Weekly Threat Intelligence Summary

Top 10 General Cyber Threats

Generated 2026-11-02T05:00:06.917517+00:00

1. #StopRansomware: SafePay Ransomware (www.cisa.gov, 2026-10-19T19:18:07)
   Score: 16.566
   Advisory at a Glance Title #StopRansomware: SafePay Ransomware Original Publication October 20, 2026 Executive Summary This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using p
2. Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (www.cisa.gov, 2026-10-06T16:22:53)
   Score: 14.379
   Advisory at a Glance Title Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data Original Publication October 8, 2026 Executive Summary Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including US critical infrastructure sectors. Thes
3. PHP2Shell Exploitation: Two Critical PHP Flaws Explained (www.recordedfuture.com, 2026-10-21T00:00:00)
   Score: 7.665
   Two critical PHP remote code execution flaws (PHP2Shell) are reportedly being exploited. See who’s exposed, how the exploits work, and how to remediate now.
4. Have an older iPhone or iPad? Apple has a security update for you (www.malwarebytes.com, 2026-10-29T11:03:18)
   Score: 7.575
   Apple has fixed a flaw exploited in targeted attacks to the iPhone XS, XS Max and XR, and seventh-generation iPad.
5. Prediction Markets Emerge as a New Vertical for Traffer Teams (www.recordedfuture.com, 2026-10-29T00:00:00)
   Score: 7.499
   Discover how Russian traffer teams use turnkey fraud infrastructure to exploit prediction markets.
6. Artificial Intimacy: Love and lies in the age of AI (www.malwarebytes.com, 2026-10-27T12:40:00)
   Score: 7.253
   Our latest report reveals how AI is reshaping our relationships, blurring what feels authentic, and creating new ways for intimacy to be exploited.
7. Crime Stoppers chapter freezes tips after breach breaks anonymity promise (www.malwarebytes.com, 2026-10-23T09:57:48)
   Score: 7.068
   A Crime Stoppers chapter has stopped accepting tips after a breach exposed information about anonymous tipsters.
8. Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation (www.crowdstrike.com, 2026-10-23T05:00:00)
   Score: 6.533
9. Fake PDF and search tools hijacked searches for 13.4 million Chrome users (www.malwarebytes.com, 2026-10-30T15:25:41)
   Score: 5.772
   319 Chrome extensions sent search queries through servers controlled by their operators, allowing them to see what users searched for.
10. Photo ID, bank checks, face scan? The UK’s age-check options (www.malwarebytes.com, 2026-10-30T13:00:02)
    Score: 5.756
    Ofcom has set out four possible age-verification methods for UK’s under-16 social media ban.

Top 10 AI / LLM-Related Threats

Generated 2026-11-02T06:02:22.067143+00:00

1. CLIC: Closed-Loop Intent Consistency for Securing LLM-Driven Control in Open RAN (arxiv.org, 2026-11-02T05:00:00)
   Score: 23.79
   arXiv:2610.40744v1 Announce Type: new
   Abstract: With the progressive capabilities of large language models (LLMs), researchers are finding ways to integrate them into the control loops of Open Radio Access Network (O-RAN) to enable slicing and resource management through user intents. However, integration of LLMs in the O-RAN control loop via the RAN Intelligent Controller (RIC) makes the system vulnerable to \textit{runtime prompt injection threats}, which manipulate control decisions without
2. What Standard Evaluations Hide About Detectors of Hijacked LLM Agents: Rare Attacks, Unseen Tools and Benchmark Transfer (arxiv.org, 2026-11-02T05:00:00)
   Score: 19.79
   arXiv:2610.41803v1 Announce Type: new
   Abstract: Detectors can flag hijacked large language model (LLM) agents from the traces of the tools they call. In the eleven evaluations we audited, attacks or anomalies make up 16% to 86% of the test samples, no evaluation varies that share, and six report no test on data from a second benchmark or source. We ask what such evaluations hide. On the AgentDrift and AgentDojo benchmarks we test trained detectors that read tool identities, behavior, call seque
3. Characterizing Recoverable Expert-Utilization Signatures in Fine-Tuned Mixture-of-Experts LLMs (arxiv.org, 2026-11-02T05:00:00)
   Score: 17.79
   arXiv:2610.41039v1 Announce Type: cross
   Abstract: As Mixture-of-Experts (MoE) large language models are increasingly deployed in distributed environments, from federated learning to edge-cloud systems, their architecture harbors an underexplored landscape of security vulnerabilities. Moving beyond textual analysis, we uncover structural memorization: a novel vulnerability where a fine-tuned model memorizes not only its training data but also the internal pathway used to process it, creating a c
4. Watermark Robustness and Radioactivity May Be at Odds in Federated Learning (arxiv.org, 2026-11-02T05:00:00)
   Score: 17.79
   arXiv:2510.17033v2 Announce Type: replace
   Abstract: Federated learning (FL) enables fine-tuning large language models (LLMs) across distributed data sources. As these sources increasingly include LLM-generated text, provenance tracking becomes essential for accountability and transparency. We adapt LLM watermarking for FL data provenance, where a subset of clients computes local updates on watermarked data, and the server averages all updates into the global LLM. We find that several evaluated
5. A Unified Attack Framework against Statistical Generative Watermarks for Large Language Models (arxiv.org, 2026-11-02T05:00:00)
   Score: 16.79
   arXiv:2610.27653v2 Announce Type: replace
   Abstract: Watermarking has emerged as a key tool for identifying text generated by large language models (LLMs), with current schemes embedding statistical signals into the generation process to enable later detection. In this work, we identify a shared weakness across a broad class of popular LLM watermarking methods, including KGW (and its variants), GumbelSoft, DipMark, ITS, and SynthID. We show that these schemes exhibit a fundamental link between t
6. AgentShield: Fortifying Web Applications Against AI Agents and Agentic Browsers (arxiv.org, 2026-11-02T05:00:00)
   Score: 16.49
   arXiv:2610.41181v1 Announce Type: new
   Abstract: LLM-powered browser agents are transforming web automation by autonomously interacting with websites and executing complex workflows. However, the effectiveness of existing anti-bot defenses against these systems remains unclear. We present a systematic empirical evaluation of modern agentic browsers against widely deployed anti-bot mechanisms, characterizing their capabilities, limitations, and behavioral differences from humans. Our results show
7. Your Next Insider Threat Won’t be Human: Securing AI Agents From the Outside in (www.rapid7.com, 2026-10-19T16:34:43)
   Score: 15.571
   Why the controls on an AI agent have to live outside of it, and what a security operations team can do to implement and maintain those controls. The new privileged user in your environment Security teams spent two decades learning how to work with the people they trust most. Domain admins, DBAs, finance approvers and contractors with VPN access all get a mature playbook: verified identity, scoped access, logged activity and a fast way to revoke it all. Today, we’re navigating the same kind of ac
8. Filter generation in practice: from algorithms to LLMs (securelist.com, 2026-10-30T10:00:44)
   Score: 14.825
   We automate filter generation for security alerts using an algorithm, a large language model, and a group of LLM agents.
9. Accept Changes, Reject Attacks: Robust Memory Management for LLM Agents (arxiv.org, 2026-11-02T05:00:00)
   Score: 14.79
   arXiv:2610.41056v1 Announce Type: new
   Abstract: Since large language model (LLM) agents rely on long-term memory, what they store now shapes what they do later. A memory manager decides how each input changes this memory and which records the agent acts on. It can fail in two ways: keeping a fact that has since changed (outdated memory), or storing a planted passage or injected instruction (memory poisoning). Most prior work studies them separately, yet they call for opposite write decisions, s
10. When Safety Checks Become Privacy Risks: A Privacy-Preserving Paradigm for LLM Agent Safety Auditing (arxiv.org, 2026-11-02T05:00:00)
    Score: 14.79
    arXiv:2610.41401v1 Announce Type: new
    Abstract: Large language model agents interact with online services through tool calls that may access private data or perform sensitive actions. Specialized providers can supply and maintain pre-execution safety auditing capabilities for agent operators. However, sending task descriptions, call arguments, and interaction histories to an external auditor may expose sensitive user information. In this work, we propose a paradigm for privacy-preserving safety
11. From Training Exposure to Membership Evidence: A Controlled Study of OLMo 2 (arxiv.org, 2026-11-02T05:00:00)
    Score: 14.79
    arXiv:2610.41732v1 Announce Type: new
    Abstract: Whether a language model was trained on a document matters for copyright, privacy, and benchmark contamination. Yet most membership-inference (MI) evaluations on language models collect members and non-members after the fact, so success may reflect distribution shift and failure is inconclusive. We re-ran OLMo 2 1B's official 50-billion-token mid-training stage, replacing selected training chunks with documents from 7,814 pairs matched on dom
12. How Much Can Tool Calls Reveal About You? Privacy Leakage from Tool-Call Traces (arxiv.org, 2026-11-02T05:00:00)
    Score: 14.79
    arXiv:2610.41885v1 Announce Type: new
    Abstract: Large language model (LLM)-based agents interact with external tools through protocols such as the Model Context Protocol (MCP), producing tool-call traces that may expose behavioral signals about users. In this work, we systematically study the risk of user-profile inference from MCP tool-call traces, where observers infer user attributes from protocol-valid tool interactions without access to user conversations. We introduce PrivacyTrace, a benc
13. STRIATUM-CTF: A Protocol-Driven Agentic Framework for Autonomous CTF Solving (arxiv.org, 2026-11-02T05:00:00)
    Score: 14.79
    arXiv:2603.22577v2 Announce Type: replace
    Abstract: Autonomous cyber operations increasingly depend on agents that can chain reconnaissance, exploitation, and analysis across many tools while maintaining state over long task horizons. Large Language Models (LLMs) are promising orchestrators for this workflow, but naive agents that pipe model output directly into a shell are brittle: they emit malformed commands, hallucinate non-existent command-line options or packages, and lose track of earlie
14. SoK: Agentic Retrieval-Augmented Generation (RAG): Taxonomy, Architectures, Evaluation, and Research Directions (arxiv.org, 2026-11-02T05:00:00)
    Score: 14.79
    arXiv:2603.07379v2 Announce Type: replace-cross
    Abstract: Retrieval-Augmented Generation (RAG) systems are increasingly evolving into agentic architectures where large language models autonomously coordinate multi-step reasoning, dynamic memory management, and iterative retrieval strategies. Despite rapid industrial adoption, current research lacks a systematic understanding of Agentic RAG as a sequential decision-making system, leading to highly fragmented architectures, inconsistent evaluatio
15. Erase the Injected Region: Multimodal Prompt-Injection Defense with On-Policy Self-Distillation (arxiv.org, 2026-11-02T05:00:00)
    Score: 14.49
    arXiv:2610.41307v1 Announce Type: new
    Abstract: Multimodal indirect prompt injection embeds malicious instructions in external media that also contains information needed for the user's task. Existing defenses can block the attack yet impair the model's use of that information, leaving a gap between attack defense and task preservation. We propose ERASE, an on-policy self-distillation method that constructs its reference by erasing the injected region in place. Modality-appropriate bl
16. SecPO: Principled Adversarial Training for Prompt Injection Security (arxiv.org, 2026-11-02T05:00:00)
    Score: 13.49
    arXiv:2610.41998v1 Announce Type: new
    Abstract: Recognized as a top threat to AI agents, prompt injection allows instructions from untrusted data (email, documents, websites) to manipulate the agent's operation. The existing best-defended LLM, Meta-SecAlign, is trained with the DPO loss but still suffers from attack success rates (ASRs) approaching 100% under adaptive prompt injections. One reason is that DPO anchors the model around the undefended reference model, which is insecure. We sh
17. Can Agentic Code Review Catch Vulnerabilities Before They Are Merged? (arxiv.org, 2026-11-02T05:00:00)
    Score: 13.49
    arXiv:2610.33509v2 Announce Type: replace-cross
    Abstract: LLM agents have been increasingly adopted for security-focused code review, but existing benchmarks mostly derive the reviewed changes from their later fixes instead of the real-world bug-introducing commits. In this paper, we present SecPRBench, the first comprehensive benchmark for evaluating agentic security review on validated real-world code changes. More specifically, we have built an automated agentic pipeline to autonomously harv
18. Prevented is Not Protected: What Attack Success Rate Hides about RAG (arxiv.org, 2026-11-02T05:00:00)
    Score: 12.49
    arXiv:2610.40742v1 Announce Type: new
    Abstract: Retrieval-Augmented Generation (RAG) is vulnerable to knowledge poisoning, where adversaries manipulate retrieved evidence to influence model outputs. Existing defenses are primarily evaluated using attack success rate (ASR), which obscures defense-induced failures and the mechanisms behind apparent attack prevention. To address this issue, this work introduces \textbf{Aligned RAG Evaluation}, a matched-query protocol that jointly examines clean a
19. When AI Investigators Cannot Trust Their Tools: Conflict-Aware Evidence Verification for Cyber Threat Investigation (arxiv.org, 2026-11-02T05:00:00)
    Score: 12.49
    arXiv:2610.41191v1 Announce Type: new
    Abstract: LLM agents increasingly triage security alerts by combining the outputs of several detection tools, implicitly treating those tools as trustworthy. Unlike prior work on conflicts between a model's knowledge and its context, we study conflicts among the tools themselves: what happens when this machine-generated evidence is conflicting or wrong. On the corrected CIC-IDS2017 dataset, four heterogeneous detectors emit labels and confidences that
20. Expected Harm: Rethinking Safety Evaluation of (Mis)Aligned LLMs (arxiv.org, 2026-11-02T05:00:00)
    Score: 12.49
    arXiv:2602.01600v2 Announce Type: replace
    Abstract: Current evaluations of LLM safety predominantly rely on severity-based taxonomies to assess the harmfulness of models' responses to malicious queries. We argue that this formulation requires re-examination as it implicitly equates model output with realized harm while neglecting Execution Likelihood-the conditional probability of a threat being realized by a real-world actor given a model's response. In this work, we introduce Expect
21. Configure the ChatGPT desktop app with Amazon Bedrock in AWS GovCloud (US) (aws.amazon.com, 2026-10-30T17:27:45)
    Score: 11.799
    The ChatGPT desktop app is now available on Amazon Bedrock in AWS GovCloud (US). This post walks through a controlled local deployment that routes model inference to Amazon Bedrock in AWS GovCloud (US-West) using API-mode sign-in, a managed device policy, a named AWS profile, and network restrictions, so a security team can validate it before broader use.
22. Safin-1.5: Safety-Native Architecture and Verifiable Reasoning for Recursive Safety Improvement (arxiv.org, 2026-11-02T05:00:00)
    Score: 11.79
    arXiv:2610.40751v1 Announce Type: new
    Abstract: Recursive self-improvement (RSI) enables large language models to advance their capabilities through successive updates, but these updates can also introduce new risks and weaken existing safeguards. In line with the AI-45{\deg} Law, we pursue Safety RSI, in which safety develops as an intrinsic capability alongside general model capabilities through continual risk discovery and repair, while preserving utility and limiting over-refusal. We introd
23. Simple Features Beat Most AI Control Monitors (arxiv.org, 2026-11-02T05:00:00)
    Score: 11.79
    arXiv:2610.41713v1 Announce Type: new
    Abstract: AI control relies on monitors to catch a capable model that sabotages its work. These monitors are evaluated on their ability to differentiate honest from backdoored code. We show that on a standard evaluation dataset, simple features beat most monitors without ever running the code, outranking 20 of 24 open-weight models prompted as monitors. The dataset gives its labels away in two ways. People wrote the honest solutions and older language model
24. Accelerate agentic AI with NVIDIA Nemotron models on Amazon EKS and SageMaker HyperPod EKS (aws.amazon.com, 2026-10-29T16:11:08)
    Score: 11.548
    NVIDIA Nemotron 3.5 Super VL is a 120B-parameter mixture-of-experts model that pairs reasoning and tool use with multimodal understanding. This post explores its architecture and use cases, then shows how to deploy it on Amazon EKS, EKS Auto Mode, and Amazon SageMaker HyperPod EKS with NVIDIA Dynamo and vLLM.
25. Evaluating Structural and SAT Attack Resilience in Cryptographic Dynamic Logic Locking via Keystream Capping (arxiv.org, 2026-11-02T05:00:00)
    Score: 10.49
    arXiv:2610.41083v1 Announce Type: new
    Abstract: Untrusted third-party entities throughout the semiconductor supply chain expose proprietary hardware intellectual property to reverse engineering, piracy, and overproduction. While logic locking counters this threat by embedding key-dependent logic, conventional static key-gates remain vulnerable to both oracle-guided SAT attacks and structural removal attacks due to their time-invariant netlist signatures. Dynamic schemes such as STREAMLOCK mitig

Auto-generated 2026-11-02