I go through about 25 cybersecurity news portals and blogs every week and pull out the most interesting stories. Then I turn them into this short, digestible summary, so you can stay up to date without trying to follow 25 different sources yourself. 😱
My aim is to create a summary that gives you the gist without needing to open up the source article. But if you do want to dig deeper, all the sources covering the event are linked below each story.
If you enjoy these, come back next Monday
scroll to the bottom to subscribe to the e-mail newsletter.
Malicious AGENTS.md dropped into ~/Downloads can steer AI coding agents into installing rogue packages or leaking tokens
Researchers observed a malicious AGENTS.md instruction file in a customer’s ~/Downloads folder that an AI coding agent automatically followed, leading it to attempt installation of a rogue npm package. They reproduced the technique against OpenAI Codex and showed a related instruction-file attack against Claude Code that could expose OAuth tokens by redirecting API traffic.
Key Details
- Attack chain hinges on intended behavior: browsers commonly save downloads to ~/Downloads, and agents load instruction files from their working directory (so a downloaded markdown file can become “orders” when the agent is launched there).
- Observed payload attempted to install the npm package “function-color” (aka “function-color”), which the researchers describe as malicious and tied to a broader npm malware campaign.
- Codex PoC success rate was ~90% when tested with a harmless payload (opening Calculator) to validate feasibility of instruction-driven tool execution.
- Claude Code technique used a planted CLAUDE.md to set an alternate API base URL, which in testing exposed OAuth tokens and enabled the attacker-controlled server to return tool calls (code execution in ~50% of tests, per the report).
- Researchers demonstrated a web page can download an AGENTS.md to ~/Downloads “silently” (BleepingComputer verified a public PoC page that triggers an AGENTS.md download with attacker-supplied content).
Next Steps
- Don’t run AI coding agents with ~/Downloads as the working directory; start them in the specific project root they’re meant to operate on (per OpenAI/Anthropic guidance cited in the coverage).
- Hunt for unexpected instruction files (e.g., AGENTS.md, CLAUDE.md) in ~/Downloads and other commonly used working directories before launching agents there.
Read more at hubs.li, BleepingComputer, Talkback.sh, Cybersecurity Reddit
Browsers and Go block eMudhra intermediates after flawed P-384 key generation made CA private keys trivially recoverable
Certificate authorities (CAs) are the trusted third parties whose digital signatures make browsers, operating systems and apps accept a website’s or software publisher’s identity as genuine. That trust depends on the CA keeping its private signing keys secret. Researchers found that eight eMudhra intermediate CAs had private keys generated so weakly that they could be recovered almost instantly. Anyone could then have issued forged certificates for any website, or signed code, that would be trusted wherever eMudhra’s chain was trusted. Chrome, Mozilla, Apple and Microsoft all blocked the intermediates within days. Mozilla and Google are also removing the issuing emSign ECC Root CA – G3 root, and Go shipped patches that reject these chains. No exploitation has been reported. The remaining risk sits with unpatched systems and with software that bundles its own trust store and doesn’t check revocation, such as language runtimes and Linux CA packages.
Key Details
- Six affected intermediates were TLS-capable and trusted across major root programs; two additional impacted intermediates were code-signing CAs trusted by Microsoft (Bug 2083449).
- eMudhra revoked the eight intermediates with reason code cACompromise on Oct 18, 2026 (UTC) after acknowledging the issue and investigating (Bug 2083449).
Next Steps
- Confirm patching beyond the browser. Browsers and operating systems update automatically, but other software often doesn’t. Ask IT to check Go-based services, Linux servers , containers, and appliances or apps that bundle their own certificate lists.
- Track certificates and CAs as assets. You should be able to quickly answer which CAs you depend on.
Read more at bugzilla.mozilla.org, Mozilla Security Blog, Google Groups, The Record, CSO Online, Bleeping Computer, The Hacker News, Security Week
Rank Math PRO plugin supply-chain compromise backdoored WordPress sites via trojanized v3.0.123 download window
Rank Math said a limited number of Rank Math PRO downloads were trojanized with malware in v3.0.123 (Oct 15 20:02 UTC–Oct 16 07:12 UTC) that could compromise sites when activated. The malware was designed for persistence (recreating backdoors on visits) and could expose secrets available to the web server, including credentials and API keys.
Key Details
- Rank Math states the compromise impacted Rank Math PRO only; the free WordPress.org plugin was not affected.
- The vendor says the malware communicates with rank1cdn[.]com and can recreate a hidden backdoor when someone visits an infected site, complicating cleanup.
- Rank Math’s advisory lists specific persistence/cleanup artifacts, including malicious wp_options entries named _uf6qdn2hmm, t8krdk990phb, or np5pvf754c, and suspicious admin accounts using the wpsupport prefix and @wp-mail[.]net emails.
- Rank Math recommends treating activated installs as compromised and notes that simply deactivating/updating is insufficient; it advises restoring from a clean pre-incident backup or, if not possible, deleting the entire plugin folder before hunting for additional backdoors and changes.
- A clean release, Rank Math PRO v3.0.124, was issued after the affected files were removed from distribution.
Next Steps
- Make sure Wordpress / Joomla / Drupal and other CMS plugins are in your vendor list and have proper monitoring processes to detect supply chain attacks.
- If you installed/updated Rank Math PRO during the affected window, verify whether v3.0.123 was activated; if it was, restore site + DB from a pre-Oct 15 20:02 UTC backup and then install v3.0.124.
- For sites that cannot restore, follow the vendor’s order-of-operations: delete the entire rank-math-pro plugin folder and remove the listed wp_options entries before searching for additional backdoors/rogue admin users and other changes.
- Add an egress control where feasible to block outbound connections to rank1cdn[.]com and rotate secrets the site could access (WP/admin passwords, DB creds, keys/salts, API keys).
Read more at Rank Math, Bleeping Computer, The Hacker News, Security Week, hubs.li
Chrome adds Gemini-backed scam detection and ClickFix clipboard warnings, and now prompts before insecure HTTP connections
Google is rolling out new Chrome protections that use server-side Gemini analysis (via Safe Browsing Enhanced Protection) to detect scam pages and show new “suspicious site” warnings in addition to the existing full-page red interstitials. Chrome also warns when users copy potentially malicious ClickFix commands (where victims are tricked into pasting commands into a terminal), and it now asks users for confirmation before connecting to sites over unencrypted HTTP by default.
Key Details
- ClickFix protection works by analyzing copied commands: Chrome scrubs PII from the clipboard payload, sends it to Safe Browsing for analysis, and warns if the verdict is dangerous.
- Chrome’s Safe Browsing warnings now have two levels: high-confidence “dangerous site” full-page red warnings, plus a lower-confidence “suspicious site” warning intended to expand coverage for deceptive patterns.
- Gemini scam detection moved from on-device to a more capable server-side model for all Enhanced Protection users, expanding beyond tech-support scams to include additional scam types (e.g., fake antivirus and fake browser update pages).
- Page text is only sent for analysis when strong scam indicators are present, and Google says any transmitted page content is processed ephemerally and is not logged, stored, or used to train models.
- HTTP connection prompts are now enabled by default for everyone: users are prompted on first visit to an HTTP site; after approval, Chrome won’t warn again unless the site hasn’t been visited for at least two weeks, and some hosts (e.g., single-label hostnames/local IPs) are excluded by default.
Next Steps
- Evaluate the risk of Gemini AI reviewing contents of visited pages, including internal document management systems with confidential data.
- For managed environments, verify whether Safe Browsing “Enhanced Protection” is enabled and allowed in your Chrome policies where appropriate, since Gemini scam detection and ClickFix warnings are tied to that mode.
- Update internal user guidance/runbooks to explicitly call out ClickFix-style lures (web pages instructing users to copy/paste terminal commands) and instruct users to stop and report when a browser shows a clipboard/command warning.
Read more at Bleeping Computer, Security Week, The Hacker News, hubs.li
Microsoft Teams rolling out AI-based, context-aware phishing detection for higher-risk chats
Microsoft says Teams will begin rolling out AI-powered, context-aware phishing detection that flags social engineering and impersonation even without links or attachments starting in early November 2026. The feature is designed to assess conversation context (without retaining message content for training) and is initially focused on higher-risk scenarios like external first-contact chats.
Key Details
- Microsoft says the detection uses conversation context but does not retain customer message content for AI model training or other secondary uses (and is intended only for security protection).
- Microsoft says no admin action is required to enable the new phishing protection, and for most users it will focus on external first-contact chats.
- Related Teams roadmap items include blurring QR codes sent by external senders and letting users report suspicious guest invitations directly in Teams.
Next Steps
- Update internal guidance for Teams users on handling unsolicited chats and guest invites, emphasizing that external first-contact conversations may be flagged as suspicious even without a malicious link.
- If you use guest access heavily, consider adding a process so helpdesk/SOC can quickly respond when users report suspicious guest invitations in Teams once the feature is available (Roadmap ID 571297).
Read more at Bleeping Computer, microsoft.com, microsoft.com, hubs.li
PHP2Shell (CVE-2026-109618/109619) drives pre-auth RCE scramble as AWS says exploitation attempts started Oct. 17—before patches shipped
Two critical PHP engine flaws dubbed PHP2Shell enable unauthenticated remote code execution by corrupting or reusing request memory across requests, prompting emergency releases and widespread scanning. AWS reports its honeypots saw exploitation attempts beginning four days before public disclosure and patch release, underscoring how quickly attackers move once details (or fixes) leak.
Key Details
- Fixed PHP versions: 8.5.12, 8.4.27, 8.3.36, and 8.2.35 (per CISA/PHP advisories).
- Affected deployments include all SAPIs serving web requests, including Apache mod_php (called out by PHP as highest risk), PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed (CISA).
- CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while request data is only partially initialized, and shutdown/cleanup can treat invalid state as valid (RCE).
- CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned global state can survive after the request heap is freed, and a later request handled by the same worker can consume that stale state (use-after-free → RCE).
Next Steps
- **Review your playbooks to have a “play” for cases where you can’t mitigate immediately **and need to take the impacted system offline temporarily.
- Upgrade immediately to PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (CISA/PHP guidance); take systems offline if you can’t update promptly.
- If you need a short-term stopgap while patching, disable session upload progress (session.upload_progress.enabled=0) and restart workers, and consider temporarily blocking multipart file uploads where feasible (per PHP/AWS mitigations; not a complete fix).
- Hunt for multipart POSTs containing the string PHP_SESSION_UPLOAD_PROGRESS and cross-check AWS-published IPs from Oct. 17 onward in web/WAF logs (AWS guidance).
Read more at Cybersecurity and Infrastructure Security Agency CISA, Calif, WIRED, The Record, VulnCheck, SecurityWeek, The Hacker News, GitHub, GitHub, SiliconANGLE, BleepingComputer, WIRED, SecurityWeek, The Hacker News, Amazon Web Services, reddit.com, reddit.com, UK National Cyber Security Centre, BleepingComputer, WIRED
The US Army wants AI agents that hack its enemies with almost no human oversight
Documents reviewed by The Intercept say the U.S. Army’s Cyber Command is developing “ECHOTRIBBLE,” a platform to use AI agents for offensive cyber missions that can autonomously move through networks and disable targets. The concept describes agents that operate with minimal human oversight, self-direct their behavior, and stealthily “neutralize” systems before self-destructing—a design experts warn could be hard to constrain and prone to unintended effects.
Key Details
- ECHOTRIBBLE is “primarily focused” on offensive missions, according to a Q&A document for prospective contractors.
- ARCYBER documents describe “neutralizing” as actions including disabling a threat (temporarily or permanently) or deleting it from the target.
- The program is described as functioning “almost like a computer worm,” hopping device-to-device and targeting both cloud systems and “air-gapped” systems, per the contractor Q&A.
- A vendor briefing example says that once placed on a laptop, the agent identifies additional targets on the network and generates tailored replicas for other device/OS types (e.g., iPad, Apple desktop, Windows 11 PC).
- Materials describe agents built for stealth, including minimal reporting back and concealing necessary external communications, followed by an attempt to self-destruct after completing objectives.
Read more at The Intercept, Cybersecurity Reddit
Linux kernel maintainers drop the “Assisted-by” tag as Torvalds backs AI use by competent contributors
Linux kernel maintainers have decided to deprecate the “Assisted-by” tag, so contributors no longer need to disclose AI assistance in patches, while Linus Torvalds argues the focus should be on contributor competence and review quality rather than whether AI was used. Torvalds says the project’s real challenge is AI increasing maintainer workload via more bug findings and low-effort AI-generated “drive-by” patches, not AI itself.
Key Details
- Torvalds drew a distinction between useful AI help from people who understand the code and submissions from “clueless people using AI” who don’t engage with the kernel community beyond one-off patches.
- Torvalds said kernel development now faces two separate AI-driven pressures: AI surfacing real bugs in a huge codebase (creating more triage/review work) and AI being used to generate patches without understanding the subsystem or implications.
- Long-time maintainer Greg Kroah-Hartman previously reported a shift from “AI slop” security reports to “real reports”, with AI-assisted reports increasingly useful but also contributing to higher volume for maintainers to process.
Read more at Talkback.sh
WhatsApp help pages exposed hidden chatbot instructions to avoid mentioning regulators and privacy laws in some user flows
Hidden text embedded in WhatsApp Help Center pages instructed “WhatsApp Support with AI” how to answer users, including directions to not recommend contacting privacy/data protection regulators in an account-deletion scenario. Separate hidden instructions told the chatbot to avoid referencing privacy regulations like GDPR/CCPA once a user mentioned legal action, and WhatsApp said the exposure was due to a bug that has since been fixed.
Key Details
- Redact reviewed 545 WhatsApp help pages and found 102 hidden instruction blocks across 80 pages that were delivered in page code but not shown in the visible article text.
- The account-deletion help page’s hidden instructions specifically told the chatbot to focus on automatic deletion timelines and “Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority” when users couldn’t delete an account due to lost device/number access.
- On a “reporting and blocking” help page, hidden guidance triggered when users mentioned lawyers/lawsuits and instructed the chatbot to not reference, cite, or interpret privacy regulations (including GDPR, LGPD, CCPA), even if the user raised them.
- WhatsApp told WIRED the text was guidance for “WhatsApp Support with AI” and said it was unintentionally exposed due to a bug; the hidden blocks were removed from the live pages after media inquiries.
- Redact said it did not test whether WhatsApp’s chatbot (or third-party assistants) actually followed the embedded instructions; it documented the instructions as they appeared in archived page source.
Read more at Redact, Talkback.sh, The Hacker News, Wired Security
Abandoned Popcorn Time app exposed millions of devices to RCE attacks
Researchers found that the Time4Popcorn (Popcorn Time fork) updater could be hijacked because it pulled unsigned executables over unencrypted HTTP from abandoned update domains and executed them with elevated privileges on Windows and macOS. Eye Security temporarily took over parts of the update infrastructure and used the same mechanism to disable the vulnerable updater on affected machines, then transferred controlled domains to Shadowserver to reduce the chance of botnet-style abuse.
Key Details
- The issue is tracked as CVE-2026-30612 and affects the Windows and macOS updater components (Updater.exe / PT.updd), enabling remote code execution if an attacker controls (or intercepts traffic to) the update channel.
- After registering the lapsed update domain, Eye Security observed activity at scale and later estimated ~2.5–3.0M Windows hosts and ~250–350k macOS hosts attempting to check for updates.
- Eye delivered a remediation update that stopped/disabled the updater service/daemon (no telemetry collection and no file deletion), but did not remediate Android because installation requires user interaction.
- Eye reported over 2 million remediation update downloads and a 98% reduction in update requests by March 1, 2026, before ending the campaign.
- Domains used as indicators of compromise include popcorntimeupd[.]xyz and related update domains such as besttime4popcorn[.]info, time4popcorn[.]info, and updatepopcorntime[.]xyz (full list in Eye’s write-up).
Read more at The Hacker News, Talkback.sh, Bleeping Computer, hubs.li
Subscribe
Subscribe to receive this weekly cybersecurity news summary to your inbox every Monday.