This week brought the usual October load, with 1,411 Microsoft fixes on Patch Tuesday and three chained Ivanti VPN zero-days.
Last week we wrote about bug bounty programs and code hosts writing new rules for AI-found reports. This week Bank of America described its own Mythos cleanup. On Wednesday's earnings call and in a CNBC interview the same day, CEO Brian Moynihan said the bank brought in 1,000 consultants to fix the flaws Anthropic's Mythos and other AI models found in its software, on top of about 3,000 of its own staff already on it. In May, JPMorgan's Jamie Dimon said his bank had "hundreds of people doing it full time." Euro-area banks owe their supervisors a plan for AI-enabled threats by October 31.
Moynihan didn't split the Mythos cost from the AML work, so we're still waiting for a bank to say what this actually costs.
Bank of America's Mythos headcount came out in answer to a question about AI and revenue per employee. Wells Fargo analyst Mike Mayo asked it on the October 14 third-quarter call, and CEO Brian Moynihan said a couple hundred million dollars of the quarter's expense growth was "remediation for the AML and remediation for the Mythos implementation" (transcript). He expects "the Mythos remediation costs run down because we added 1,000 extra staff to work on that, not in the headcount but in consultants." He did not split the Mythos share from the anti-money-laundering work, which follows a $1.2 billion FinCEN penalty announced the day before.
In a CNBC interview the same day, Moynihan said the contractors arrived in the second quarter and joined about 3,000 of the bank's own staff already doing the work, and that the weaknesses were in code the bank wrote and code its vendors supplied. Bank of America was one of the banks whose CEOs Treasury and the Fed briefed on Mythos in April. In May the Fed and the OCC paused some cyber exams of the largest banks so they could work through what the model found.
European supervisors have set a date. The ECB's July 7 letter gives every significant euro-area bank until October 31 to send its supervisory team an action plan for AI-enabled cyber threats. The short-term priorities it lists are vulnerability and patch management, AI-enabled monitoring, and a check that third-party risk management is fit for purpose. To make room, it moved the annual IT risk questionnaire from September to February 2027.
If you sell software to a bank, we'd expect its next due-diligence questionnaire to ask what a frontier model found in your code, since Moynihan said the cleanup covered vendor code and the ECB wants euro-area banks' October 31 action plans to verify their third-party risk management.
Trail of Bits' Keegan Ryan tested 25 package managers against a repository that injects code into legitimate packages. Only Go and vcpkg verified every download by default. Nine, including npm, Cargo, Bundler and uv, catch tampering only when a lockfile is present, five need a lockfile plus extra steps, and nine, among them Maven, Composer and Gem, don't verify downloads at all. Only Go checks signatures by default.
Composer writes a Git commit hash into composer.lock but never checks the downloaded ZIP against it, and Pub warns about a hash mismatch and installs anyway unless you pass --enforce-lockfile.
Bloom Security's Golan Myers showed that npm Trusted Publishing tied a package to a GitHub owner and repo name rather than the repository's permanent ID. If that repo was renamed or deleted before the binding was ever used, anyone could create a repo under the old name and publish.
Myers counts more than 1,500 exposed packages with over 10 million downloads, reported the bug on June 6, and says GitHub's last substantive reply came on July 8. GitHub now expires trusted-publishing configurations that haven't published within 48 hours of creation.
At Docker, CVE-2026-105445 handed a user's personal access tokens to whoever became owner when the account was converted to an organization, without rotating them or telling anyone, from August 2024 until September 30. Docker fixed it less than four hours after the report, deactivated the transferred tokens on October 8, and says a review of about 304,000 pushes made with them found no sign of abuse.
Bloom isn't naming the 1,500 packages, and a binding that an attacker already published through counts as validated, so GitHub's expiry doesn't touch it. For a package whose GitHub repo you renamed or deleted, its npm publish history is the record of whether someone else shipped a version.
XBOW published how it built the Chrome full chain that it says earned the first $250,000 full-chain award under the Chrome VRP rules Google introduced in April. Agents running OpenAI's gpt-5.6-sol searched source code, built proofs of concept and wrote the exploit stages between August 2 and 7, while XBOW researchers "chose targets, supplied context, challenged results, redirected searches," Brendan Dolan-Gavitt writes. XBOW puts the API bill, reconstructed from its logs, at about $40,000.
The chain has three bugs, all now fixed. A bug in Maglev, one of V8's optimizing compilers, reuses a mutable number during deoptimization to read and write anywhere inside V8's pointer-compression cage, a heap overflow in Blink's animated WebP decoder gives one chosen native write outside the cage, and an overflow in Crashpad, the crash handler that runs outside Chrome's sandbox, finishes it.
"Pre-LLMs a Chrome full chain would take a team of four around 6-9 months," Dolan-Gavitt writes, and XBOW's own first submission took two months.
Which helper process in your own product runs outside the sandbox the way Crashpad does in Chrome? The crash handler is where this chain finished, and XBOW expects agents working alone to find bugs like these three within a year.
Volexity reported that a previously unknown group it tracks as UTA0576 has exploited a chain of three Ivanti Connect Secure zero-days since October 3, against a customer appliance on 22.8R2.4 that was fully patched at the time. A request to the public welcome.cgi login script passes the access check on its URL path, while an X-DSCGI-PATH header routes it to the protected wu.cgi upload handler. That handler saves a file before checking it is a valid ZIP, so requests sent before it deletes the file run the script, and a third bug in the root-level dsinvoked service turns that into root.
Ivanti patched the first two, tracked together as CVE-2026-104935, on October 13, and CISA added it to KEV that day with an October 16 deadline. The privilege escalation has no CVE and no fix yet, and Volexity says Ivanti expects one "in the coming weeks."
UTA0576 installed no web shell. It re-ran the whole chain for every command, took Active Directory credentials, LAPS passwords and BitLocker recovery keys, then filtered its own time window out of debuglog and audit.log and restored what it had changed. Volexity says Ivanti's Integrity Checker Tool did not detect the chain because the library patch lived only in memory, and it assesses with medium confidence that the group used LLMs to develop the exploit.
Rotate the LAPS local admin passwords, BitLocker recovery keys and LDAP service credentials in any domain an exposed appliance could query this month. The patch leaves them as they were, and Volexity's indicators, a dsstatmond process or a hidden .icscap directory, only show that someone was there.
• Cisco Secure Email Gateway CVE-2026-76519, CVSS 9.8. A relative path traversal in the Advanced Malware Protection feature mishandles email attachments, so an unauthenticated attacker who sends a crafted attachment through the gateway can write arbitrary files and run commands as root. Only gateways with File Reputation enabled and assigned to a mail policy, and Content Scanner Tools older than 25.3.0.5525, are exposed. Cisco says it learned of exploitation in October, published on October 14, and offers no workaround. Fixed in Content Scanner Tools 25.3.0.5525, which installs without a restart, and in AsyncOS 15.5.5-014 and 16.5.0-780. AsyncOS 16.0 users have to migrate to a fixed release. CISA added it to KEV on October 14 with an October 17 deadline. (Cisco)
• AhsayCBS CVE-2026-105133 and CVE-2026-105134, rated medium and critical, both zero-days. Attackers chain an authentication bypass in the checkSysPwd function with a command injection in the Replication Receiver's /rps/api/json/UpdateReceivers.do endpoint to run code as SYSTEM on the backup server without logging in. Huntress first saw it on October 7 and counted five targeted organizations by October 8, with JSP web shells and an XMRig miner disguised as edge.exe running as a fake MicrosoftEdgeUpdateSvc service. Huntress found that 10.3.4 is also vulnerable, and the hotfix that closes the entry point, 10.3.4.45 for v10 and 9.15.2.70 for v7 through v9, arrived October 12 through Ahsay's website. CISA added both to KEV on October 14 with an October 17 deadline. (Huntress)
• Ivanti Connect Secure CVE-2026-104935, CVSS 8.6, a zero-day and the subject of this week's Ivanti Deep Dive. Two bugs tracked under one CVE let an unauthenticated attacker run commands on the appliance, and a third, a privilege escalation with no CVE and no fix yet, takes the attacker to root. Affects 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. Fixed in 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5. Ivanti says it fixed part of the bug in 25.1.3.0 in July and the attacks came while it was backporting that fix. CISA added it to KEV on October 13 with an October 16 deadline. (Ivanti, Rapid7, Volexity)
• Microsoft Windows Shell CVE-2026-96951, CVSS 8.8, a zero-day. Microsoft classes it as command injection in Windows Shell that evades Mark-of-the-Web, the tag Windows puts on downloaded files so it can warn before opening them. The attack scenario Microsoft describes is a crafted file sent by email or instant message that the user has to open. Microsoft marks it exploited but not publicly disclosed, and credits four finders, among them two Fujitsu researchers and "Benoit Sevens using Claude with Anthropic." Fixed in the October 13 Patch Tuesday release. CISA added it to KEV on October 13 with an October 16 deadline. (Microsoft, BleepingComputer)
• Palo Alto Networks PAN-OS CVE-2026-0322, CVSS v4.0 score 8.6. An authenticated attacker with network access to the management interface can run code as root on the firewall, and no special configuration is needed to be exposed. Palo Alto published on October 14 and says "very limited exploitation has been observed targeting the Palo Alto Networks management interface." There is no workaround, and the advice is to limit management access to trusted internal addresses. Fixed in 12.2.4, with hotfix releases for 12.1, 11.2, 11.1 and 10.2 listed in the advisory. Cloud NGFW and Prisma Access are not affected. CISA added it to KEV on October 14 with an October 17 deadline. (Palo Alto Networks)
• PaperCut NG/MF CVE-2026-81578 and CVE-2026-82078, plus new bypasses. PaperCut reported on August 27 that this authentication bypass and post-auth code execution bug were being exploited against 26.0.3 before a patch existed, and both have been in KEV since August 31. On October 9, watchTowr's Piotr Bazydlo published bypasses of both patches (WT-2026-0141 and WT-2026-0142, fixed in 26.0.4 build 76508), a route through the Setup Wizard that resets the admin password without logging in (WT-2026-0143, fixed in build 76530), and CVE-2026-82077, a Scan to Fax path traversal that runs commands after login (fixed in 26.0.5 on September 10). Chained, WT-2026-0143 and CVE-2026-82077 give code execution without credentials on builds older than 76530. Version 26.0.5 fixes all of them. (watchTowr)
• Five older bugs added to KEV on October 8, listed in CISA's KEV catalog with an October 11 deadline. They are ISC BIND CVE-2015-5477 (a TKEY query that crashes named), Apache Struts CVE-2016-3081 (command injection through Dynamic Method Invocation), Strapi CVE-2023-22894 (exposure of sensitive user data, which CISA lists as cleartext storage of sensitive information), ONLYOFFICE Docs CVE-2021-3199 (path traversal in Document Server) and ProFTPD CVE-2015-3306 (the mod_copy module letting unauthenticated users copy files on the server). CISA gave no details of the attacks. The newest of the five dates from 2023. (CISA)
• GitLab CE/EE CVE-2026-97229, CVSS 10.0. An integer overflow in the CI/CD regular expression compiler lets an attacker run code on the GitLab server, and GitLab rates it reachable without authentication "under certain conditions." Rapid7 reproduced it on the official 19.4.1 CE image by committing a malicious .gitlab-ci.yml and a repository path with UTF-8 characters to a public project, which gave it OS commands as the GitLab git user. Any account that can create a public project meets that bar, and on instances with open self-registration that means anyone. Affects 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2, fixed October 12. Reported by joaxcar through HackerOne, and Rapid7 has seen no exploitation. (GitLab, Rapid7)
• SAP Cloud SDK for Python CVE-2026-89111, CVSS 10.0. In multi-tenant BTP applications, an attacker who controls the tenant_subdomain value can point the SDK's OAuth2 token request at a server they own and receive the application's client ID and secret. Affects the sap-cloud-sdk package below 0.45.2. Version 0.45.2, published October 13, rejects any subdomain that is not a valid DNS label before building the token URL, and until you upgrade SAP suggests checking tenant_subdomain against an allowlist of known tenants. (SAP)
• Docker Hub CVE-2026-105445, rated critical by Docker. Converting a personal account to an organization handed the account's personal access tokens to the new owner without rotating them, covered in this week's package-manager Deep Dive. Docker reviewed about 304,000 pushes made with the transferred tokens and found no sign of abuse. (Docker)
• curl and libcurl CVE-2026-92392, severity High. When a server resets an HTTP/2 stream during an upload with REFUSED_STREAM or HTTP_1_1_REQUIRED, curl keeps using the transfer handle after freeing it. Affects 8.12.0 through 8.22.0, fixed in 8.23.0 on October 14 and in 8.20.2, 8.16.2 and 8.14.3. The reporter, credited as "Luna with Claude, Anthropic," turned it into code execution, but only from a malicious server that knows the exact curl build, architecture and heap layout, with an upload of about 135 KB and roughly 23 bytes left for the command. Daniel Stenberg writes that "the most likely outcome of an attempted attack is rather just a crash." It is curl's first HIGH since 2023, and the other 23 CVEs in the release are rated Low. (curl)
• Microsoft .NET Framework and MessagePack-CSharp CVE-2026-108398 and CVE-2026-92707, CVSS 8.8 and 5.3, both publicly disclosed before the fix. In the .NET bug, a logged-in attacker places a crafted assembly on the system, registers it for loading by a protected process and runs code inside that process despite Windows Defender Application Control. BleepingComputer credits James Forshaw of Google Project Zero. The MessagePack-CSharp flaw lets an unauthenticated attacker exhaust memory over the network. Both were fixed October 13, and Microsoft reports no exploitation. (Microsoft)
• A curl Audit by Aisle (Daniel Stenberg, curl) Why it's worth your time: last week we covered Google and GitHub limiting automated bug reports, and here a maintainer describes the version that worked. Stenberg says Aisle's engineers pointed AI-powered tooling at curl and produced 35 published vulnerabilities, so Aisle "has found more CVEs in curl than any other group or individual ever did before," and he calls the findings "detailed and accurate." The curl audits page dates the work from September 2025 to October 2026 and lists it as curl's fifth external audit, next to a June 2026 Trail of Bits review that found one low-severity CVE. Curl 8.23.0 shipped the same day with 24 security fixes.
• GitHub's Model for Secret Detection (GitHub, Batu Ozturkler and Shengyu Fu) Why it's worth your time: GitHub replaced the LLM calls in its generic secret scanning with a fine-tuned ModernBERT classifier, quantized to 8 bits, that scores each regex candidate along with its file path, secret type and a bounded slice of surrounding context. On the same public traffic as its previous LLM pipeline it reports 13% higher precision, 19% higher recall, an 86% lower median post-push scan time and more than 98% lower serving cost, plus an 11.5% rise in owner-weighted acceptance in a customer A/B test. GitHub says generic detection now runs in push protection as well as post-push scanning. Its examples include a password next to a production database URL and a connection string in deployment config, and last week Truffle found that 51.8% of still-working leaked credentials were types push protection didn't block by default. The figures are GitHub's own and relative to its old pipeline, with no absolute false-positive rate.
• MyReport Updater: From gRPC to SYSTEM (Quarkslab, Lucas Laise)
Why it's worth your time: the updater service for MyReport, a French business intelligence platform, runs as LocalSystem and listens on TCP 9095 on every interface, and its UpdateConfigReferent gRPC method accepted calls from other hosts with no authentication (CVE-2026-110632). Pointing the updater at an attacker's server was enough, because it trusted whatever MD5 digest and file size that server returned, and a planted HID.dll then loads as SYSTEM through the on-screen keyboard (CVE-2026-110633). Quarkslab sent its report on November 12, 2025, and the fixes, MyReport v8 and Updater 3.0.2 with package signature checks and a named pipe in place of the network listener, shipped October 13 and 15. It is a short checklist for any in-house updater.
• Playing It SFAPE: Code Execution in Isolated User Mode (Doyensec, Adrian Denkiewicz)
Why it's worth your time: SFAPE.dll is the VBS enclave behind Defender SmartScreen's Enhanced Phishing Protection, holding hashed credentials in the isolated VTL1 side of Windows. Calling its Initialize export twice writes the fixed value 0xC0000510 to an address the host chooses, and Denkiewicz walks that one 4-byte write into a broken range check, a time-of-check bug, VTL1 read and write primitives and finally code execution in the enclave through NtContinue. Microsoft fixed it as CVE-2026-83498 on September 8 and later marked it a duplicate of an internal find. Its updated Code Integrity policy blocks old SFAPE builds, but the post notes that Edge's prefs_enclave_x64.dll, an older enclave with similar read and write bugs, still is not blocked.
• CVE-2026-81983: Integer Overflow Vulnerability Enables Out-of-Bounds Write in Adobe Acrobat (Remedio, Omri Dar) Why it's worth your time: Remedio had an LLM write most of a Python fuzzer that wraps one image in a minimal PDF and mutates its width, height, bit depth, color space and filters, then buckets the crashes under a debugger. The minimized trigger is a 745-byte PDF in which a 32-bit width times components multiplication sets the loop bound for byte-swapping 16-bit samples, so the loop writes past a 16-byte buffer in Acrobat.dll. Adobe rated it critical at CVSS 7.8 and fixed it in APSB26-141 on September 8, and the fix adds a 64-bit range check. Remedio reported it through HackerOne on May 31.
The briefing security leaders actually read. CVEs, tooling shifts, and remediation trends — distilled into 5 minutes every week.
Join security leaders who start their week with the briefing. Free, 5 minutes, no fluff.
First briefing drops this week. Check your inbox.
Weekly only. No spam. Unsubscribe anytime.