The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability. The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS
A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP's official Python client for BTP services. An attacker must be able to control the tenant subdomain,
SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. The SAP Python SDK is the official programmatic toolkit for developing AI agents and Python applications on the company's SAP Business Technology Platform (BTP) services. Tracked as CVE-2026-89111, the maximum-severity vulnerability patched this month can be exploited by remote attackers without privileges to steal credentials. Customers who can't immediately deploy the October 2026 SAP patches can temporarily mitigate the issue by using an allowlist to validate tenant_subdomain values. "The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated," according to a Tuesday advisory.
Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. Details of the flaws are below - CVE-2026-105133 (CVSS v4 score: 5.5) - An improper authentication vulnerability in the checkSysPwd() function in the "com/ahsay/obs/api/ApiStructsAction.java"
Attackers behind a string of personal data leaks at Japanese organizations have abused APIs for mobile apps and targeted known software flaws, the JPCERT Coordination Center (JPCERT/CC) said. The Tokyo-based center, which takes incident reports, based its October 8, 2026 alert on those reports and other information. The alert names no attacker and no affected organization. JPCERT/
Google has announced a new security measure that limits access to Android's accessibility services to verified applications classified as Accessibility Tools when Advanced Protection is enabled. With malicious Android applications abusing the API serving as the main conduit for malware and financial fraud, the tech giant said the move would block a major attack pathway. Advanced Protection is a
Attackers are exploiting a new critical zero-day flaw in Cisco Catalyst SD-WAN Manager, the system companies use to manage their Cisco SD-WAN networks, Cisco said in an advisory on September 30. The flaw, CVE-2026-76504, could allow a remote attacker with no login access to use the Manager's API as the admin user. Fixed releases are available, and there is no workaround. It carries a
A malicious MCP server could trick an application built on the official MCP Python SDK into handing over the OAuth credentials it uses to log in to a real service, the SDK's maintainers said in a security advisory. Affected versions sent the client secret, the authorization code, and the PKCE proof key to a token endpoint the attacker controlled. The fix is in versions 1.30.0 and
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-5430 (CVS score: 9.8) - A path traversal vulnerability in WSO2 API Control Plane,
Cisco Talos finds CLOSEDQUORUM, malware that lets four commercial AI models vote on its next move, with no human operator required. Cisco Talos found malware, dubbed CLOSEDQUORUM, that holds a vote before deciding what to steal from you. Four AI models vote on its next move, without any human interaction. CLOSEDQUORUM is the first Windows malware they’ve seen that hands its tactical decisions to a panel of commercial AI models instead of a human operator. Once it lands on a machine, it doesn’t wait for instructions. It asks four different large language models what to do next, tallies their answers, and acts on whichever choice gets the most votes. “CLOSEDQUORUM is, to our knowledge, the first publicly documented Windows implant to apply this model to tactical command and control (C2). After deployment, it delegates the selection of its next action to a panel of commercial large language models (LLMs) and executes the resulting decision, with the intent of harvesting user credentials and crypto wallets.” reads the report published by Talos. “It does not require continued commands from a human operator or tasking from a dedicated, attacker-operated C2 server; the complete dynamic operation is delegated to the AI.” The name makes sense. A quorum needs a minimum number of people to make a decision, and this one has exactly four members: DeepSeek, Qwen, Mistral, and Google Gemini. There is no human involved. Talos discovered the malware using CAIRN, a new open-source toolkit designed to find threats that use AI. This is the first case study from the project. Most discussions about AI and cybercrime have focused on speed and scale. Attackers can write phishing emails faster, create more malware variants, and carry out more attacks with less effort. That’s true, but in these cases, a human is still in control, choosing the targets and deciding when to attack. Talos calls what CLOSEDQUORUM does something different: effort displacement. It’s not making an operator faster at their job. It’s removing them from an entire phase of the job. “A third dimension has received less attention in the malware space: effort displacement. This is not merely augmenting what an operator can accomplish in a session but transferring an entire phase of the attack from the operator to the system. Effort displacement compounds the effects of speed and scale because the human-in-the-loop is no longer the bottleneck.” Talos continues. “Human operators are bound by attention, working hours, and cognitive load. An AI system capable of executing a phase of the attack chain can continue when the operator is no longer watching. It does not go offline when the attacker sleeps.” On execution, the malware gathers basic host information, hostname, OS version, admin status, and folds it into a prompt sent to each of the four models in turn. Each model has to answer with one of exactly four options: steal, inject, persist, or move. Anything that doesn’t match the format gets thrown out. Steal runs three things at once: dumping credentials from LSASS memory, pulling saved passwords out of Chrome, Edge, and Firefox, and scanning for crypto wallets like MetaMask and Exodus. Inject writes shellcode and picks a delivery method depending on what the model recommends. Persist sets up the usual mechanisms to survive a reboot. Move is defined in the code but has no actual function behind it yet, so calling it does nothing. If the four models disagree and end up tied, there is a fixed order for breaking the tie: DeepSeek first, followed by Qwen, Mistral, and Gemini. It’s not a sophisticated system. The model that loads first in the code simply gets the final say. The malware encrypts everything it steals and sends it out through a Discord webhook instead of a traditional command-and-control server. That’s the interesting part. Security teams can block domains, IP addresses, or certificates, but a Windows process quietly connecting to four AI APIs and a chat service can look like normal application traffic, at least until its other activity raises a red flag. “Stolen material arrives AES-256-GCM encrypted in the operator’s Discord channel as base64 code blocks.” continues the report. “CLOSEDQUORUM replaces a dedicated C2 endpoint with a chain of correlated behaviors. No single indicator fully identifies the architecture, but the combination is distinct: Repeated execution at randomized 5 – 15-minute intervals; AI-provider API traffic originating from an unexpected Windows executable; Similar requests potentially sent to several model providers within a short interval; Structured prompts containing host context or offensive capability language (Note: This would likely only visible through TLS inspection or provider-side telemetry); Numerous known malware techniques for process injection, LSASS access, or persistence creation; Discord webhook communication from the same process or host.” The encryption is worth a second look too, mostly because it’s weaker than it sounds. The key comes from the current date, not a proper secret, which means the malware’s own developer could decrypt any operator’s stolen data just by knowing what day it is. That’s obfuscation dressed up as security, and it’s a detail that says something about how this whole operation was actually built. The public sample Talos pulled apart is inert. It ships with placeholder API keys and a dummy webhook, so nobody’s running the live version through this exact binary. Development builds tell a different story though, with real credentials baked in at compile time, which points to a model where a developer builds custom versions for paying operators, credentials-as-a-service, basically, with the AI orchestration as the selling point. There is also a trail pointing to the developer. Artifacts found in the malware connect the person behind it to carding forum posts dating back to 2025. That suggests this is not just an academic proof of concept created in a lab. It appears to come from someone already involved in cybercrime and testing how much autonomy AI can add to their existing activities. That doesn’t make the malware impossible to stop. It relies on commercial AI APIs, which can rate-limit requests, reject them, or return responses that don’t match the expected format. Its predictable tie-breaking also makes it easier to identify. Talos recommends watching for Windows binaries that contact several AI providers and Discord within a short period while also accessing LSASS or creating suspended processes. None of these signs is enough on its own, but seeing them together is highly unusual. “CLOSEDQUORUM is an early and limited example, but it makes an emerging threat model concrete and gives defenders an outline of the observable signals they can begin addressing today.” concludes the report. “As effort displacement expands across more phases of an intrusion, its effects will compound with the speed and scale already afforded by modern AI. “ Talos technical writeup includes the YARA rule and the MITRE ATT&CK mapping. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, malware)
Confirm this action.
Leaving now will discard your changes.