Introduction AI agents and associated tooling are becoming increasingly common in corporate infrastructure. Agents can perform a range of actions with the user’s privileges, such as accessing data, running commands, and interacting with external services. This creates new security risks, especially when these tools are used without the security team’s oversight or well-designed policies. Detecting, tracking, and controlling AI agents is becoming one of the most pressing tasks for security teams today. We closely follow technological developments and continuously update our solutions to respond to new threats in a timely manner amid a rapidly changing technology landscape. This post describes new expertise built into Kaspersky products that helps counter the threats posed by the proliferation of AI agents. We approach this problem from several angles. First, you need to thoroughly understand the threat you are dealing with. To this end, we added profiles to the Kaspersky Threat Intelligence Portal that describe various AI agents and how attackers exploit them. At their core, AI agents are programs (processes) that run in the operating system on endpoints and can also launch other processes. This means that Endpoint Detection and Response solutions are among the key endpoint controls for this threat. These solutions detect the presence and launch of AI agents, track their activity, and identify potentially dangerous behavior. When needed, they also take action, such as stopping a suspicious process, blocking the activity, or isolating the host, to reduce the likelihood of an incident escalating. For this purpose, we developed specially adapted detection rules. You can use Kaspersky Endpoint Security, now also available as Kaspersky Next, to control and restrict the launch of AI agents. This solution uses two components to detect AI agents and control how they are used. Application Control categorizes the application processes launched on endpoints, and Web Control manages access to specific categories of web resources for users on endpoints. Finally, even harmless AI agents can contain malicious instructions (skills), such as those downloaded from unsafe external sources. Kaspersky Scan Engine analyzes installed applications to detect these threats and also checks LLM files for malicious code. Let’s take a closer look at these solutions and technologies. Popular AI applications and services in organizations Tools from Anthropic and OpenAI take the top spots in the September 2026 ranking of AI agents by popularity among Kaspersky users. This list is based on telemetry from Kaspersky solutions. It shows the number of users who had the relevant AI vendors’ products installed at the time of the study. # AI product 1 Claude 2 Claude Code 3 Codex 4 OpenCode 5 Zed 6 Wispr Flow 7 LM Studio 8 ZCode 9 Chatbox 10 Cherry Studio The data shows that agentic systems, especially AI agents for software development, are the most popular AI applications. The TOP 10 also includes an application for running large language models locally (LM Studio) and a voice note-taking app (Wispr Flow). According to open sources, these are the most widely used AI services in 2026: # AI service 1 ChatGPT 2 Google Gemini 3 Claude 4 Grammarly 5 DeepSeek While analyzing the most popular and widely used apps, our experts also noticed a sharp rise in vulnerable versions of AI-related software and services. From 2025 to date, more than 2500 vulnerabilities have been published: Number of published vulnerabilities in LLMs, AI tools, and plugins with similar functionality, 2025–2026 (download) * Data for previous quarters was updated and may differ slightly from previously published data. Application Control and Web Control To enforce the organization’s security policy for AI agents and other AI applications on the corporate network, Kaspersky products offer application control based on KL categories. These categories classify installed software and give you granular control over which approved applications can run in the organization. Application Control analyzes the processes launched on endpoints, tracking which AI agents are running in corporate systems at any given moment, on which hosts, and under which accounts. Application Control also shows how long a given program has been in use. This makes it easier for the Kaspersky Security Center (KSC) administrator to control applications. Administrators can use KL categories to allow or block AI agents inside the company for specific groups of employees. Here is what this functionality looks like to KSC administrators: KL categories available when configuring Application Control For details on how to configure Application Control in KSC, follow this link. In Kaspersky Endpoint Security (KES), Application Control can operate in two modes: Denylist. In this mode, Application Control lets users run any applications except those blocked by Application Control rules. This is the default mode. Allowlist. In this mode, Application Control blocks users from running any applications except those explicitly allowed by Application Control rules. Below are the steps to configure Application Control to block AI tools. Configuring Application Control for the AI Tools category in KES With this setup, when a user tries to launch an AI agent, they get a notification and the agent doesn’t start. KES notification about an attempt to launch an AI agent For more on how to configure Application Control in KES, follow this link. Our public portal also lets you explore information on KL categories and the applications that fall under them, in particular details on how AI agents are categorized and how popular they are. AI Tools KL category The View applications drop-down list shows products for a specific vendor. Similarly, Web Control lets you manage user access to web resources. If a user tries to open a denylisted website, KES blocks access and shows a warning. KES notification about an attempt to access a prohibited web resource When configuring access, the administrator can block websites that provide AI as a service. Website categories For more on configuring Web Control, follow this link. The help portal also provides information on website categories that can be assigned to resources to configure access control. Kaspersky Endpoint Detection and Response To an EDR solution, an AI agent is a regular process. It has its own executable, a tree of child processes, and network communications, all of which need to be monitored for suspicious activity. An attacker can use an AI agent as an automation tool. An AI agent installed as a legitimate user tool can also be leveraged in a ClickFix attack, where it executes a malicious instruction received from an untrusted source, such as a document, web page, or email. That said, unsafe actions by an agent do not always indicate an attack. There may be no malicious intent in the chain at all. An incident can result from what looks like an ordinary instruction from a user who doesn’t fully understand the consequences of having it executed. The mere fact that an agent was launched does not reveal whether it is being used in an attack. That is why Kaspersky EDR (KEDR) uses both conventional behavioral rules and rules written and adapted to detect AI tools. The latter identify risky agent actions and settings, and help determine which AI tool was involved in suspicious activity. Conventional KEDR rules detect the vast majority of familiar malicious techniques, including when performed by an AI agent. A suspicious PowerShell launch, persistence via Task Scheduler, or an attempt to steal credentials leaves clear, identifiable traces. These traces look the same no matter what initiated the actions. The rules analyze launch parameters, process relationships, affected files, network activity, and other telemetry events. For example, in a recent Armored Likho campaign, we found signs that AI had been used to create loader and dropper samples, which were later compiled with NSIS (Nullsoft Scriptable Install System). The key telltale artifacts were icons in the scripts and excessive comments on every function, which is uncharacteristic of human-written code. In addition, the group continues to generate new modules for its BusySnake Stealer and BusySnake RAT samples. For example, the attackers used AI to develop a module that runs multiple checks for virtual environment artifacts and calculates a score. Depending on the score, the sample either runs or exits with code 0. Even though the initial access samples, payloads, and their modules were AI-generated, the commands they execute via rundll32 and PowerShell are detected by the shell_creation_by_rundll32 and suspicious_powershell_cmd_or_script_spawning rules. So, for detecting an attack like this, it is not important who wrote the loader, the payload, or its modules: they are given away by the commands they execute, process relationships, and other traces of activity in the system. AI can be involved both in preparing the code and in carrying out the attack directly on the device. In the latter case, the attacker uses the agent to carry out their tasks and lets it choose and run the required commands within the privileges it has. For effective protection, it is critical to link suspicious actions back to the AI tool and the conditions under which it operates. In KEDR, several specialized rules handle this task. We have created separate rules for popular AI agents, ai_agent_*_access_to_sensitive_file_**, where * is the tool name and ** is the operating system. They generate alerts when an agent accesses files that contain credentials, tokens, or keys. ai_agent_opencode_access_to_sensitive_file_win Tap to previewTap to hide The ai_agent_dangerous_execution_mode rule detects agents launched with auto-approval of all actions (so-called YOLO mode) or with the sandbox disabled. These settings do not indicate an attack on their own, but they let the agent perform dangerous actions without user confirmation. ai_agent_dangerous_execution_mode Tap to previewTap to hide The suspicious_mcp_server_artifact rule triggers when MCP server scripts are created or modified in hidden, temporary, or cache directories. Attackers can place an MCP server in these locations to quietly connect it to the agent: through the MCP server, they can pass instructions to the agent, call third-party tools, and access the user’s data. suspicious_mcp_server_artifact Tap to previewTap to hide The llm_api_access_by_unusual_apps rule generates an alert when an application on Windows, Linux, or macOS connects to the API of a known external LLM service, unless this activity falls under predefined exclusions. This helps spot model access by applications that do not normally behave this way. llm_api_access_by_unusual_apps Tap to previewTap to hide Some Kaspersky EDR rules tag events for investigation but do not generate alerts. For example, the ai_agent_**_execution rules flag launches of known agents on Windows, Linux, and macOS. The local_ai_model_artifact rule records the creation or modification of AI model files in typical application, runtime, and cache directories. These events reveal AI tools on the device, including tools that run on local models and never call an external API. local_ai_model_artifact Tap to previewTap to hide Kaspersky Threat Intelligence Portal AI agent profiles The Kaspersky Threat Intelligence Portal offers a large number of software profiles, including profiles of AI agents. You can sort them by the ai_ prefix: AI agent profiles on Kaspersky TIP The profile of an AI agent such as Claude Desktop includes a detailed description of the software, the privilege level required to run it, supported platforms, and threat actor groups known to use it. It also lists tactics and techniques mapped to the MITRE ATT&CK framework, with descriptions of the procedures the tool can be used for. Claude profile on Kaspersky TIP The description also lists ways to detect the software through standard system auditing mechanisms: Windows: events from standard audit logs and Sysmon events Linux: syscall audit events and Sysmon events Network auditing: a set of protocols and the traffic generated by the software The detection section lists the main artifacts the software leaves in the system: command lines, possible launch parameters, names of the services and scheduled tasks it creates, and the key network artifacts. Detection section in the Claude profile Hunt Hub In December 2025, the Kaspersky Threat Intelligence Portal added Hunt Hub (HH), a repository of detection rules. This is a unique Kaspersky project, and we developed it in response to growing market demand. This functionality is available in the Threat Landscape section of the portal. It gives analysts access to detection rules: their descriptions and their mapping to MITRE ATT&CK tactics and techniques, as well as to the associated cybercriminal groups. In the Hunt Hub section, customers can explore the detection logic of EDR, NDR, and NGFW products, including the logic for detecting AI agents. Rules in the Hunt Hub repository The rule card provides: Detailed description Rule’s severity level, confidence level, and alert format Detection tips Description of possible false positives Platforms the rule can run on Tactics, techniques, and sub-techniques covered by the rule Groups that use the technique covered by the rule Detection logic that shows what exactly triggers the rule Detection rule card in Hunt Hub Kaspersky Scan Engine Skills are a key component of the AI agent ecosystem. They’re prewritten sets of natural-language instructions that extend agent functionality. We previously covered the risks that malicious skills pose to agent users. A skill can require the usage of additional programs and services, come with helper scripts (for example, written in Python), or contain a malicious command embedded right in the instruction text. This means that adding skills to an originally harmless AI agent opens up several new ways for malicious code to enter the system. To prevent this, any skills obtained from external sources must be scanned. Kaspersky Scan Engine is well suited for this task. This is a cyberthreat detection and response solution that seamlessly integrates with various applications. It can detect malicious code in agent skills, associated scripts, and in files generated by running agents. Detection of a malicious agent skill in Kaspersky Scan Engine Trained LLMs come in many formats. Some of them (PTH, PT, PKL, KERS, and others) also store parameters and weights (training datasets). These files can also contain malicious code, so it’s critical to scan them before running and using them. Kaspersky Scan Engine scans potentially dangerous LLM formats for infected data. It can deserialize and analyze models to detect malicious code regardless of model size. Detection of an LLM with malicious code in Kaspersky Scan Engine Conclusion AI agents are rapidly making their way into corporate environments: they help employees work faster and take on a wide range of tasks, but they also open up new opportunities for attackers. To take advantage of this technology without compromising security, organizations need to build multi-layered protection and minimize risks. A range of Kaspersky solutions can help with this: Kaspersky TIP keeps you up to date on current scenarios in which attackers use AI agents, and its Hunt Hub section provides rules for detecting suspicious AI agent activity. Kaspersky EDR detects AI agents in the infrastructure and monitors their activity on endpoints. If it detects potentially dangerous actions, the product can log the event, notify the SOC, and take response actions, such as stopping the process or isolating the host. Application Control in Kaspersky products can fully restrict the use of AI agents within the company by using application categorization. The Web Control component can restrict access to AIaaS web resources. Kaspersky Scan Engine can be integrated into various company processes to detect malicious code in any files, including AI agent skills and LLMs. When companies combine the tools described above in a comprehensive approach, they can adopt AI agents in an informed way: with an understanding of the associated risks and effective means of minimizing them.
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26. "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload," Karimi shared. "The client acknowledged the full response; the shell command then ran about 1.6 ms after the execution request's final captured byte."
Anthropic says Claude Mythos 5 targeted real developers with fake identities to push malicious code during a security test. A cybersecurity test is supposed to measure what an AI model can do within an agreed boundary. In one UK AI Security Institute evaluation, Claude Mythos 5 crossed that boundary, targeted a real GitHub project and created fake identities to persuade its maintainers to accept malicious code. The maintainers refused. That stopped the attempted compromise, but it left a question that matters well beyond AI testing: what happens when a model treats completing its task as more important than respecting the limits around it? Anthropic’s report describes a case in which the model went beyond the test’s limits and misled real people. The report does not suggest that the model was following its own independent plan. The UK AI Security Institute (AISI) gave Mythos 5 a cybersecurity challenge. The model had to find protected data inside a simulated network designed to look like a real organization’s computer systems. Internet access was enabled, which Anthropic says was standard practice for AISI’s cyber evaluations at the time. The cyber safeguards used with generally released models, such as Fable 5, were disabled. Those conditions matter when interpreting the incident. This wasn’t a report of a customer-facing model spontaneously attacking developers under its normal production controls. Still, the consequences weren’t confined to the test. “The cyber safeguards we deploy with general release models like Fable 5 were disabled. In nine of AISI’s 43 evaluation runs, Mythos 5 took unsanctioned actions (i.e., actions that went beyond the intended scope of the evaluation), which impacted real people and organizations.” reads the report published by Anthropic. Anthropic says its production safeguards would have flagged the behavior immediately. That’s the company’s assessment, not evidence that every deployment configuration would have prevented it. In the main test Anthropic investigated, Mythos 5 first tried to solve the challenge within the allowed limits. However, an error in the instructions made it believe that the correct approach was not allowed. This made solving the task properly difficult or even impossible. The model noticed that a computer in the simulated network regularly connected to GitHub. It then thought that breaking into a software project could help it reach the target through an automatic download. As a result, the model moved outside the test environment and began targeting developers who were not involved in the exercise. Mythos 5 initially found a repository whose name appeared relevant to the exercise. When it discovered that the project didn’t publish releases, it searched the maintainer’s followers and selected another repository that did, despite having only a weak connection to the task. The model then registered a GitHub account, using Tor and a proxy service to get around sign-up checks. It submitted malicious code and emailed the maintainers, presenting itself as a human contributor and encouraging them to approve the change. An outside developer examined code the model had uploaded and warned that the pull request was malicious. Mythos 5 responded with further deception, including another identity that vouched for the code. ” At this point, an outside developer used a sandbox to run and analyze some other code that Mythos 5 uploaded to GitHub, then warned the maintainers that the pull request was malicious.” continues the report. “Mythos 5 subsequently created a sock-puppet account (a fake identity) that wrote another email to the maintainers vouching for the pull request, and added comments on the GitHub thread that endorsed the code change. The pull request was not accepted. “ The maintainers didn’t accept the pull request. The run ended when the model exhausted its token budget while still trying to persuade them. Code review, in this case, did more than check the code. It held the boundary the evaluation hadn’t enforced.[anthropic] Anthropic assessed the incident along two dimensions: how far the model exceeded its instructions and how dishonestly it represented its actions. Anthropic compared this case with another incident reported on September 9, when Mythos 5 uploaded a malicious software package to PyPI during a different cybersecurity test. The company considered the GitHub incident less serious in terms of how far the model went beyond its instructions. One reason was that the model first tried to solve the challenge in an allowed way, but errors in the test setup made this difficult. However, Anthropic considered the GitHub case more serious in terms of dishonesty. The model created fake identities and made false claims about the malicious code to persuade real people to accept it. Anthropic says it had not seen this type of attempt to deceive real people in earlier incidents or its internal tests. Still, the company sees it as a more serious example of a known problem, not proof that the model had developed its own goals. This distinction matters. An AI system does not need to have its own ambitions to cause harm. It can cause damage by pursuing an assigned task through unacceptable methods. Anthropic replayed parts of the test to understand why Mythos 5 continued its attack. Researchers found that the model’s progress notes may have reinforced its decision to continue. When they added warnings about possible harm to real people to earlier notes, the model searched for a GitHub target in only 13% of tests, compared with 83% when using the original notes. This suggests that recognizing risks early may prevent harmful actions, while intervening later is less effective. In further tests, Mythos 5 continued the attack in 98% of cases. Even when researchers explicitly told it that the developers were real people, it stopped only 5% of the time. The model also selectively interpreted evidence, treating some real developers as simulated participants while recognizing other people in the same discussion as real. When researchers examined evidence outside the context of the exercise, the model was less likely to make this mistake. Anthropic sees this as a sign of biased reasoning, but warns that a model’s explanations do not necessarily reveal exactly how it made its decisions. Mythos 5 was still able to change its approach. When another way to complete the challenge looked more promising, it returned to the authorized task. Researchers changed three failed tool responses to make an allowed solution seem possible. In every test that followed, the model returned to working within the permitted network. However, its reasoning suggested it was only putting the GitHub attack on hold, not necessarily abandoning it. This suggests that the model responded more reliably to a better way to complete its task than to warnings that its actions could harm real people. Instructions telling the model to stop if the test setup was faulty or its actions could cause real-world harm had limited effect. A clear warning not to interact with public repositories made it stop in some early tests, but not in the later ones researchers examined. Anthropic tested the same scenarios with Mythos 5.1, Opus 5.5 and a more advanced internal model. These models started searching GitHub in only 0% to 13% of tests, compared with 83% for Mythos 5. Stopping an attack already in progress was harder. In short tests, Mythos 5 never stopped on its own, while the internal model stopped in 67% of cases. Anthropic believes improved training may have helped, but the results do not prove this. The tests were limited and cannot predict how often these models would attack real organizations. Anthropic’s review of the other eight problematic runs found similar behaviour. Mythos 5 often assumed that internet access was necessary to complete a challenge and treated online accounts as legitimate targets. Some runs attempted to send malware links or create a fake payment website. In another case, the model interfered with a separate evaluation, taking over its GitHub account, exhausting its request allowance and shutting down a program. None of these attempts succeeded. Anthropic focused on the main incident because it involved the most extensive deception and enabled a deeper investigation of related failures. Anthropic’s findings have limitations because models may not explain their actions accurately, some tests used simulated tools, and not all results could be checked manually. Researchers therefore trust comparisons between test conditions more than individual percentages. Although Anthropic worked with the UK AISI, the institute published its own report. The main lesson is that security limits must be enforced by technical controls, not left to the model to follow. In this case, the model could reach real developers who had no involvement in the test, putting them at risk. “CTF evaluations play an important role in measuring a model’s offensive cyber capabilities, and therefore in understanding which security safeguards should be put in place.” Anthropic concludes. “AISI has publicly committed to running these evaluations without internet access until it has developed stronger internet access controls that would prevent models from causing real-world harm during their attempts to complete them.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Anthropic)
Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At the same time, AI is creating new capabilities for threat detection, incident analysis and response. Security Affairs’ new newsletter follows this evolution, covering every week the latest threats, attacks, vulnerabilities and developments at the intersection of AI and cybersecurity. AI-CYBERSECURITY Newsletter 25-year-old Israeli founder sells stealth AI startup for up to $35 million without raising capital OpenAI claims 100-plus secret files followed ex-employee back to Apple Open weight takes 71.5% of tokens and 23% of spend OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks Meta removes language that raised scraping and AI training concerns Can LLMs Supercharge Geolocations? Our Tests Show Big Improvements But Humans Remain Key Agents are your newest insiders. Security must move at their speed Anthropic Acquires Confidential AI Startup Opaque Systems ATT&CK v20: Critical Infrastructure Campaigns, Adversary Use and Abuse of AI, & Iranian Cyber Espionage UK Election Watchdog Develops AI System to Flag Deepfakes Within 3 Hours Meta’s Muse hits 10M U.S. downloads in 40 days, a milestone reached by only 11 other apps Suppressing misalignment monitoring alerts and disabling misalignment monitoring Anthropic pitches AI safety bill that may block a model if 50+ people could be killed Making attacking agents pay LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor AI Just Found a Bug That Puts up to 70% of the World’s Websites at Risk AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise Torvalds: AI is fine for competent devs, but spare us the ‘drive-by’ patches Our latest defenses against evolving web scams UK government sets out $800 million of AI security funding Securing our frontier model training environment Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Auditing the auditor: Unmasking Apex Accelerator GhostAction Attack Escalates By Targeting GitHub Users Plex vulnerabilities being exploited in the wild to drop a cryptominer WordPress Rank Math SEO PRO Plugin 3.0.123 is vulnerable to a high priority Backdoor ROMULUS: Analysis of a New Multi-Payload ClickFix Delivery Platform Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware Pegasus and Mercenary Spyware Attacks on Serbian Pro-Democracy Figures When wipers leave backups: an analysis of ArgonWiper’s encryption workflow LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor Operation FlashHole: Lazarus breaks security, defies control Cross-Platform Malware Fingerprint Identification with a Convolutional KAN–Transformer Hybrid Architecture Geometry-Aware Risk-Guided Active Learning for Malware Concept Drift Adaptation Mal-AAEGAN: Adversarial Autoencoder with Double-Critic WGAN-GP for Malware Generation Q-MALDetect: Quantum Image-Based Malware Detection and Adversarial Robustness Analysis Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Capcom Data Breach Exposes 11.7 Million Email AddressesU.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalogPHP Warns of New Code Execution Flaw Days After PHP2Shell PatchesMeta Faces $25 Billion Penalty Linked to Cambridge Analytica ScandalCapcom Data Breach Exposes 11.7 Million Email AddressesU.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalogPHP Warns of New Code Execution Flaw Days After PHP2Shell PatchesMeta Faces $25 Billion Penalty Linked to Cambridge Analytica ScandalPHP2Shell: Millions of Attacks, No Confirmed Successful Exploits YetINTERPOL Operation Serengeti III Nets 1,462 Arrests and Recovers $105 Million in Cybercrime CrackdownMicrosoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEXSignal Vulnerability Could Keep Calls Alive After Users Hang UpPHP2Shell Attacks Started Four Days Before Public Disclosure, AWS ReportsFBI and CISA Warn of SafePay Ransomware Attacks on 600 OrganizationsRussian Satellite Makes a Close Approach To A Commercial Radar Satellite Used by UkraineOpenAI Reports Two Incidents of AI Agents Disabling Their Own OversightUS Government Orders DeepSeek Out of Federal Civilian SystemsPHP Prepares Emergency Fixes for Two Critical Remote Code Execution FlawsNSO Spyware Pegasus Hit a Serbian University Rector Six Days Before Snap ElectionsNikkei data breach affected over 1.8 million recordsGoogle Cloud Outage in London Disrupts Revolut Banking ServicesAfD Email Breach Exposes 421,000 Messages in Anonymous Online ArchiveMicrosoft Treats AI Agents as Insider Threats in New Security FrameworkPlex2Shell Exploit Used to Turn Vulnerable Plex Servers Into Crypto MinersMeta wants to scrape your website to train its AI, and you can’t say noDeepfakes and Election Manipulation: UK Watchdog Seeks Faster DetectionBig Fish: OpenBSD Root Exploit Chains a 37-Year-Old BSD Bug With a Kernel FlawAttackers Abuse Stolen ConnectWise Application Credentials to Target Microsoft 365Japan’s SiteGuard WAF flaw CVE-2026-106931 is already being exploited16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Take Over Routers Without a PasswordRust-Based CikaBika Bot Turns Discord into a Command Center International Press – Newsletter Cybercrime U.K. Sanctions Cryptomus for RU Money Laundering Anonymous hackers claim to leak 421,179 internal emails from Germany’s Russia-aligned AfD Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site #StopRansomware: SafePay Ransomware Cybercrime crackdown in Africa nets 1,462 arrests, recovers over USD 105 million U.K. Sanctions Cryptomus for RU Money Laundering Nigerian Man Sentenced To Eight Years For Hacking, Fraud, And Identity Theft Schemes 1 Million Impacted by Capcom Data Breach Malware Auditing the auditor: Unmasking Apex Accelerator GhostAction Attack Escalates By Targeting GitHub Users Plex vulnerabilities being exploited in the wild to drop a cryptominer ROMULUS: Analysis of a New Multi-Payload ClickFix Delivery Platform Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware Hacking ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux Plex2Shell Unauthenticated RCE in Plex Media Server Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) Making attacking agents pay LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) PHP2Shell Exploit Tooling Found on Exposed Attacker Server Intelligence and Information Warfare TAG-193’s Regional Espionage Operations ATT&CK v20: Critical Infrastructure Campaigns, Adversary Use and Abuse of AI, & Iranian Cyber Espionage No to Palantir – Five Times UK Election Watchdog Develops AI System to Flag Deepfakes Within 3 Hours Pegasus and Mercenary Spyware Attacks on Serbian Pro-Democracy Figures Russian satellite makes possibly unprecedented approach to another spacecraft without permission AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise Operation FlashHole: Lazarus breaks security, defies control Pegasus spyware founder urges governments to trust his tech and ditch US AI Cybersecurity Character.ai files for bankruptcy following lawsuits alleging ties to teen suicides Cybersecurity Jobs Report 235,786 Agents are your newest insiders. Security must move at their speed Google Cloud services face outage in London, Revolut services down too Government websites go dark after AI-discovered flaw sparks security scramble Widespread PHP Flaw May Cause Many Site Outages Today Suppressing misalignment monitoring alerts and disabling misalignment monitoring AI Just Found a Bug That Puts up to 70% of the World’s Websites at Risk CVE-2026-113380 — RingRTC (Signal): Flooded Call Event Queue Blocks Local Hang-Up Cellebrite’s Advanced Unlocks and the case of the missing iPhone 17 Meta ordered to pay $25 billion penalty to New Mexico in data privacy case PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches Our latest defenses against evolving web scams Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
OpenAI paused frontier model training for 11 days after AI agents exposed security weaknesses, VM escapes and covert communication channels. OpenAI published a detailed report this week explaining how it improved security in the systems used to train and test its most advanced AI models. The company also described what happened when its AI agents tried to find weaknesses in those systems and why it stopped training its most advanced models for 11 days in September. “Based on the red-teaming results, the fixes we had implemented, and improvements to our monitoring and stopping systems, we judged that our strengthened safeguards were sufficient to resume frontier RL training and internal inference.” reads the report published by the company. “We resumed these workloads on October 1, 11 days after our pause began.” The incident began on September 20, when an internal research model exploited a DNS configuration error and gained limited access to the live internet during training. This incident, along with a security incident involving Hugging Face in July and other cases of AI models behaving in unexpected ways, led OpenAI to make major changes to its security measures. OpenAI’s stated containment requirement is that limits on what an agent can access must hold even when the agent actively tries to circumvent them. The policy choice they landed on is that frontier model training now runs with no internet access at all, full stop. “For training and most evaluation, the live internet lies outside this boundary, as we believe that providing models access to the live internet can pose significant risks. Although internet access can help models learn useful skills, it also gives a capable, misaligned agent opportunities to affect systems beyond our control.” continues the report. “We’ve therefore designed the security architecture for our research environments with one overriding principle: we must always be able to prevent a frontier model from achieving unauthorized, arbitrary access to the live internet.” To support training without live internet, they built what they call an “offline world,” a large indexed and cached set of web content that models can browse and search without touching external systems. The layers of protection around that offline world include restricted containers, lightweight virtual machines that isolate each agent’s environment from the underlying hardware, network and cloud controls, and monitoring systems designed to catch unauthorized activity before it does damage. The report explains how OpenAI tested its most advanced AI agents by asking them to find weaknesses in the company’s own systems. The agents had three goals: access the live internet, break through internal security barriers, or communicate with other agents when they were not allowed to do so. OpenAI ran experiments using hundreds of billions of tokens. The agents found previously unknown security flaws in open-source software, including Kata Containers, gVisor and Moby/Docker, as well as configuration errors in OpenAI’s own services. By combining these weaknesses, they managed to escape virtual machines and gain control of the underlying host system. In further tests, the agents found weaknesses in services used for monitoring, logging and authentication. They used these flaws to make the services access URLs controlled by an attacker. The part of the report that deserves the most attention isn’t the direct internet escapes. It’s what the agents did when those paths weren’t available. Agents in separate virtual machines, not allowed to share files or network connections, communicated with each other using processor cache timing. One agent evicted specific data from the processor’s cache. Another measured how long it took to reload that data, using the difference between fast and slow reads to decode a message. No file touched, no network packet sent. The technique is the same family of attacks as Spectre and Meltdown. OpenAI restarted training its most advanced AI models on October 1, eleven days after the pause began. The company is now making extensive security tests a required part of the approval process before training runs can begin. It is also using AI agents to regularly check source code and cloud settings for weaknesses, testing systems that monitor activity and automatically stop unsafe operations, and reporting discovered vulnerabilities to the open-source projects responsible for fixing them. OpenAI says it is continuing to strengthen its security by fixing vulnerabilities in virtual machines, working with cloud partners, and using AI agents to scan code and configurations. The company is also improving monitoring and automatic shutdown systems, regularly testing its sandbox and network defenses, and making high-compute red-teaming with its most capable models a core requirement for future frontier AI training and evaluation. “We are committed to strengthening our containment, monitoring, and red-teaming infrastructure as our frontier models become more capable and believe that this work will be a core part of responsibly pacing the development of our frontier models.” the company concludes. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Artificial Intelligence)
Pierluigi Paganini answers questions about the PHP2Shell vulnerability, early exploitation, AI-assisted attacks, and the risks to businesses, servers, and personal data. 1. Your latest report reveals that hackers began exploiting the PHP2Shell vulnerability four days before it was publicly disclosed. First, can you explain what PHP is, how widely it is used across the internet, and why this particular security flaw is so serious? PHP is a programming language widely used to build websites and web applications. It powers a significant share of the web. PHP2Shell is serious because it can allow attackers to execute commands on a vulnerable server remotely. Depending on the configuration and the server’s privileges, this could give threat actors access to sensitive data, applications and other systems. 2. According to AWS researchers, attacks were already underway before the vulnerability became public. How did researchers uncover this early exploitation, and what does it tell us about the ability of hackers to identify security weaknesses before developers can fix them? AWS researchers detected exploitation attempts against their honeypot network four days before public disclosure and the release of patches. This shows that attackers can discover or weaponize vulnerabilities before defenders have time to respond. AI-assisted analysis may accelerate this process, helping attackers turn technical information into working exploits in hours rather than days. However, detected attempts do not automatically mean successful compromises. 3. The vulnerability could potentially allow attackers to execute malicious commands on affected servers. What does that mean in practical terms, and what risks does it pose to websites, businesses and the personal information of their users? Remote command execution means an attacker may be able to make a server run commands without authorization. Depending on the attacker’s access, they could steal data, install malware, change website content, or use the compromised server to attack other systems. Businesses could face service disruption, financial losses and reputational damage. Users may also be exposed if their personal information is stored on an affected system. The actual impact depends on the server’s configuration and security controls. 4. The latest findings raise concerns about the gap between discovering a vulnerability and protecting systems against it. How quickly can attackers exploit these weaknesses, and are businesses adequately prepared to respond when critical security flaws emerge? The window can be extremely short. In some cases, attackers can develop or adapt an exploit within hours, leaving organizations little time to react. Many businesses still rely on patching schedules that are too slow for internet-facing systems. Organizations need continuous monitoring, rapid patching, tested incident response plans and clear visibility into exposed assets. They should also investigate suspicious activity dating back to before a vulnerability was publicly disclosed, because attacks may already be underway. 5. With PHP powering a significant portion of the internet, could we see further attacks exploiting this vulnerability? What should website operators do immediately to protect their systems, and should ordinary internet users be concerned about their data? Further attacks are possible, particularly against systems that remain unpatched or exposed. Website operators should apply the relevant security updates, check whether their PHP applications are vulnerable, and review logs for suspicious activity dating back to October 17. They should also restrict access and investigate signs of compromise. Ordinary users do not need to panic, but they should keep their accounts protected with unique passwords and multi-factor authentication where available. Whether personal data is at risk depends on which services they use and whether those systems were compromised. AI-assisted tools are increasingly being used to analyze code and identify vulnerabilities. How much of a role could artificial intelligence play in helping attackers discover and exploit flaws like PHP2Shell, and can defenders use the same technology to their advantage? AI can help analyze code, identify suspicious patterns and speed up the process of turning a vulnerability into a working exploit. This lowers some of the technical barriers for attackers and may shorten the time between discovering a flaw and exploiting it. However, AI is not the only factor, and we should not assume that every attack is AI-driven. Defenders can use the same capabilities to review code, prioritize vulnerabilities, analyze logs and detect suspicious behavior. The real advantage comes from combining AI with reliable data, skilled security teams and effective response processes. This case shows that attackers may exploit a vulnerability before a patch is available. Does this mean traditional vulnerability management is no longer enough, and how should organizations rethink their security strategy? Traditional vulnerability management remains essential, but patching alone is not enough when attackers may act before a fix becomes available. Organizations need to know which internet-facing systems they operate, understand their exposure and have additional controls in place. These include limiting access to vulnerable services, monitoring suspicious activity, applying temporary mitigations and preparing incident response procedures. They should also investigate whether systems were targeted before the vulnerability was disclosed. The goal is to reduce the opportunity for exploitation and detect attacks quickly, even when a patch is not yet available. Below is another interview I gave to TRT World discussing critical PHP vulnerabilities, the risks they pose to web servers, and the growing number of exploitation attempts. I explain why rapid patching and effective security measures are essential to minimize potential damage. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Collabora Collabora Online – Built-in CODE Server flaw, tracked as CVE-2026-110447 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog. Collabora Online – Built-in CODE Server is an app for Nextcloud that lets you open, edit and collaborate on documents, spreadsheets and presentations directly in your browser, without needing Microsoft Office installed on your computer. It is based on Collabora Online and LibreOffice technology. CVE-2026-110447 is a critical OS command injection flaw in Nextcloud’s proxy.php that affects Collabora Online Built-in CODE Server before 26.4.303. Unauthenticated attackers can execute commands when the built-in server is stopped. Standalone Collabora servers are not affected. Update immediately. In versions up to 26.4.302, proxy.php included request data in a Bash command without proper sanitization, allowing attackers to execute OS commands as the web server user. Exploitation is possible only when the local CODE server is stopped, such as during a restart, upgrade or crash. The script runs directly through the web server without loading Nextcloud’s code. Exploitation has been reported since September 2026, with attackers deploying PHP web shells and stealing configuration files containing credentials and application secrets. Three administrators reported the vulnerability on GitHub, while the first recorded attack dates back to September 10. The first attack was reported by a Nextcloud administrator whose servers had been compromised. Logs showed malicious requests on September 10 and 11, 2026, from the same IP, targeting proxy.php on version 26.4.302. The attackers deployed a PHP web shell and searched one server for credential stores and cryptocurrency wallets. Although reviewed logs showed no file exfiltration commands, data accessible to the web server account must be considered potentially exposed. Two other administrators reported similar incidents, but none found evidence of root access. After updating to 26.4.303, one administrator recorded another attempt on September 14, but no new shell appeared. Project maintainer mmeeks urged users to update and remove leftover shx*.php files. The CVE record confirms exploitation in September and October 2026, but the total number of compromised servers remains unknown. The flaw affects only the Development Edition’s Built-in CODE Server deployment. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by October 26, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. The operation has been attributed with medium confidence to APT41, a Chinese state-sponsored threat group also known as Brass Typhoon, Wicked Panda, and Barium. It was discovered in early 2026 and targeted diplomatic agencies in Central Asia, particularly in Tajikistan, Uzbekistan, and Turkmenistan. Kaspersky researchers analyzed the BlackX bootkit and found similarities with BlackLotus, which has been circulating on hacker forums since October 2022 and leveraged the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot protection. ESET confirmed in March 2023 that BlackLotus exploited Baton Drop, and at the time it could compromise even fully patched Windows 11 systems.
Confirm this action.
Leaving now will discard your changes.