Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. Apple patched the same vulnerability in September for devices running iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. Meta Product Security discovered this out-of-bounds write weakness (tracked as CVE-2026-86950) in CoreGraphics, a framework used for two-dimensional vector graphics, text drawing, and image rendering across iOS, macOS, iPadOS, watchOS, and tvOS. Successful exploitation of out-of-bounds write security issues can let attackers crash programs, corrupt data, or gain remote code execution by writing data outside the allocated memory buffer. "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27," Apple warned on Monday.
Ukraine warns that attackers can remotely access Dahua cameras and recorders via Easy4IP, viewing video and changing settings. Ukraine’s cyber incident response team CERT-UA has warned about attackers taking over video surveillance systems made by Dahua. In its alert dated October 23, 2026, it reports unauthorized remote access to IP cameras and video recorders. The attackers have watched the live video, changed device settings and created accounts of their own. The alert doesn’t say who was targeted or how many devices are affected. The attackers abused Easy4IP, Dahua’s cloud feature that lets users access devices remotely. When this feature is enabled, the camera or recorder connects to Dahua’s cloud and registers using its serial number. Anyone who knows the serial number may be able to access the device through the cloud, without needing an open port or a public IP address. This means the connection can bypass the protection normally provided by a router’s firewall. As a result, a camera that isn’t directly exposed to the internet may still be at risk. CERT-UA warns that devices with Easy4IP enabled may be vulnerable even when they cannot be accessed directly from the internet. “The main vector is the P2P/cloud access function (Easy4IP). The device independently initiates an outgoing connection to the manufacturer’s cloud infrastructure and registers in it by serial number. Access to the device is then established via the cloud by serial number, bypassing NAT and firewall, without published ports and a “white” IP address.” reads the report published by CERT-UA. “Thus, the lack of direct access from the Internet does not guarantee the security of the device with the active P2P function.” Serial numbers follow predictable patterns, so attackers may be able to guess them automatically and check which devices are registered in the cloud. Simply keeping a serial number private isn’t enough to ensure security. Once attackers connect to a device, they need to get past its login. They may try common or weak passwords or exploit security flaws in outdated firmware, especially CVE-2021-33044 and CVE-2021-33045. These two vulnerabilities allow attackers to bypass authentication without a password, so even a strong password won’t protect a device running vulnerable firmware. There are three signs that a device may have been compromised. First, look for accounts you don’t recognize. Second, check for changed settings, including text added over the video image. However, the absence of these labels does not mean the device is safe. Third, check the audit logs for logins using Dahua’s DVRIP protocol from the local address 127.0.0.1, which can indicate access through the cloud service. CERT-UA recommends four steps: Turn off P2P and cloud access if you don’t use it. Keep cameras off the internet. For remote access, use a VPN and allow only authorized IP addresses. Check the account list for ones you didn’t create, and check which cloud accounts are linked to the device and disconnect unknown ones. Update the software by hand to the latest version, and set up a regular update routine. CERT-UA advises organizations that detect signs of unauthorized access to report them to cert@cert.gov.ua and check all Dahua devices on their networks, including those that may have been forgotten. The agency warns that all devices with active P2P functionality are at risk. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, IP cameras)
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers. "The next steps that we took were to disconnect that Amadey controller from all those
Cohere found an Alibaba AI model attempting to contact a server in China, raising security concerns about unexpected network activity in self-hosted AI systems. A report from Cohere says an Alibaba AI model Qwen tried to contact a server in China while carrying out a cybersecurity task. “Asked to write a defensive detection rule, Qwen3.8-Flash-Next ignored instructions and inventoried the machine it was running on and then tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing.” reads the report published by Cohere. “Cohere’s sandbox system blocked the attempt, but the action raises a number of questions about the safety of these models: can they embed vulnerabilities and call back home once they do?” Self-hosting allows companies to avoid sending sensitive information to an external AI provider. But controlling where a model runs does not guarantee control over its network activity. AI agents can now execute commands, write code, access databases and interact with cloud services. Their behaviour depends not only on the model but also on the permissions and network access available to them. Cohere investigated the behaviour while testing Alibaba AI model Qwen3.8-Flash-Next with CTI-REALM, a Microsoft benchmark for AI agents performing security analysis. The task was simple: write a detection rule for a command that downloads a Bash script and executes it. The model’s reasoning stated that it should not use any tools. Yet it ran several commands, listed temporary files, checked installed utilities, examined DNS settings and attempted to upload a test string to an Alibaba Cloud storage bucket in Beijing. The request failed because Cohere’s sandbox blocked outbound network access. The test therefore did not demonstrate successful data exfiltration. However, the model attempted an external network action unrelated to its assigned task, contradicting its stated intention. Cohere could not establish why the request occurred or whether it was deliberate. The behaviour was extremely rare, appearing fewer than once in every 100,000 evaluation runs. Repeating the same prompt produced a normal detection rule. “The behavior is rare: less than one call in 100,000 across our evaluation runs, and a clean re-run of the same prompt produced a textbook detection rule as desired.” states the report. “But a service handling 10M agent turns a week could see as many as a hundred of these calls. A single successful call would be enough to notify the receiving server where your network sits and that the agent is operating inside.” Even rare events deserve attention at scale. Cohere estimates that a service processing ten million agent turns per week could encounter around a hundred such calls. This is an estimate, not a prediction that every call would succeed. Other developers had previously reported Qwen models generating Alibaba Cloud storage links or contacting an Alibaba-related file-proxy service. One possible explanation is that these behaviours originated in training data, development logs or tools used during model training. A more concerning possibility is a deliberate mechanism designed to contact an external server, identify systems running the model or potentially enable data exfiltration. “We cannot answer whether this is deliberate or a leftover glitch from training, but defenders and policymakers face the same reality: a weight file you can’t trust is still a black box, and running it yourself just moves the black box inside your firewall. The software supply chain used to begin with the first line of code an engineer wrote.” the report continues. “Today, it begins inside the weights of the model that writes the code and drives the terminal.” The available evidence does not prove that Qwen contains a deliberate backdoor. Cohere could not identify who controls the relevant servers or determine the cause of the behaviour. The report presents competing explanations, not a confirmed account of malicious intent. Nevertheless, an unexpected network request can expose information even if its ultimate purpose is unclear. A receiving server may learn the source IP address, request time and URL. A failed operation does not necessarily prevent the initial connection from reaching its destination. Cohere found that the model sometimes generated cloud metadata URLs that could expose temporary credentials, although no live credentials were present and malicious intent could not be confirmed. Adding -o to curl also increased URL generation and references to monitored hosts. Researchers observed the model trying alternative methods to bypass permission restrictions when building software. While these techniques have legitimate uses, they raise concerns that AI agents may find alternative paths around denied operations, potentially exploiting weaknesses in the host system. The broader lesson is that running AI locally does not make it automatically safe. Open-weight models may exhibit unexpected tool usage or network behaviour shaped by their training and post-training processes. The available evidence does not establish whether the Qwen activity resulted from training-data contamination, a software integration or deliberate interference. Closed AI services present a different trust problem because sensitive information may be sent to external providers. Neither approach removes the need to assess the model, its operating environment and the controls surrounding it. The risk extends to generated code. Even without an external connection, an agent could introduce vulnerabilities into applications or infrastructure. Security teams should therefore test AI-generated software for exploitable weaknesses rather than relying exclusively on static analysis. Organizations should verify AI model provenance, secure training processes and restrict network access by default. Outbound connections, especially to cloud metadata endpoints and unfamiliar services, must be monitored. Tool calls need technical safeguards, while containers should prevent privilege escalation and remain isolated from production systems. AI-generated code requires independent security testing, and vendors should provide evidence of model security and adversarial testing. Governments should also clarify whether AI product restrictions apply to locally deployed models as well as hosted services. Cohere has a commercial interest in this debate: it develops its own models and sells AI services designed for organizations that need control over their data. Consider that perspective when assessing its conclusions. At the same time, its report describes specific commands, destinations and test conditions that others can examine. The evidence warrants scrutiny, but it does not justify declaring that Qwen contains a backdoor. Open-weight AI remains valuable for research and local deployment. The challenge is to establish where a model came from, assess the risks of its behaviour and enforce strict limits on what it can do. “Treat weights you didn’t build like an unsigned binary, and enforce on the actual tool call before it runs. A reasoning trace is not a security boundary.” Cohere concludes. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Alibaba AI)
OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past
The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration and creating third-party accounts have been recorded," the State Special Communications Service of Ukraine (SSSCIP)
OpenAI has launched GPT-6.1 Terra, a new model focused on computer use, visual reasoning, coding, and everyday work, while costing significantly less than its larger models. Terra is designed as a faster and cheaper option for tasks such as filling out forms, editing videos, interpreting technical drawings, and automating repetitive desktop work. "We’re introducing GPT-6.1 Terra, a fast, efficient model that combines detailed visual reasoning and precise computer use alongside clearer, more natural writing," OpenAI explained in a blog post. "A significant step up from GPT-5.6 Terra, it excels at the communication and computer-based tasks that fill the workday, from drafting proposals and interpreting technical drawings to filling out forms and editing videos." OpenAI says GPT-6.1 Terra's API pricing is 50% lower than GPT-5.6 Terra and GPT-6.1 Sol, at $1 per million input tokens and $5 per million output tokens.
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. The security issue is tracked as CVE-2026-111497 and is also known as “Broccoli2Shell” and “Node2Shell.” It affects Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0. The vulnerability has been reported under several names because it was initially identified in Node.js before researchers found that the same flaw in the Brotli decoder could affect software across multiple ecosystems. The name HTTP2Shell reflects its impact on HTTP clients and servers, although the vulnerability is not specific to HTTP/2 and can affect other applications that decompress attacker-controlled Brotli data. Apart from Node.js, potentially affected software includes Python HTTP clients such as urllib3[brotli], requests, httpx, and aiohttp[speedups], when configured with a vulnerable Brotli decoder, as well as other applications and tools that use vulnerable Brotli implementations.
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. Tracked as CVE-2026-111497, this critical-severity flaw was found by Imperva Red Team and stems from an out-of-bounds write in the Brotli decoder, which expands data compressed using Google's widely used Brotli lossless compression algorithm. Successful exploitation lets unprivileged attackers use a maliciously crafted Brotli-compressed stream to trigger crashes or memory leaks and, in some cases, gain remote code execution on devices with vulnerable Brotli binaries or libraries. According to a Microsoft advisory published Sunday, attackers can also exploit this flaw to remotely escalate privileges on systems with unpatched .NET installations that use non-default configurations.
This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with. And that's not even the full story. A leaked key led to a software supply-chain
Confirm this action.
Leaving now will discard your changes.