (aws.amazon.com, 2026-10-20T17:52:50)
Score: 10.089
Enterprise supply chains are data-rich but insight-poor, with the data to decide scattered across ERP, monitoring, procurement, and email. This post shows how Amazon Bedrock AgentCore exposes those systems as a governed tool layer, and how Amazon Quick turns them into one conversational experience for business users, with a deploy-it-yourself walkthrough. - Pwn2Own Ireland 2026 – Day One Results (www.thezdi.com, 2026-10-06T09:28:31)
Score: 9.773
Welcome to Day One of Pwn2Own Ireland 2026! Today, 21 entries took the Pwn2Own stage to target multiple categories – including multiple Samsung attempts and our first Pixel entry. Follow the action live! We’ll be posting real-time updates and results throughout the competition on our blog and across social media. Stay up to date by following us on Twitter , Mastodon , LinkedIn , and Bluesky , and join the conversation using #Pwn2Own Ireland and #P2OIreland for continuous coverage. Here are the r - Pwn2Own Ireland 2026 – The Full Schedule (www.thezdi.com, 2026-10-05T18:11:29)
Score: 9.621
Fáilte! Pwn2Own Ireland 2026 has arrived in Cork, and the world's top security researchers are ready. We've got more phone entries than we've ever had, and more than 60 entries total. Earlier today, we held the random draw to determine attempt order. Below is the official schedule. All times are Irish Standard Time (IST) and may change as the competition progresses. You can find our live leaderboard here . This will be updated throughout the day. Jump to: — Day One — Day Two —
Auto-generated 2026-10-26
