𝗧𝗼𝗱𝗮𝘆’𝘀 𝗧𝗵𝗿𝗲𝗮𝘁 𝗜𝗻𝘁𝗲𝗹 𝗦𝘂𝗺𝗺𝗮𝗿𝘆 AI agents hijacked via silent AGENTS.md file drops; APT41’s BlackX UEFI bootkit kills named AV at kernel level; two M365 campaigns breached 1,000+ Entra tenants — all bypassing MFA. Defense means moving the target, not trusting static callbacks.

𝗨𝗻𝗽𝗮𝘁𝗰𝗵𝗲𝗱 𝗧𝗮𝗶𝗹𝘀𝗰𝗮𝗹𝗲 𝗦𝗦𝗛 𝗙𝗹𝗮𝘄 (𝗧𝗮𝗶𝗹𝘄𝗼𝗿𝗺): 𝗢𝗻𝗲 𝗖𝗼𝗺𝗽𝗿𝗼𝗺𝗶𝘀𝗲𝗱 𝗗𝗲𝘃𝗶𝗰𝗲 𝗥𝗲𝗮𝗰𝗵𝗲𝘀 𝗥𝗼𝗼𝘁 𝗼𝗻 𝗔𝗻𝘆 𝗣𝗲𝗲𝗿 𝘁𝗵𝗲 𝗡𝗲𝘁𝘄𝗼𝗿𝗸 𝗣𝗲𝗿𝗺𝗶𝘁𝘀 𝗜𝘁 𝘁𝗼 𝗖𝗼𝗻𝗻𝗲𝗰𝘁 𝗧𝗼 — Cyberdione Labs published a lab-verified technique against Tailscale v1.104.2: a single compromised device can SSH into any peer it has network-rule access to and gain root, no passwords or keys required. The root cause is architectural — Tailscale SSH authenticates devices, not users, so one foothold is all an attacker needs. No CVE has been assigned, no patch exists, and Tailscale has offered no remediation timeline despite publicly acknowledging the issue. Tailworm is a lateral movement multiplier that should prompt a hard look at server-side execution controls across any Tailscale deployment. When an attacker pivots to a new host via this technique, the next step is typically dropping tooling — shells, loaders, infostealers — directly on that server. The uncomfortable reality for organizations running Tailscale as a zero-trust overlay is that network trust is not execution trust. Controlling who can reach an endpoint via the network layer says nothing about what is permitted to execute once they arrive. Most enterprises have invested heavily in the network perimeter Tailscale replaced, but far fewer have defined post-pivot execution controls on the endpoints now reachable through it. That gap is worth closing before a compromised developer laptop becomes the pivot point into your production infrastructure.

𝗠𝟯𝟲𝟱 𝗧𝗼𝗸𝗲𝗻-𝗥𝗲𝗽𝗹𝗮𝘆 𝗖𝗮𝗺𝗽𝗮𝗶𝗴𝗻: 𝗔𝗶𝘁𝗠 𝗥𝗲𝗹𝗮𝘆 𝗖𝗮𝗽𝘁𝘂𝗿𝗲𝘀 𝗦𝗶𝗴𝗻-𝗜𝗻 𝗦𝗲𝘀𝘀𝗶𝗼𝗻𝘀, 𝗕𝘆𝗽𝗮𝘀𝘀𝗲𝘀 𝗠𝗙𝗔 𝗔𝗰𝗿𝗼𝘀𝘀 𝟵𝟳 𝗔𝗰𝗰𝗼𝘂𝗻𝘁𝘀 𝗮𝘁 𝟳𝟵 𝗢𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻𝘀 — Huntress tracked an adversary-in-the-middle relay campaign running July 14 through September 22, 2026, in which attackers intercepted post-authentication M365 OAuth tokens and replayed them directly against mailboxes, SharePoint, and OneDrive — no MFA re-challenge invoked, because the factor is only checked at authentication time, not token use. Over 200,000 login attempts were logged. 97 accounts at 79 organizations were fully compromised. 48 rogue Entra devices were registered for durable persistence. All traffic traced to 193.26.115.0/24. This campaign operated concurrently with — and independently from — the ConnectWise Cloud Backup incident and the STORM-0940 ScreenConnect chain: three distinct M365 mass-compromise paths active simultaneously. MFA does not protect against post-authentication token theft — this month's three concurrent M365 compromise chains prove it empirically, not theoretically. The 48 rogue Entra device registrations are the longer-tail threat: once an attacker has a device enrolled in your tenant, they hold persistence without needing to steal tokens again, and standard token rotation won't evict them. Enterprise defenders should evaluate where in the kill chain their controls actually sit — if nothing is operating at the token exfiltration layer on the endpoint, MFA is providing a false ceiling of confidence. The wider pattern demands equal attention: M365 is now under sustained, parallel pressure from multiple independent threat actors using distinct toolchains. This is not one campaign to contain. It is an identity attack ecosystem in broad circulation.

𝗖𝗼𝗻𝗻𝗲𝗰𝘁𝗪𝗶𝘀𝗲 𝗖𝗹𝗼𝘂𝗱 𝗕𝗮𝗰𝗸𝘂𝗽 𝗔𝗣𝗜 𝗦𝗲𝗰𝗿𝗲𝘁 𝗦𝘁𝗼𝗹𝗲𝗻 — 𝟭,𝟬𝟬𝟬+ 𝗘𝗻𝘁𝗿𝗮 𝗧𝗲𝗻𝗮𝗻𝘁𝘀 𝗛𝗶𝘁, 𝟭𝟲𝟮 𝗖𝗼𝗻𝗳𝗶𝗿𝗺𝗲𝗱 𝗖𝗼𝗺𝗽𝗿𝗼𝗺𝗶𝘀𝗲𝗱, 𝗦𝗲𝗿𝘃𝗶𝗰𝗲 𝗦𝗵𝘂𝘁 𝗗𝗼𝘄𝗻. A threat actor stole a ConnectWise Cloud Backup (formerly SkyKick) API secret and used it to authenticate directly into customers' Microsoft 365 environments — Exchange Online, Teams, SharePoint, MS Graph, and Partner Center — bypassing MFA entirely. Within 24 hours, Huntress observed nearly 1,000 Entra tenants touched, 300+ successful authentications, and 162 confirmed compromises. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management with no restoration timeline. This is the third ConnectWise-linked M365 mass compromise in five weeks. This is a supply chain trust violation at scale — and the real exposure isn't ConnectWise specifically, it's the unchecked OAuth app surface most organizations are carrying right now. The attacker needed no endpoint foothold: one stolen API credential with broad delegated permissions opened the door to phishing from trusted domains, malware delivery via SharePoint links, and bulk email credential harvesting across hundreds of orgs simultaneously. Backup tools, RMM platforms, and SaaS management vendors routinely hold M365 OAuth grants with permissions far exceeding their actual function. If your organization hasn't inventoried what third-party applications hold delegated M365 access — what they can read, write, send, or administer — this incident is a live demonstration of exactly how wide that blast radius can be.

𝗕𝗹𝗮𝗰𝗸𝗫 𝗨𝗘𝗙𝗜 𝗕𝗼𝗼𝘁𝗸𝗶𝘁: 𝗔𝗣𝗧𝟰𝟭 𝗕𝘆𝗽𝗮𝘀𝘀𝗲𝘀 𝗦𝗲𝗰𝘂𝗿𝗲 𝗕𝗼𝗼𝘁, 𝗟𝗼𝗮𝗱𝘀 𝗞𝗲𝗿𝗻𝗲𝗹 𝗗𝗿𝗶𝗳𝗲𝗿 𝗧𝗵𝗮𝘁 𝗘𝘅𝗽𝗹𝗶𝗰𝗶𝘁𝗹𝘆 𝗞𝗶𝗹𝗹𝘀 𝗞𝗮𝘀𝗽𝗲𝗿𝘀𝗸𝘆 𝗮𝗻𝗱 𝗔𝗳𝗮𝘀𝘁 𝗖𝗮𝗹𝗹𝗫𝗮𝗰𝗸𝘀 — APT41 (Brass Typhoon) deployed this UEFI bootkit in early 2026 espionage campaigns against Central Asian diplomatic targets. It exploits CVE-2022-21894 (Baton Drop) — the same flaw BlackLotus used — to bypass Secure Boot on fully patched Windows 11. A signed-but-revoked kernel driver then kills ETW telemetry, disables security callbacks, and executes code branches that explicitly terminate Kaspersky and Avast by name. Post-compromise payloads include a RAT using Google Drive, OneDrive, or Yandex.Disk for C2, a custom infostealer, and a reverse shell. The most important detail here isn’t the nation-state attribution — it’s the architectural implication. The threat actor didn’t work around endpoint protection; they hardcoded the termination of specific named security products into the kernel driver itself. Any control that depends on maintaining a named process, registering security callbacks, or consuming ETW event feeds is a documented, implemented target. Equally worth noting: CVE-2022-21894 is a 2022 vulnerability that still defeats Secure Boot on patched Windows 11 today. Organizations treating Secure Boot as a meaningful pre-execution integrity control should revisit that assumption. The pre-boot execution chain — before kernel-resident security tooling ever loads — remains the most reliable place to enforce trust. For teams conducting threat model reviews or evaluating endpoint control adequacy against BYOVD and firmware-level persistence, Kaspersky’s attribution report documents the implementation in full detail.

𝗪𝗲𝗯 𝗣𝗮𝗴𝗲 𝗦𝗶𝗹𝗲𝗻𝘁𝗹𝘆 𝗗𝗿𝗼𝗽𝘀 𝗠𝗮𝗹𝗶𝗰𝗶𝗼𝘂𝘀 𝗔𝗚𝗘𝗡𝗧𝗦.𝗺𝗱 𝗜𝗻𝘁𝗼 ~/𝗗𝗼𝘄𝗻𝗹𝗼𝗮𝗱𝘀 — 𝗔𝗜 𝗖𝗼𝗱𝗶𝗻𝗴 𝗔𝗴𝗲𝗻𝘁𝘀 𝗔𝘂𝘁𝗼-𝗘𝘅𝗲𝗰𝘂𝘁𝗲 𝗥𝗼𝗴𝘂𝗲 𝗜𝗻𝘀𝘁𝗿𝘂𝗰𝘁𝗶𝗼𝗻𝘀 𝗪𝗶𝘁𝗵 𝗡𝗼 𝗪𝗮𝗿𝗻𝗶𝗻𝗴. Forever Security confirmed a real-world incident: visiting a malicious webpage is sufficient to plant a rogue AGENTS.md in ~/Downloads. Chrome, Edge, and Firefox silently save it with no prompt. Because AI coding agents auto-load AGENTS.md from their working directory, the hijack is primed the moment a developer next runs their agent from that folder — no additional click required. Researchers achieved 90% success against OpenAI Codex and demonstrated OAuth token exfiltration and full account takeover against Claude Code. No patch is coming; agents loading AGENTS.md are working as designed. Every enterprise with developers running AI coding assistants — Claude Code, Codex, or any agent that honors AGENTS.md — is exposed right now. Internal telemetry showed over 1,300 Claude Code sessions launched directly from ~/Downloads, meaning this is not a theoretical edge case. The attack chain ends at execution: rogue package installs, credential store access, or any payload the agent is instructed to run. Security teams should immediately inventory which AI coding tools developers are running, audit the directories those tools are launched from, and evaluate whether controls exist to detect unsanctioned agent actions before they reach production systems or credential stores.

𝗚𝗶𝘁𝗟𝗮𝗯 𝗠𝗮𝘅-𝗦𝗲𝘃𝗲𝗿𝗶𝘁𝘆 𝗥𝗲𝗴𝗘𝘅 𝗖𝗼𝗺𝗽𝗶𝗹𝗲𝗿 𝗥𝗖𝗘 — 𝗥𝗲𝗺𝗼𝘁𝗲 𝗔𝘁𝘁𝗮𝗰𝗸𝗲𝗿𝘀 𝗖𝗮𝗻 𝗘𝘅𝗲𝗰𝘂𝘁𝗲 𝗖𝗼𝗱𝗲 𝗼𝗻 𝗦𝗲𝗹𝗳-𝗛𝗼𝘀𝘁𝗲𝗱 𝗚𝗶𝘁𝗟𝗮𝗯 𝗦𝗲𝗿𝘃𝗲𝗿𝘀 CVE-2026-GITLAB: A max-severity flaw in GitLab's RegEx compiler engine allows unauthenticated remote attackers to execute arbitrary code on any self-hosted GitLab instance. No authentication required — exposure is the entire internet-facing GitLab surface. Patch is available; unpatched servers are actively targeted. For enterprise security teams: GitLab is DevOps infrastructure — RCE here means source code theft, pipeline poisoning, and supply chain compromise in one shot. Every self-hosted GitLab instance in your environment is a critical-priority patch target today. Cloud-hosted GitLab.com is unaffected.

𝗔𝗿𝗶𝘀𝘁𝗮 𝗩𝗲𝗹𝗼𝗖𝗹𝗼𝘂𝗱 𝗢𝗿𝗰𝗵𝗲𝘀𝘁𝗿𝗮𝘁𝗼𝗿: 𝗧𝗵𝗶𝗿𝗱 𝗭𝗲𝗿𝗼-𝗗𝗮𝘆 𝗶𝗻 𝗙𝗼𝘂𝗿 𝗠𝗼𝗻𝘁𝗵𝘀 — 𝗖𝗩𝗦𝗦 𝟵.𝟵 𝗦𝗤𝗟 𝗜𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻 𝗚𝗿𝗮𝗻𝘁𝘀 𝗙𝘂𝗹𝗹 𝗦𝗗-𝗪𝗔𝗡 𝗖𝗼𝗻𝘁𝗿𝗼𝗹. Arista has disclosed an unauthenticated SQL injection vulnerability in the VeloCloud SD-WAN Orchestrator rated CVSS 9.9 — the third critical zero-day to hit this platform in four months. Successful exploitation hands an attacker full administrative control over SD-WAN policy, routing, and every branch site managed by the orchestrator. Three near-maximum-severity zero-days in a single platform within four months is a signal, not a coincidence — it points to systemic weaknesses in the codebase, not isolated misses. For CISOs running VeloCloud, the immediate question is whether the orchestrator management plane is reachable from untrusted networks. Restrict access now, assess the patch timeline, and treat orchestrator-level compromise as a realistic threat model rather than a theoretical one.

𝐓𝐞𝐚𝐦𝐏𝐂𝐏 𝐇𝐚𝐬 𝐂𝐨𝐦𝐩𝐫𝐨𝐦𝐢𝐬𝐞𝐝 1,000+ 𝐎𝐒𝐒 𝐏𝐚𝐜𝐤𝐚𝐠𝐞𝐬 𝐢𝐧 𝐅𝐨𝐮𝐫 𝐌𝐨𝐧𝐭𝐡𝐬 — 𝐀𝐈 𝐀𝐠𝐞𝐧𝐭𝐬 𝐈𝐧𝐬𝐭𝐚𝐥𝐥𝐢𝐧𝐠 𝐔𝐧𝐯𝐞𝐭𝐭𝐞𝐝 𝐃𝐞𝐩𝐞𝐧𝐝𝐞𝐧𝐜𝐢𝐞𝐬 𝐁𝐞𝐜𝐚𝐦𝐞 𝐭𝐡𝐞 𝐊𝐢𝐥𝐥 𝐒𝐰𝐢𝐭𝐜𝐡. The threat actor TeamPCP has poisoned more than a thousand open-source packages in under four months — and the kill switch is the AI coding agent your developers are already using. These agents pull and install dependencies autonomously, without human review, making them the ideal propagation mechanism for a malicious package to reach production before anyone reads a diff. The risk isn't theoretical and it isn't at the perimeter. It lives inside your development pipeline. Traditional software composition analysis tools audit approved package lists after the fact; they are blind to what an AI agent installs in the moment. Every AI-assisted build environment your organization runs is now a potential ingestion point for supply chain malware. Security teams need runtime visibility into agent-driven dependency resolution — not just a post-build SBOM — and development teams need guardrails that require human approval before any unvetted package lands in a build.

𝗡𝗼𝗱𝗲𝟮𝗦𝗵𝗲𝗹𝗹: 𝗥𝗖𝗘 𝗘𝘅𝗽𝗹𝗼𝗶𝘁 𝗗𝗲𝗺𝗼𝗻𝘀𝘁𝗿𝗮𝘁𝗲𝗱 𝗼𝗻 𝗢𝗳𝗳𝗶𝗰𝗶𝗮𝗹, 𝗨𝗻𝗺𝗼𝗱𝗶𝗳𝗶𝗲𝗱 𝗡𝗼𝗱𝗲.𝗷𝘀 𝟮𝟰.𝟮𝟮.𝟬 𝗕𝘂𝗶𝗹𝗱 — 𝗖𝗩𝗘-𝟮𝟬𝟮𝟲-𝟭𝟭𝟭𝟰𝟵𝟳. Researchers have successfully demonstrated a working remote code execution exploit against an official, unmodified Node.js 24.22.0 build. The Node2Shell technique requires no memory corruption — it weaponizes the Node.js native module loader to inject a malicious .node binary via crafted require() paths, achieving shell execution with the privileges of the Node process. Every enterprise running Node.js-based APIs, microservices, or CI/CD tooling is exposed right now. This is not a configuration issue — it affects default, unpatched installs. Endpoint isolation and in-memory behavioral detection (AMTD) are the only controls that catch post-exploitation activity before lateral movement begins.

𝗣𝗶𝗹𝗹𝗼𝗼 𝗖𝗩𝗘-𝟮𝟰𝟰𝟬-𝟱𝟱𝟰𝟵𝟰𝟰: 𝗖𝗼𝗱𝗲 𝗘𝗗𝗲𝗻𝗾𝗶𝗼𝗻 𝘃𝗶𝗮 𝗖𝗿𝗮𝗳𝗰𝗲𝗱 𝗘𝗣𝗦 𝗙𝗶𝗹𝗲𝗻𝗮𝗺𝗲 — 𝟮𝟰𝟬 𝓴𝓾𝓻𝓻𝓾𝓸𝓷 𝗣𝗮𝗸𝗵𝗼𝗻 𝗣𝗿𝗼𝗷𝗲𝗻𝗰𝗶𝗲𝗴 𝗮𝗰 𝗥𝗶𝗴𝗸. A critical remote code execution flaw has been disclosed in Pillow, Python’s dominant image-processing library with 436 million monthly downloads. Attackers can trigger arbitrary code execution simply by supplying a crafted EPS filename — no file content manipulation required. The vulnerability window is currently unpatched, and a working Node2Shell exploit against an unmodified Node.js 24 build confirms active exploitation potential across the Python and Node.js ecosystems simultaneously. If your organization runs Python web apps, data pipelines, ML workflows, or any service that processes user-supplied images, you are exposed right now. Security teams should immediately audit all Pillow dependencies across their software inventory, restrict image upload surfaces where possible, and prioritize emergency patching the moment a fix lands. This is a supply-chain-scale event — the sheer download volume means Pillow is embedded deep in third-party packages your teams may not even know they’re running. Treat this as a critical incident response situation, not a routine patch cycle.

𝗠𝗼𝗿𝗽𝗵𝗶𝘀𝗲𝗰 𝗧𝗵𝗿𝗲𝗮𝘁 𝗕𝗿𝗶𝗲𝗳 · Oct 23: AI automates supply chain attacks at 2,900/min (Storm-0940). 1K+ OSS packages poisoned. Live RCEs in Pillow & Node.js 24. Arista VeloCloud CVSS 9.9 (3rd zero-day in 4 months). GitLab max-RCE today. Perimeters are burning.

𝗚𝗶𝘁𝗟𝗮𝗯 𝗠𝗮𝘅-𝗦𝗲𝘃𝗲𝗿𝗶𝘁𝘆 𝗥𝗲𝗴𝗘𝘅 𝗖𝗼𝗺𝗽𝗶𝗹𝗲𝗿 𝗥𝗖𝗘 — 𝗥𝗲𝗺𝗼𝘁𝗲 𝗔𝘁𝘁𝗮𝗰𝗸𝗲𝗿𝘀 𝗖𝗮𝗻 𝗘𝘅𝗲𝗰𝘂𝘁𝗲 𝗖𝗼𝗱𝗲 𝗼𝗻 𝗦𝗲𝗹𝗳-𝗛𝗼𝘀𝘁𝗲𝗱 𝗚𝗶𝘁𝗟𝗮𝗯 𝗦𝗲𝗿𝘃𝗲𝗿𝘀. GitLab patched a CVSS 10.0 unauthenticated RCE in its RegEx Compiler — no credentials required to own exposed Community or Enterprise Edition instances. This hits the same week as LiteLLM, OVHcloud CLI, AOMEI Backupper, and ConnectWise supply chain compromises: CI/CD infrastructure is under coordinated, multi-vector attack. CI/CD compromise is the highest-leverage pivot in the modern enterprise kill chain. Once an attacker controls the pipeline, every build artifact and every developer endpoint that consumes it becomes a payload delivery vehicle — silently, at scale, with implicit trust already baked in. Organizations running self-hosted GitLab should patch immediately and audit pipeline access controls, secrets exposure, and artifact signing practices. Security teams should also account for AI coding agents now running automated pipeline jobs: those flows carry the same blast radius as human developer access and warrant the same scrutiny around authorization boundaries and anomaly detection before a CI/CD compromise turns them into an undetected insider threat vector.

𝗣𝗥𝗜𝗹𝗹𝗢 𝘅𝗲𝗹𝗼𝗮𝗹𝗱 𝗢𝗳𝗰𝗵𝗲𝗹𝗹𝗰𝗻: 𝗧𝗵𝗽𝗳𝗱 𝗟𝗲𝗿𝗼-𝗗𝗲𝗼 𝗽𝗻 𝗙𝗼𝗾𝗿 𝗠𝗼𝗻𝗳𝗵𝗹 — 𝗣𝗩𝗦𝗦 𝟿.𝟿 𝗦𝗤𝗟 𝗜𝗻𝗷𝗲𝗰𝗳𝗽𝗼𝗻 𝗚𝗳𝗲𝗻𝗳𝗹 𝗙𝗲𝗹𝗹 𝗦𝗗-𝗨𝗔𝗙 𝗣𝗼𝗻𝗳𝗿𝗼𝗹. CVE-2026-114625 allows any authenticated user — including read-only customer accounts — to escalate to operator privilege on VeloCloud Orchestrator, the management plane governing enterprise SD-WAN routing. Active exploitation is confirmed. Organizations that fully patched the July and September VeloCloud zero-days are still exposed to this one. This isn't a single vendor stumble — it's a quarter-long siege: 13+ critical zero-days across Cisco ISE, Check Point, F5, Citrix NetScaler, SonicWall, Ivanti, FortiGate, PAN-OS, BeyondTrust, and now three separate VeloCloud rounds. The data makes a hard argument: perimeter and network control planes are being targeted systematically, patch cadence is not keeping pace with discovery, and full compliance after prior rounds guarantees nothing on the next. When SD-WAN orchestration is the compromise target, the blast radius is enterprise-wide routing control — not a misconfigured endpoint, but the plane that decides where traffic goes. Security teams need to pressure-test the assumption that patched equals protected, especially on appliance categories that have been hit repeatedly this quarter.

𝐓𝐞𝐚𝐦𝐏𝐂𝐏 𝐇𝐚𝐬 𝐂𝐨𝐦𝐩𝐫𝐨𝐦𝐢𝐬𝐞𝐝 𝟏,𝟎𝟎𝟎+ 𝐎𝐒𝐒 𝐏𝐚𝐜𝐤𝐚𝐠𝐞𝐬 𝐢𝐧 𝐅𝐨𝐮𝐫 𝐌𝐨𝐧𝐭𝐡𝐬 — 𝐀𝐈 𝐀𝐠𝐞𝐧𝐭𝐬 𝐈𝐧𝐬𝐭𝐚𝐥𝐥𝐢𝐧𝐠 𝐔𝐧𝐯𝐞𝐭𝐭𝐞𝐝 𝐃𝐞𝐩𝐞𝐧𝐝𝐞𝐧𝐜𝐢𝐞𝐬 𝐁𝐞𝐜𝐚𝐦𝐞 𝐭𝐡𝐞 𝐊𝐢𝐥𝐥 𝐒𝐰𝐢𝐭𝐜𝐡 Starting with a Trivy compromise in February, TeamPCP systematically backdoored CI/CD pipelines and poisoned more than 1,000 open-source packages in four months. Each malicious package carries credential stealers, reverse shells, or in-memory implants that fire the moment the dependency loads — and the critical force multiplier is that AI coding assistants and agentic dev workflows now pull and execute those dependencies continuously, with virtually no human review in the loop. For enterprise security teams, this reframes the AI coding assistant as an initial access vector. Shadow coding tools — the ones developers adopt without IT approval — are quietly pulling unvetted packages into build pipelines at scale, and most organizations have zero inventory of what those agents actually installed. The primary attack surface is Linux-heavy CI/CD infrastructure, where visibility gaps are widest; the blast radius of a single poisoned dependency can extend from the build environment into production through credential exfiltration, key capture, and persistent memory-resident footholds.

𝐍𝐨𝐝𝐞𝟐𝐒𝐡𝐞𝐥𝐥: 𝐑𝐂𝐄 𝐄𝐱𝐩𝐥𝐨𝐢𝐭 𝐃𝐞𝐦𝐨𝐧𝐬𝐭𝐫𝐚𝐭𝐞𝐝 𝐨𝐧 𝐎𝐟𝐟𝐢𝐜𝐢𝐚𝐥, 𝐔𝐧𝐦𝐨𝐝𝐢𝐟𝐢𝐞𝐝 𝐍𝐨𝐝𝐞.𝐣𝐬 𝟐𝟒.𝟐𝟐.𝟎 𝐁𝐮𝐢𝐥𝐝 — 𝐂𝐕𝐄-𝟐𝟎𝟐𝟔-𝟏𝟏𝟏𝟒𝟗𝟕. Imperva published a working RCE proof-of-concept against the official, unmodified Node.js 24.22.0 image by feeding crafted Brotli-compressed data to the bundled decoder. This is no longer theoretical — it is a demonstrated exploit on a standard runtime. Any Node.js app decoding untrusted Brotli data is in scope; with Brotli as the default compression for ~35% of HTTPS traffic, that scope is broad. For enterprise security teams: when this RCE lands on a Windows server, AMTD prevents the shellcode from executing in memory — Node process morphing blocks attacker memory targeting regardless of how the exploit was triggered. Patch to 24.22.1 (released Oct 21). The 22.x and 26.x lines remain untested. Financial services and e-commerce running high-traffic Node.js APIs should treat this as active exposure now.

𝗧𝗼𝗱𝗮𝘆'𝘀 𝗧𝗵𝗿𝗲𝗮𝘁 𝗜𝗻𝘁𝗲𝗹 𝗦𝘂𝗺𝗺𝗮𝗿𝘆 AI-driven supply chain attacks hit 2,900 sign-ins/min; 1,000+ OSS packages poisoned by AI agents. Python Pillow & Node.js 24 have live RCEs. GitLab & Arista VeloCloud (CVSS 9.9) burning through perimeters fast.

𝗚𝗶𝘁𝗟𝗮𝗯 𝗠𝗮𝘅-𝗦𝗲𝘃𝗲𝗿𝗶𝘁𝘆 𝗥𝗲𝗴𝗘𝘅 𝗖𝗼𝗺𝗽𝗶𝗹𝗲𝗿 𝗥𝗖𝗘 — 𝗥𝗲𝗺𝗼𝘁𝗲 𝗔𝘁𝘁𝗮𝗰𝗸𝗲𝗿𝘀 𝗖𝗮𝗻 𝗘𝘅𝗲𝗰𝘂𝘁𝗲 𝗖𝗼𝗱𝗲 𝗼𝗻 𝗦𝗲𝗹𝗳-𝗛𝗼𝘀𝘁𝗲𝗱 𝗚𝗶𝘁𝗟𝗮𝗯 𝗦𝗲𝗿𝘃𝗲𝗿𝘀 CVSS 10.0 unauthenticated RCE — no credentials required. Hits same week as LiteLLM PyPI, OVHcloud CLI, and ConnectWise compromises. CI/CD infrastructure under coordinated siege. Audit internet exposure and extend endpoint coverage to downstream build consumers.

𝐀𝐫𝐢𝐬𝐭𝐚 𝐕𝐞𝐥𝐨𝐂𝐥𝐨𝐮𝐝 𝐎𝐫𝐜𝐡𝐞𝐬𝐭𝐫𝐚𝐭𝐨𝐫: 𝐓𝐡𝐢𝐫𝐝 𝐙𝐞𝐫𝐨-𝐃𝐚𝐲 𝐢𝐧 𝐅𝐨𝐮𝐫 𝐌𝐨𝐧𝐭𝐡𝐬 — 𝐂𝐕𝐒𝐒 𝟗.𝟗 𝐒𝐐𝐋 𝐈𝐧𝐣𝐞𝐜𝐭𝐢𝐨𝐧 𝐆𝐫𝐚𝐧𝐭𝐬 𝐅𝐮𝐥𝐥 𝐒𝐃-𝐖𝐀𝐍 𝐂𝐨𝐧𝐭𝐫𝐨𝐥 CVE-2026-114625 active exploitation confirmed. Read-only accounts can escalate to operator privilege. Third zero-day on this product since July — fully-patched orgs still vulnerable. 13+ critical zero-days across network appliances this quarter.

𝗧𝗲𝗮𝗺𝗣𝗖𝗣 𝗛𝗮𝘀 𝗖𝗼𝗺𝗽𝗿𝗼𝗺𝗶𝘀𝗲𝗱 𝟭,𝟬𝟬𝟬+ 𝗢𝗦𝗦 𝗣𝗮𝗰𝗸𝗮𝗴𝗲𝘀 𝗶𝗻 𝗙𝗼𝘂𝗿 𝗠𝗼𝗻𝘁𝗵𝘀 — 𝗔𝗜 𝗔𝗴𝗲𝗻𝘁𝘀 𝗜𝗻𝘀𝘁𝗮𝗹𝗹𝗶𝗻𝗴 𝗨𝗻𝘃𝗲𝘁𝘁𝗲𝗱 𝗗𝗲𝗽𝗲𝗻𝗱𝗲𝗻𝗰𝗶𝗲𝘀 𝗕𝗲𝗰𝗮𝗺𝗲 𝘁𝗵𝗲 𝗞𝗶𝗹𝗹 𝗦𝘄𝗶𝘁𝗰𝗵 Since February, TeamPCP poisoned 1,000+ OSS packages via CI/CD compromise. AI coding agents install dependencies autonomously with no human review — turning every dependency resolution into a potential initial access event.