Tag: Security

An autonomous AI agent discovered four vulnerabilities in the decades-old, widely used EPICS (Experimental Physics and Industrial Control System) open source software toolkit, including a critical flaw that could allow remote attackers to execute code on systems used to control particle accelerators and fusion experiments. The bugs include a critical, 9.8-rated under CVSS v3.1 integer overflow vulnerability (CVE-2026-114595), leading to an attacker-controlled out-of-bounds heap write and potentially remote code execution; an 8.2-rated, high-severity, improper message-length validation flaw (CVE-2026-114596), causing an out-of-bounds memory write and controller-process crash; a 7.5-rated, high-severity insufficient bounds checking bug (CVE-2026-114597) that allows out-of-bounds memory reads and process crashes; and a 7.5-rated, high-severity type confusion flaw (CVE-2026-114598) that can lead to denial of service and could expose adjacent memory contents. All four affect EPICS Base, which is used to operate some of the world’s largest scientific research projects and facilities, and organizations should update to version 7.0.11, which includes the fixes. “Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code,” the US Cybersecurity and Infrastructure Security Agency (CISA) warned in a Tuesday advisory. An AI agent called Cipher independently found all four previously unknown security holes – investigating and testing the unfamiliar EPICS system, and validating the four exploits – in three hours and 49 minutes, Causal Security co-founder Shubham Raj told The Register. “The initial investigation required no human intervention, followed by one instruction authorizing deeper exploitability testing in a secure environment,” Raj said. Earlier this year, Causal Security’s Cipher, which Raj described as “a fully autonomous super hacker that can reason across the technology stack,” found multiple critical attack paths in power-grid systems used across North America and Europe, prompting an October 8 security advisory from CISA. EPICS, originally developed by Los Alamos National Laboratory and Argonne National Laboratory, is used to build and remotely control distributed Supervisory Control and Data Acquisition (SCADA) systems, connecting operators to physical devices. It’s used in around 90 major scientific, university, and industrial projects and facilities globally including Argonne National Laboratory’s Advanced Photon Source and ITER’s fusion reactor control system. All four of these flaws illustrate how AI agents are really good at finding vulnerabilities in industrial and operational technologies – systems and equipment that used to be able to rely on obscurity to protect them from hackers – and add to defenders’ concerns that it’s only a matter of time until an autonomous cyberattack shuts down critical services, like power grids or water systems. These are the types of digital intrusions that can cause physical harm. Raj points to CVE-2026-114595, the critical integer-overflow vulnerability, as an example. “It allows attacker-controlled network data to cause an out-of-bounds heap memory write, with potential for remote code execution,” he told us. “EPICS controllers sit between operators and physical equipment, handling measurements, commands, and control functions,” he continued. “Operationally: Imagine a particle accelerator in the middle of an expensive experiment. An attacker could potentially crash a controller, interrupt critical measurements or control functions, and force operators to halt the experiment. That could mean lost experimental work, significant downtime, and expensive recovery.” Plus, if an attacker was able to develop an RCE exploit, this could allow them to “take control of the affected process, manipulate readings, interfere with control functions, or disrupt the equipment connected to it,” Raj said. The prerequisite for exploiting these vulns in a real scientific facility is being able to reach the vulnerable EPICS services on a facility’s control network. But this could occur if the networks weren’t sufficiently segmented, or another system had access to the vulnerable EPICS network. “Once an attacker is able to find a network, which is either misconfigured or they are able to reach, it’s pretty easy to carry out the attacks,” Raj said, adding that exploitation wouldn’t require deep OT knowledge, or understanding of how particle accelerators or fusion reactors work. “Someone with conventional exploitation skills could investigate them, and increasingly capable AI systems could help develop exploits without requiring specialized OT expertise.” Manipulating specific physical processes does require additional knowledge, he added. “But an attacker doesn’t need to understand the physics of a particle accelerator to disrupt the software controlling it. Crashing critical processes or interrupting monitoring and control can already have serious operational consequences. What’s changing is that attackers may no longer need years of specialized expertise just to discover these weaknesses.” ®

Source: The Register Security · 2026-10-27

Microsoft has released another out-of-band update for Windows, but this one isn’t an emergency fix for the latest breakages. This time, it’s all about certificates. The non-security out-of-band release applies to supported OSes ranging from Windows 11 and Windows Server 2025, to Windows 10. It’s all about updating the current certificate trust list (CTL) of devices that cannot access Microsoft’s certificate-update service, or where automatic CTL updates are disabled. It also contains everything in the October 13 update, including the ongoing VPN issues and the change that could break on-premises Exchange Servers. There might also be oddities with Smart App Control, audio, and Remote Desktop connections for non-admin users, all of which are known issues in the October 13 update. These problems are not resolved in this patch, so be aware of this when installing it. It is also worth remembering that many devices will not need this version since the current certificate list updates usually come down through the update service. However, if that service isn’t available or being used, it might be a good idea to get this out-of-band fix (while keeping the known issues in mind), since problems can occur when verifying certificates used by applications or websites. The OOB update came after Microsoft laid out its response to the compromised eMudhra certificate keys. The Indian certification authority’s private keys were compromised earlier this month, requiring a massive cleanup effort. According to Microsoft, “they could potentially be used to create certificates or sign content that appeared to come from a trusted CA [certificate authority].” Like many other organizations, Microsoft moved swiftly to block the affected certificate authorities. It did so by updating its Windows Disallowed Certificate Trust List to block the affected certificates. There was also a separate CRLSet release for Edge and WebView2. According to the Windows behemoth, “On October 26, Microsoft released an out-of-band Windows update that removes seven certificates associated with the affected hierarchies: six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list.” Microsoft’s out-of-band patches are usually released after the company breaks a product and needs to issue an emergency fix. This time, the revision is due to Somebody Else’s Problem and a need to get a CTL update out to devices that are disconnected from CTL updates. ®

Source: The Register — Security · 2026-10-27

Microsoft has released another out-of-band update for Windows, but this one isn’t an emergency fix for the latest breakages. This time, it’s all about certificates. The non-security out-of-band release applies to supported OSes ranging from Windows 11 and Windows Server 2025, to Windows 10. It’s all about updating the current certificate trust list (CTL) of devices that cannot access Microsoft’s certificate-update service, or where automatic CTL updates are disabled. It also contains everything in the October 13 update, including the ongoing VPN issues and the change that could break on-premises Exchange Servers. There might also be oddities with Smart App Control, audio, and Remote Desktop connections for non-admin users, all of which are known issues in the October 13 update. These problems are not resolved in this patch, so be aware of this when installing it. It is also worth remembering that many devices will not need this version since the current certificate list updates usually come down through the update service. However, if that service isn’t available or being used, it might be a good idea to get this out-of-band fix (while keeping the known issues in mind), since problems can occur when verifying certificates used by applications or websites. The OOB update came after Microsoft laid out its response to the compromised eMudhra certificate keys. The Indian certification authority’s private keys were compromised earlier this month, requiring a massive cleanup effort. According to Microsoft, “they could potentially be used to create certificates or sign content that appeared to come from a trusted CA [certificate authority].” Like many other organizations, Microsoft moved swiftly to block the affected certificate authorities. It did so by updating its Windows Disallowed Certificate Trust List to block the affected certificates. There was also a separate CRLSet release for Edge and WebView2. According to the Windows behemoth, “On October 26, Microsoft released an out-of-band Windows update that removes seven certificates associated with the affected hierarchies: six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list.” Microsoft’s out-of-band patches are usually released after the company breaks a product and needs to issue an emergency fix. This time, the revision is due to Somebody Else’s Problem and a need to get a CTL update out to devices that are disconnected from CTL updates. ®

Source: The Register Security · 2026-10-27

Japanese ISP GMO Internet has warned customers the cloudy desktop service it offers as an ideal foreign exchange trading environment was compromised by an attacker, and that it had been slow to improve the service’s security. GMO runs a service called Onamae.com Desktop Cloud and last week admitted “a third party had installed malicious programs in the server environments of some customers.” That’s never welcome news but is an especially poor outcome because the servers host cloudy Windows desktops that GMO recommends customers use to host foreign exchange trading applications. In later updates the company revealed that some customers reported “unauthorized operations were performed on their trading accounts” and advised that third parties had probably seen users’ passwords for trading services. The next day, the company advised users to immediately change passwords for their trading accounts, and to do so using a device that they don’t use for trading. The company has since admitted that its Onamae.com Desktop Cloud service’s “systems had security vulnerabilities, that its environment was accessed without authorization, and that customer information was taken outside the Company.” “Some customers have also reported transactions in their trading accounts that they do not recognize.” Those transactions have GMO sufficiently worried that it contacted major trading services, asked them to forcibly terminate all active sessions, monitor for unauthorized transactions, and to block trade requests coming from the Onamae.com Desktop Cloud. Not paying, or complaining GMO said it has “received a demand for money from a person believed to be the attacker. We have also been told that, if we refuse, the attacker will take actions such as publishing information about the Company and our customers.” The attacker wants $50 million. The company won’t pay because it feels “complying would not guarantee that the obtained information is deleted or that its misuse is prevented.” Investigations into the incident continue, with GMO warning that 26,739 VDI servers may have been hit by the attack, and that users’ personal devices may be at risk. The company is offering all users a ¥5,000 ($32) condolence payment and promised to make good on any trading losses caused by the attack. This incident may have quite a blast radius, as GMO has warned that some trading apps may keep sessions alive even after passwords change. “Check your securities or FX company’s guidance or your account page, and either disconnect all active sessions or ask the company’s support desk to disconnect them,” GMO advised. That ¥5,000 isn’t going to get anywhere near paying for the work customers will do to sort this out. GMO CEO Masatoshi Kumagai acknowledged that in a blog post in which he described the payment as “a token of our initial sincerity towards our customers who have experienced inconvenience and worry.” “We will dedicate the full resources of our group to providing a free alternative environment for six months, fundamentally overhauling our system infrastructure, and conducting a thorough investigation into the cause and preventing recurrence with the help of external experts,” he added. But he also admitted that GMO knew the service’s security could be improved. “Our in-house white-hat hackers had previously pointed out areas for improvement to the team,” he wrote. “The team took these points to heart and was working on countermeasures.” “However, while we proceeded cautiously, considering the impact on service availability and prioritizing other issues, our response lacked sufficient depth and speed, allowing the attackers to exploit the vulnerability. I deeply regret that, despite having professionals on staff, we failed to fully translate their expertise into effective defenses as an organization.” The CEO also said GMO can’t secure itself without government help. “I’ve been involved in this world for 31 years, since the dawn of the internet industry,” he wrote. “The cyberspace that I built with my colleagues, believing it would bring smiles to people’s faces, is now on the verge of being completely destroyed by malicious actors.” “The ease with which open weight AI models can be combined and spread into countless attack tools has transformed cyberattacks, which once required advanced skills, into an era where anyone can easily carry them out,” he added, before claiming that GMO Group’s cybersecurity operation “has confirmed that the source of an unauthorized access attack targeting approximately 20 Japanese companies was the misuse of ‘ARTEX,’ an autonomous AI penetration testing tool originally intended for defense.” Kumagai thinks public/private partnerships are needed to improve infosec across Japan. “Yesterday, we submitted a proposal to the government to ‘apply proactive cyber defense,’” he wrote. “We are by no means trying to shift the blame for our company’s actions onto the government and beg for a bailout,” he wrote, but argued that unless Japan implements national-level defenses, more such incidents are unavoidable. ®

Source: The Register — Security · 2026-10-27

A new Miasma-family npm worm, originally believed to be just a test with no victims, secretly armed 42 real GitHub repositories from 11 owners, hijacking accounts as early as July and using a stealthy payload built to stay hidden from GitHub and automated scanners, according to JFrog researchers. Threat hunters at SafeDep, an open source supply chain security firm, first spotted the “testmetest” npm campaign last week, identifying 18 packages linked to the same operator between October 19 and October 25, including releases containing credential-stealing malware. As with earlier npm worms, the malware is self-replicating, steals credentials, and installs a wiper that deletes the home directory when the victim revokes the stolen GitHub token, the security researchers noted. The new npm worm shares code with June’s Miasma Phantom Gyp worm, and adds Mini Shai-Hulud’s token-revocation wiper. As of October 22, however, SafeDep had found no compromised third-party packages or victims. “All observed activity belongs to the operator’s own test accounts,” the team wrote. As with most happy-ending security stories, that proved too good to be true. In a Monday report, supply chain security company JFrog said its analysis proved otherwise, and found the testmetest campaign operator “had already armed real repositories belonging to established developers and organizations.” This isn’t just about timing, either, according to JFrog researchers Guy Korolevski and Yair Benamou. “The payload blobs were large enough to evade the GitHub search and API paths normally used to find this kind of compromise,” they wrote. How the attacks worked The attackers planted execution hooks for AI coding assistants and development tools, including Claude, Gemini, Cursor, and VS Code, alongside polymorphic wrappers measuring 12.9 to 13.7 MB that decode a hidden CI-publisher payload. Separately, the npm worm steals credentials, modifies repositories and CI configurations, and spreads through npm packages. The malware also uses a compiled native add-on to decrypt and launch a separate payload. Before executing, the loader checks for CI runners, containers, sandboxes, debuggers, and other signs of automated analysis, exiting silently when it detects them to reduce the likelihood of detection by security scanners. The researchers also found a second build that skips the encrypted file. “It forks, detaches and runs a hard-coded command that pulls a loader from a repository on the operator’s own GitHub account,” they wrote. That account – CementBeetleSteeple – hosted 17 campaign repositories in total. JFrog connected this account to a shellpanel scanner, previously documented by Socket in a large-scale campaign that abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 and steal server credentials. CVE-2026-41940 is an authentication bypass affecting cPanel and WHM. CISA added it to its Known Exploited Vulnerabilities catalog in April, and cPanel has since published patched versions. “C2 infrastructure were previously reported by Socket; our findings connect them to the testmetest GitHub victim cluster through artifacts and workflows on the same hijacked owners,” the JFrog researchers wrote. They added that while they found 42 armed GitHub repositories and attempted internet-wide exploitation, they did not confirm any downstream cPanel compromises.®

Source: The Register — Security · 2026-10-26

LiteLLM has traced last week’s supply chain attack to a master key it accidentally committed to a public GitHub repository in May. The cloud and AI model secret-stealing part of the incident began when someone uploaded a poisoned version (1.107.0) of the popular open source AI gateway to PyPI and its container registries last Wednesday. This compromised version contained an infostealer and a remote access trojan capable of executing arbitrary code on infected machines. While the trojanized package was available on PyPI for less than two hours before being quarantined, it received about 49,000 downloads during that time, according to Wiz. On Friday, LiteLLM detailed the attack chain behind the compromised release and traced it back to May 27, when a configuration file containing a master key was committed to the public LiteLLM-Labs/lite-harness repository. The key belonged to an open source tool used internally by LiteLLM to orchestrate AI agents. The project’s developers quickly spotted the error and removed the exposed commit, but failed to revoke the master key. “On October 10th, the threat actor used this key to gain access to our LiteLLM Agent Platform and extracted this GitHub CLI OAuth token,” according to Friday’s postmortem. “From this point onwards, the threat actor had owner-level access to all repositories in our GitHub.” This is especially serious because GitHub CLI tokens are “post-2fa,” meaning that they don’t trigger GitHub’s sudo mode authentication flows typically required to perform high-impact repository actions. The token allowed the attacker to author malicious commits into branches on other internal repos – including workflows designed to steal any tokens and secrets configured to be available during the continuous integration development process. And this allowed them to steal other GitHub CLI OAuth tokens linked to two engineers with maintainer privileges. Plus, they acquired tokens for several other internal systems, we’re told. “Reviewing the actor’s activity on these other systems shows attempts to identify and exfiltrate additional keys and tokens, with a primary focus on upstream inference API tokens,” LiteLLM noted. Having now stolen several privileged identities, the miscreant could make changes to GitHub repositories without raising any suspicion because the actions and approvals all appeared to come from legitimate, credentialed engineers. In response, LiteLLM’s developers are revoking every token associated with every internal system and vendor platform. “This incident has provided a strong illustration of the risks associated with failing to rotate a potentially exposed key,” they wrote. The infostealers hidden inside the compromised package were designed to hoover up a ton of sensitive information, including browser credentials and cookies from Chrome, Firefox, Edge, and Safari, along with AWS credentials, Google Cloud Platform service account keys and application default credentials, and Microsoft Azure tokens. It also swiped API keys for OpenAI, Anthropic, Cohere, and other LLM providers. So if you installed and ran version 1.107.0, assume any credentials accessible to the affected system may have been stolen. Investigate affected systems, change passwords, and rotate exposed keys. A quick prayer to the patron saint of supply chains wouldn’t hurt, either. ®

Source: The Register — Security · 2026-10-26

To address a vulnerability in Google’s Brotli compression technology that could allow attackers to corrupt process memory, Microsoft is urging .NET users to update “as soon as possible” after releasing an out-of-band (OOB) security update. It released new versions for .NET 8, 9, 10, and .NET 11 to patch against the Brotli bug, following similar updates from Node.js, Python, and other projects. Senior program manager Rahul Bhandari said in the October 25 release that the buffer overflow vulnerability in Brotli, tracked as CVE-2026-111497 and rated 8.1 under CVSS v3.1 in Microsoft’s advisory, could allow an unauthenticated attacker to read or corrupt process memory, potentially resulting in information disclosure, denial of service, or elevation of privilege. Microsoft’s own advisory for the vulnerability, which some are referring to as Broccoli2Shell or Node2Shell, confirms that while experts have cobbled working exploits together, there is nothing to suggest that criminals are using them in successful attacks. However, its exploitability assessment reads: “Exploitation More Likely.” Broccoli2Shell was first disclosed on October 21 by the Node.js team, which released fixes for ten vulnerabilities, the most serious of which was CVE-2026-111497. Node.js credited Khai Tran and Sylvie Mayer of OpenAI’s Codex Security with the discovery, but failed to mention why it was only recognized as a security flaw and disclosed properly in October, despite the underlying bug having been fixed in Brotli’s source code in February. OpenAI filled in the gap with a Xeet: “This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability, and there was no more recent release of Brotli. “Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software.” Attackers can exploit vulnerable systems by providing them with malicious Brotli-compressed data via a specially crafted request. The vulnerability went slightly under the radar due to the disclosure timing closely aligning with that of PHP2Shell, although fixing the critical flaw should be a priority due to the range of technologies that are affected. In addition to .NET, Node.js, and Python, Bun, Envoy, and Istio have all released patches, and JFrog has worked up an exploit affecting FFmpeg using a specially crafted JPEG XL image, extending the exploit path beyond HTTP. It said that FFmpeg reaches Brotli through libjxl, which it uses to decompress metadata stored in brob boxes within the image format. The same researchers said the vulnerability affects Apache Arrow too, with attackers able to cause a denial of service. Merav Bar, threat researcher at Wiz, added that cloud users are exposed extensively, noting that 91 percent of cloud environments rely on components vulnerable to the Brotli flaw and that 82 percent of cloud environments have publicly exposed Node.js instances. She said: “Cloud environments are particularly exposed due to the widespread use of Brotli-enabled components across containerized applications, Kubernetes clusters, API gateways, reverse proxies, serverless workloads, and cloud-hosted web services.” “Successful exploitation could enable attackers to compromise application workloads, access sensitive information, disrupt service availability, or execute malicious code within affected containers or runtime environments,” Bar added. In an advisory published through its Patch the Planet initiative, OpenAI recommended blocking untrusted Brotli-compressed data where practical until patches can be applied. It also advised maintainers to rebuild affected deployments and restart services to ensure the fixes take effect. ®

Source: The Register — Security · 2026-10-26

A UK-based developer and pentester has claimed a $2,000 Bitcoin prize for demonstrating the exploitability of the PHP2Shell vulnerabilities that melted the internet last week. Jaydip Modhwadia, 26, otherwise known as “Killa,” claimed the prize set by James Pavur, who launched the “Steal My Bitcoin” site on October 24. Pavur launched the CTF (capture the flag) challenge to prove that the PHP2Shell exploit was not as easy as those in the cybersecurity community claimed it to be, promising to award $2,000 in Bitcoin to anyone who could achieve Remote Code Execution (RCE) on his website. “My Bitcoin was stolen after 19.28 hours,” the website now says, after Modhwadia claimed the prize, although the real time taken is thought to be less than three hours. Soon after Pavur launched the CTF on Saturday, prospective flag-catchers complained that the website he set up, which served only static HTML, was not built in a way that allowed the PHP2Shell exploit to achieve RCE. The web page was running a vulnerable version of PHP, but the exploit path required a vulnerable website to serve a PHP file for flag-catchers to use as a hook – something that Pavur seemingly updated at around 1300 UTC on October 25. Modhwadia achieved RCE on the website, exposing a PHP endpoint, at 1547 UTC. After an error from Pavur placing the wrong wallet key on the server, the CTF creator sent Modhwadia his award, which the community upped to $2,000 from Pavur’s initial $500. The pentester published a write-up of his method, a single-file Python script he says requires 20 HTTP requests “at most” to fully execute. Speaking to The Register, Modhwadia also confirmed that he got the flag in “around three or so hours in total.” He said he followed the news about the competition, “but didn’t attempt it until it gained significant notice.” If he had attempted it before Pavur introduced the endpoint, he may have struggled. For hours, bug bounty hunters were trying to access the website to attempt the challenge, as news of the CTF had exploded across tech circles. “The fact that it took 19 hours was because after it went popular, the entire site became basically unusable for anyone at all,” Modhwadia added. The challenge saw a huge number of attempts, despite Pavur’s decision to introduce a prohibitive 1MB request limit on Nginx. Alon Gal, co-founder and CTO at Hudson Rock, commended Modhwadia’s work, but added that his success achieved in just a few hours should not be taken to mean that the same attack could be automated at scale. He said: “Does this mean autonomous AI agents can now compromise arbitrary PHP servers at scale? No. This was a sophisticated, target-specific exploit. “But it does demonstrate that PHP2Shell can be weaponized against a live target, even with meaningful technical constraints.” Modhwadia’s proof of concept is not the first to prove PHP2Shell is exploitable, but it falls under the more advanced category. Early signs suggested that Address Space Layout Randomization (ASLR) on a vulnerable server would prove a significant barrier to real-world exploitation, and the pentester’s solution bypasses it, along with the others that were disclosed recently. Spencer McIntyre, director of exploit development at VulnCheck, told The Register last week that attackers are finding new ways to exploit PHP2Shell, and “are clearly spending time (and tokens) on this bug.” Initially, experts said exploit code was being found online hours, or even days, before the vulnerabilities were disclosed publicly, which led to millions of exploit attempts, although it was too early to determine the efficacy of these on real-world systems. Scores of websites were taken down for maintenance last week as organizations raced to protect themselves from the attacks, which may or may not have proved successful. Modhwadia said he donated a portion of the prize he received to the Lupus Foundation to raise awareness about the condition, from which he also suffers. ®

Source: The Register — Security · 2026-10-26