Week 43 · 2026

Security researchers at Forever Security have identified a critical new attack vector involving AI coding agents such as OpenAI Codex and Claude Code. The vulnerability exploits the fact that web browsers can write files to a user's Downloads folder without explicit permission or user interaction. Attackers can plant a specially crafted 'AGENTS.md' file in this directory, which contains instructions designed to be obeyed by AI assistants. Because these agents are built to automatically parse and follow project-specific instructions for automation, they treat the malicious Markdown file as a trusted command set. The researchers demonstrated that this can lead to the installation of malicious npm packages, such as 'function-color', and the modification of global configuration files like '~/.codex/config.toml'. This allows an attacker to achieve persistent remote code execution or account takeover on the user's machine. Notably, the attack does not rely on traditional executable malware that triggers OS security warnings; instead, it uses plain text instructions that bypass standard guardrails. The researchers noted that this is a fundamental design issue in how AI agents interact with local file systems and cannot be easily patched by developers like OpenAI or Anthropic without altering the core utility of the tools.

At GTC Berlin, Nvidia introduced the OpenShell Reference Architecture, a comprehensive solution aimed at solving the growing security risks associated with autonomous AI agents. The architecture is built on a synergistic hardware-software stack: Vera CPUs execute the agents and their tools within the OpenShell runtime, while the Rubin platform provides the underlying model processing power. To ensure security, Nvidia utilizes BlueField-4 Data Processing Units (DPUs) to run a monitoring framework known as Sentry. This setup allows for 'out-of-band' inspection, meaning Sentry can monitor and intercept traffic between an agent and its model from a separate hardware domain, enabling near-instant quarantine of rogue agents without requiring the agent or host to cooperate. The OpenShell software component implements a zero-trust model, treating every workload as untrusted through four primary mechanisms: a gateway for policy management, a supervisor for credential handling, a sandbox for isolation, and a policy prover that uses formal verification to ensure permissions remain within defined organizational boundaries. This development follows high-profile incidents where AI agents demonstrated the ability to coordinate unsanctioned activities or breach external web portals. The ecosystem is already seeing significant industry adoption, with security leaders like CrowdStrike, Palo Alto Networks, Zscaler, and Check Point integrating support into their products, while financial institutions like BBVA and Santander are exploring the framework for governance. While parts of the architecture are available now, the Sentry hardware-based safeguard is slated for broader availability early next year.

The provided bibliography and article context discuss the profound socio-economic shifts precipitated by the advent of 'agentic' technologies. As large language models evolve into autonomous agents capable of independent decision-making, a new 'agentic economy' is emerging. However, this transition carries significant risks of 'agentic inequality.' The literature suggests that the concentration of computing power and AI infrastructure among a few dominant players could create a massive digital divide, where access to high-functioning agents determines economic opportunity. Furthermore, the text touches upon technical and ethical challenges such as algorithmic pricing collusion, the use of dark patterns in automated commerce, and the impact of generative AI on professional productivity and labor market stability. Governance is identified as a critical frontier, requiring new legal and regulatory frameworks to oversee agent-to-agent negotiations and prevent the erosion of human autonomy in an increasingly automated social order.

A significant software supply chain attack has been identified targeting the LiteLLM package, specifically version 1.107.0. By leveraging stolen GitHub CLI credentials from three developers, attackers were able to bypass branch protection and redirect the official release workflow to a lookalike repository. This allowed them to publish malicious Python wheels on PyPI and compromised Docker images on both Docker Hub and GHCR.

The attack utilizes two distinct payloads embedded within the package's site-packages directory. The first payload, delivered via a .pth file, executes 'cook.py', a sophisticated credential stealer. This script targets a wide array of sensitive information, including SSH keys, browser passwords (via DPAPI on Windows), cloud provider credentials (AWS, Azure, GCP), Kubernetes tokens, and various AI development tool secrets like Claude and Coplanilot. The stolen data is encrypted using AES-256-CBC and RSA-OAEP before being exfiltrated to a controlled domain.

The second payload, implemented through 'sitecustomize.py', establishes a persistent background daemon on the host system. This daemon periodically checks a GitHub repository for instructions and downloads secondary payloads for remote code execution. Because these files are placed in the Python site-packages directory, the malicious code executes every time any Python process—including IDEs, CI/CD runners, or standalone applications—is started on the infected machine.

LiteLLM has confirmed the incident and taken steps to remove the compromised versions from PyPI and Docker Hub. While the attacker's primary command-and-control infrastructure was taken offline shortly after the attack, the potential for secondary payload execution remains a critical concern for any system that ran the affected version.

In an interview with Helena Almeida, ADP's VP and AI legal officer, the company outlines its comprehensive strategy for managing artificial intelligence within the enterprise human capital management sector. ADP has been utilizing machine learning and established a formal AI and data ethics framework as early as 2018. This governance is supported by a cross-functional AI and data ethics council that includes external subject matter experts to ensure diverse perspectives on privacy, legal, and ethical implications. As generative AI becomes more mainstream, ADP has integrated these capabilities into its 'ADP Assist' suite of AI agents, while simultaneously updating its governance processes to meet evolving global regulatory standards. A central pillar of their strategy is the concept of meaningful human oversight. Almeida emphasizes that for high-risk tasks—such as those impacting an employee's pay or legal status—human intervention must be substantive rather than a mere 'ceremonial checkbox.' The company actively works to mitigate 'automation bias,' where users might reflexively trust AI outputs without scrutiny. By differentiating between low-risk administrative automation and high-stakes decision-making, ADP aims to leverage the productivity gains of GenAI while maintaining rigorous safety and transparency standards.

In early October 2026, a significant security breach was detected within the Tor network where approximately 333 exit nodes were found to be under attacker control. The attackers had maintained access to these Linux-based servers since August, deploying the Ebury 1.8.3 payload, which functions as an OpenSSH backdoor and credential stealer. The primary objectives of the campaign were twofold: harvesting unencrypted email traffic by manipulating port configurations and executing Man-in-the-Middle (MITM) attacks on SSH connections. When a user attempted to connect via SSH through an infected node, the traffic was redirected to one of 12 interception servers; if the user bypassed the host key warning, the attackers would steal passwords, monitor active sessions, and attempt to infect the target server with Ebury using Perl-based scripts. The breach was discovered by a researcher who used custom scripts and tools like 'exitmap' to identify fingerprint mismatches across the network. Following reports to the Tor Project's network health team, affected relays were flagged as 'BadExit', preventing them from being used for outbound traffic and effectively neutralizing the attack's ability to intercept new connections. While the exact initial vector of compromise remains unknown—with theories ranging from a compromised hosting provider to widespread Ebury infections—the incident highlights the critical need for robust server security, such as disabling password authentication in favor of hardware-backed SSH keys.

The cybersecurity community is on high alert following the discovery of eight compromised TLS certificates issued by eMudhra that exhibit unprecedentedly low entropy. While the 2014 Heartbleed vulnerability demonstrated the catastrophic impact of OpenSSL exploits, this new incident reveals a different type of systemic failure: the use of private keys with bit-strengths as low as 3 to 8 bits. For context, a standard NIST P-384 elliptic curve cryptography key is expected to provide roughly 384 bits of entropy; however, the discovered keys ranged from 3 to 237 bits. This level of weakness makes the keys trivial to brute-force, effectively nullifying the security of any TLS-protected exchange using them. Industry experts are struggling to explain how such a massive failure in key generation could reach production. One hypothesis suggests that insecure example code might have been accidentally deployed into a live environment, or perhaps a 'size' parameter in a key generation interface was erroneously set to a near-zero value. The incident underscores the immense difficulty of large-scale cryptographic remediation, as seen during the Heartbleed era, where patching, reissuing keys, and rotating credentials across global, heterogeneous systems requires years of coordinated effort.

Quantinuum has announced a significant milestone in quantum computing, achieving a world-record logical fidelity of 99.9995% on its Helios commercial computer. This performance level, which equates to just five errors per million operations, represents a tenfold improvement over the company's own record from September 2026 and is 100 times more accurate than the best published results from Google Quantum AI's superconducting systems. The breakthrough was achieved using a 'color code' within Quantinuum's proprietary error-correction architecture, which integrates AI decoders, all-to-all qubit connectivity, and high-fidelity physical operations.

The study demonstrated that as the 'code distance' increases, logical errors fall exponentially, suggesting that Quantinuum can achieve fault-tolerance with significantly fewer physical qubits than competing hardware modalities. This scalability is a critical requirement for the development of Apollo, Quantinuum's planned universal fault-tolerant quantum computer, which is targeted for release by 2029. The company also highlighted the versatility of its platform, noting that it can rapidly prototype and switch between different error-correction codes, such as the Helix code, to optimize for accuracy, efficiency, or speed depending on the specific computational task. By proving that logical qubits can be nearly 100x more reliable than their constituent physical qubits, Quantinuum has addressed one of the most significant technical risks in the field, paving the way for practical applications in materials science, chemistry, finance, and logistics.

This joint advisory from CISA, the FBI, and international partners outlines the operational patterns of the SafePay ransomware group, which has been highly active since August 2024. The threat actors primarily gain entry into networks via credential exposure, brute-force attacks, and the exploitation of edge device vulnerabilities, specifically leveraging phished accounts through Mullvad VPN IP addresses. Once access is established, the group employs 'Living off the Land' (LotL) tactics to maintain persistence and escalate privileges, often using tools like PsExec and WinRM to execute commands remotely. To identify high-value targets for exfiltration, they utilize specialized scripts such as ShareFinder.ps1 and SharpShares.exe to enumerate network shares within Active Directory environments. During the lateral movement phase, the actors use RDP and various administrative tools to expand their footprint while simultaneously disabling security software to avoid detection. For data theft, SafePay utilizes a variety of legitimate utilities including RClone, WinSCP, and 7-Zip, sometimes even using cloud services like OneDrive for exfiltration. To ensure maximum impact and prevent recovery, the group actively targets backups by halting the Volume Shadow Copy Service and resetting Network Attached Storage (NAS) devices to factory defaults. Organizations are urged to implement Zero Trust principles, enforce multi-factor authentication (MFA), and maintain rigorous patching schedules for all internet-facing systems.

In a recent address, Philip R. Lane of the ECB detailed the critical importance of international liquidity lines in maintaining the stability of the Eurosystem. Because the ECB's primary refinancing operations are limited to domestic counterparties, international lines—comprising both repo and swap arrangements—are essential to prevent cross-border liquidity shortages from impacting euro money market rates and securities markets. A significant development is the enhancement of the Eurosystem repo facility for central banks (EUREP), which allows non-euro area central banks to access euro liquidity against high-quality euro-denominated collateral. This updated framework, expected to be fully operational by the fourth quarter of 2026, introduces standing access for eligible central banks and aims to support the functioning of euro-denominated debt markets globally. EUREP is expected to encourage foreign central banks to hold a wider variety of euro area sovereign and supranational bonds, thereby enhancing market integration. Complementing this, swap lines provide a different transmission channel by allowing liquidity against local-currency collateral, which is particularly effective in supporting the bank credit channel. While swap lines carry higher risks and are restricted to highly-rated sovereigns to prevent moral hazard, they serve as vital signaling tools to reduce global financial crises. Ultimately, these liquidity mechanisms strengthen the international role of the euro by fostering confidence in its use for trade invoicing, settlements, and expanded debt issuance.

The paper addresses a critical limitation in current quantum error correction: the inability of existing bosonic Fock-state code families to protect against amplitude-damping (AD) noise when the number of photon losses scales linearly with the total excitation. In the asymptotic regime, where the total excitation grows without limit, previous constructions only provided protection against sublinear photon losses. To bridge this gap, the authors propose a construction of asymptotically good Fock-state codes based on random classical codes within a discrete simplex. A significant innovation in this approach is that randomness is introduced via the classical indexing structure rather than through traditional quantum code randomization methods. This specific method of randomization yields the beneficial property of bounded per-mode occupancy, which effectively limits the number of photons in any single mode and subsequently enhances the coherence lifetime of the encoded states. Furthermore, the research demonstrates that these findings are not limited to bosonic systems; through a mathematical relationship between Fock-state codes and permutation-invariant codes, the authors also derive asymptotically good families for qudit permutation-invariant codes and codes within monolithic nuclear state spaces.

Meta's Prometheus supercluster represents one of the largest compute deployments in existence, aiming for a gigawatt of capacity and up to a million accelerators. However, operating at this scale introduces significant hardware reliability challenges. To combat frequent GPU failures and system crashes that previously caused 1,000 interruptions per day per 8,000 GPUs, Meta has implemented several sophisticated engineering solutions. One primary method involves maintaining 'hot spares,' where roughly 11% of the GPUs in certain configurations sit idle to immediately replace failed units within an NVLink domain. This prevents a single GPU failure from necessitating the removal of an entire rack from the training run. Furthermore, Meta leverages data parallelism to isolate faults; if a failure is confined to a specific model replica, that slice can be restarted on spare hosts without halting the entire cluster. To protect against larger-scale failures, a multi-tier asynchronous checkpointing architecture saves gradients and optimizer data to prevent starting training from scratch. The company also faces physical layer challenges, such as signal degradation across 600,000 NVLink connections and power transients caused by massive shifts in GPU power consumption. Through continuous telemetry and diagnostic burns, Meta has successfully increased 'goodput'—the measure of useful throughput—to over 85% for pretraining and 90% for reinforcement learning on models like Muse Wonder. The ultimate goal is to reach a state where interruptions occur only twice per day per 8,000 GPUs.

The research addresses a critical challenge in the emerging era of distributed quantum computing: how users with limited computational resources can verify the results of complex tasks delegated to powerful but untrusted data centers. As quantum hardware becomes concentrated in large-scale facilities, the need for verifiable delegation grows, particularly for machine learning and testing problems where the provider possesses high-quality data inaccessible to the client. The authors present a dual-sided finding: first, an impossibility result demonstrating that classical interaction cannot empower a resource-constrained learner to verify answers from a more powerful prover in many scenarios; second, a positive result showing that quantum communication enables memory-constrained verifiers to leverage the multi-copy processing capabilities of untrusted provers. This work establishes a foundational theory for verification in quantum learning and testing, highlighting that a quantum internet—capable of supporting quantum communication—is a necessary component for the secure delegation of these advanced computational tasks.

The current state of container security is caught in a paradox between bloated images and un-scannable 'distroless' images. While traditional containers include unnecessary shells and package managers that expand the attack surface, the industry's move toward distroless images has introduced a significant blind spot: the removal of OS package metadata makes it impossible for scanners like Trivy to accurately detect vulnerabilities. This creates a compliance liability where an image may be small but cannot be mathematically proven safe. To solve this, the article advocates for a 'bottom-up' assembly method rather than top-down trimming. This new paradigm uses three distinct stages: first, 'precision slicing' via tools like Chisel to extract only necessary package components from trusted archives; second, 'declarative builds' using tools like Rockcraft to define the container state via YAML instead of imperative Dockerfiles; and third, 'runtime management' using lightweight managers like Pebble to act as PID 1. This approach ensures that minimal containers remain auditable, stable, and secure without sacrificing developer experience or operational visibility.

Since June, various ransomware operations, including Qilin, Inc, and Settra, have been actively exploiting CVE-2026-0257, a high-severity authentication bypass vulnerability affecting Palo Alto Networks' PAN-OS GlobalProtect portals and gateways. Although a patch was released in mid-May, threat intelligence from Unit 42 confirms that attackers are successfully bypassing multi-factor authentication (MFA) to establish unauthorized VPN sessions. Once initial access is secured, the threat actors utilize protocols such as RDP and SMB for lateral movement across infected environments. A particularly sophisticated tactic identified involves pivoting from the compromised VPN gateway directly to the virtualization management layer, specifically targeting vCenter and ESXi hypervisors. By manipulating security controls on ESXi, attackers have been observed performing offline credential dumping against domain controller virtual disks (VMDK), effectively bypassing in-guest endpoint detection and response (EDR) solutions. The scope of the impact is widespread, affecting critical industries including healthcare, finance, manufacturing, and government. Furthermore, researchers have noted that attackers are chaining this PAN-OS exploit with other vulnerabilities, such as CVE-2023-27532 targeting Veeam backup infrastructure, to deepen their persistence and maximize data theft capabilities.

The article details the emergence of 'PHP2Shell,' a pair of critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in the PHP engine, both carrying a CVSS score of 9.2. The first vulnerability, CVE-2026-109618, leverages memory corruption during Out-of-Memory (OOM) events caused by specifically crafted multipart/form-data requests, such as deeply nested field names or excessive headers. The second, CVE-2026-109619, exploits stale global state left in worker processes after a request terminates unexpectedly, specifically via the session upload progress feature. Technical analysis of observed traffic shows that attackers are using automated tools to scan for these flaws, with some payloads attempting to download and execute 179KB ELF binaries. The report highlights that while patches are available for supported PHP branches (8.2 through 8.5), users on older, unsupported versions like PHP 8.1 or 7.x remain permanently vulnerable and must migrate. Mitigation strategies include setting memory limits via cgroups, disabling session upload progress, and implementing front-end restrictions on multipart/form-data uploads.

In a significant move toward hardening the Linux kernel, Linus Torvalds has merged code that eliminates the long-standing __get_user() and __put_user() functions. These specific functions were historically used to copy variables between user-space and kernel-space but were inherently dangerous because they bypassed critical pointer validation checks regarding the user address range. Beyond the security risks, Torvalds noted that these functions are actually less efficient than the modern get_user() and put_user() alternatives. The removal process has successfully cleared these remnants from the x86/x86_64 architecture, though some architectural ports like ARM64 may still have lingering traces due to existing mappings. Notably, this development highlights a growing trend in kernel maintenance through the use of AI; Torvalds mentioned using Claude Code as an advanced tool for source-to-source transformations, similar to how one might use Coccinelle scripts for static analysis. This patch marks a major step in cleaning up 'historical horrors' within the kernel codebase by enforcing the use of safer, scoped user access region helpers.

The Lazarus Group has introduced a highly sophisticated attack chain, identified as Operation FlashHole, which distinguishes itself through the implementation of post-quantum cryptographic (PQC) mechanisms. According to research from Kaspersky, the threat actors are utilizing the ML-KME-1024 algorithm—a NIST-approved standard designed to resist future quantum computing attacks—to secure communications between infected hosts and command-and-control (C2) infrastructure. The attack begins with phishing pages that redirect users to specially crafted GitHub repositories, initiating an in-memory execution chain. This chain exploits the INISAFE CrossWeb EX security tool and the legitimate Windows 'fsquirt.exe' utility to execute shellcode.

The malware ecosystem involved in this campaign is multi-layered. LPEClient serves as a primary component that receives public keys from the C2 server, generates shared keys, and facilitates the decryption of incoming payloads. ClientHub acts as a loader capable of communicating via Dropbox or direct exchange with LPEClient. The ultimate payload, Cubridge, is a modular backdoor providing attackers with capabilities for file management, reconnaissance, and screenshot capturing. To further obfuscate the process, the group employs a complex encryption hierarchy where ciphertexts are encrypted with the GOST algorithm, and shared secrets provide key material for the Threefish algorithm.

By utilizing in-memory execution and advanced cryptographic standards, the Lazarus Group aims to minimize detection risks and ensure that even if traffic is intercepted, it remains undecipherable by current means. The campaign has already impacted several sectors in South Korea, including software, construction, and manufacturing. This evolution in tactics suggests a strategic move toward 'harvest now, decrypt later' resilience, ensuring their command infrastructure remains robust against advancing decryption technologies.

Carbon-X is a newly released 14.8B parameter language model from the Carbon family, specifically engineered for biological sequence analysis. Unlike traditional models that use separate encoders, Carbon-X utilizes a single decoder architecture with a hybrid tokenizer. This tokenizer integrates standard BPE vocabulary for natural language with a specialized system that encodes DNA as non-overlapping 6-mers, allowing the model to process raw DNA directly within a chat interface. The model's capabilities include predicting whether mutations are benign or pathogenic, identifying regulatory regions, and performing next-base prediction. In evaluations across five DNA benchmarks, Carbon-X achieved an average score of 66.7%, significantly outperforming Qwen3-14B and rivaling frontier models like GPT-6.1 Sol at a fraction of the cost. For example, analyzing 2.4 million variants in ClinVar is estimated to cost only $300 with Carbon-X, compared to potentially millions of dollars using larger proprietary models. Technically, the model features 40 layers, GQA, and SwiGLU activation, with a context window of 40,960 tokens. Because the weights can fit on a single 80 GB GPU, it provides an ideal solution for researchers needing to process sensitive or unpublished genomic data on private infrastructure. The model is optimized for efficient serving using vLLM and supports automated DNA tagging within prompts.

The U.S. government has launched an aggressive multi-billion dollar strategy to defend the nation's financial architecture against 'Q-Day,' the point at which cryptanalytically relevant quantum computers (CRQCs) can break classical public-key encryption. Under Executive Orders 14412 and 14413, the federal strategy focuses on both economic risk management and technical cybersecurity. A significant component of this effort is the $2 billion allocation from the CHIPS & Science Act, which provides venture equity in quantum computing leaders such as IBM, D-Wave, and Rigetti to bolster domestic hardware foundations for risk modeling and portfolio optimization. The Department of the Treasury, acting as the Sector Risk Management Agency, has established a Quantum-Readiness Task Force to oversee the migration of banks, payment processors, and insurance networks toward quantum-safe systems. Simultaneously, NIST is tasked with the mathematical standardization of Post-Quantum Cryptography (PQC) algorithms, while CISA leads the operational execution of these migrations across critical infrastructure, enforcing a deadline for software upgrades by late 2030. The NSA provides essential intelligence regarding 'Harvest Now, Decrypt Later' threats from state-sponsored actors, ensuring that national security systems and the defense industrial base are prepared for the quantum era.