VulnHub

Last Sunday, an attacker exploited a remote code execution vulnerability in SGLang, an open-source inference engine, to gain unauthorized access to a NEAR AI inference server. This breach allowed the attacker to execute code and potentially view sensitive requests being processed on the server, including those made in a confidential mode designed to enhance privacy through a trusted execution environment. As a result, data from 18 agents and around 100 users was compromised. This incident raises serious concerns about the security of open-source software and the potential risks involved in handling sensitive data. Companies using SGLang or similar technologies need to assess their security measures to prevent future breaches.

A serious security issue has emerged involving Claude Code, an AI coding tool that unintentionally saves files containing sensitive information, such as credentials, to public Git repositories. This oversight poses a significant risk for organizations using the tool, as it could expose their confidential data to anyone accessing these repositories. The incident raises concerns about the security practices surrounding AI tools in software development. Companies using Claude Code need to review their security measures and ensure that sensitive information is not being inadvertently published. This situation serves as a reminder of the vulnerabilities that can arise from integrating AI into coding workflows.

Researchers at Check Point have identified three espionage campaigns linked by shared infrastructure and malware known as Sparrow. These campaigns have primarily targeted telecommunications companies, government bodies, military organizations, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year. The clusters, named SilentDelivery, have been using similar malware code, indicating a coordinated effort from a group with ties to China. The implications of these attacks are serious, as they not only threaten sensitive data and national security but also highlight the ongoing risk to critical sectors worldwide. Organizations in these sectors should remain vigilant and enhance their security measures to protect against potential breaches.

Cybersecurity researchers have reported an attack exploiting two vulnerabilities in AhsayCBS, a backup software solution. This attack, observed by Huntress in early October 2026, utilized CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute unauthorized commands on compromised systems. The attackers deployed a Python-based backdoor capable of evading sandbox detection, which raises significant concerns for organizations using AhsayCBS. The vulnerabilities have been patched, but the incident serves as a reminder for companies to regularly update their software and monitor for any signs of compromise. Users of AhsayCBS should ensure they have installed the latest updates to protect against these exploits.

The cybercriminal group known as Blind Eagle has launched a new campaign targeting organizations across Latin America. They are using phishing tactics that mimic court-related notifications, such as court summons and fiscal notices, to trick users into downloading a remote access trojan (RAT). This RAT is linked to known malware variants like AsyncRAT and DCRat. The phishing messages are crafted in Portuguese and Spanish, making them particularly effective against local targets. As organizations fall victim to these tactics, sensitive data could be compromised, highlighting the need for enhanced cybersecurity measures in the region.

On October 11, 2023, a cyberattack targeted refrigeration controllers at approximately 700 retail locations across France, leading the French government to attribute the attack to a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC). The assailants modified the defrost settings on these controllers to high temperatures, resulting in significant food spoilage and causing fires at least 15 times. This incident raises serious concerns over the security of critical infrastructure, as it demonstrates how cyberattacks can disrupt everyday operations and pose risks to public safety. The French government is now investigating the full extent of the damage and the motivations behind the attack, which may have broader implications for international relations and cybersecurity strategies. Retailers affected by this incident are likely to face financial losses and increased scrutiny regarding their cybersecurity measures.

Google has released a security update to address nine vulnerabilities in Chrome, one of which is being actively exploited in the wild. This high-severity flaw, identified as CVE-2026-125350, is a use-after-free bug related to the XML component of the browser. Use-after-free vulnerabilities can allow attackers to execute arbitrary code, posing a significant risk to users. All Chrome users are advised to update their browsers promptly to protect against potential exploitation. Keeping software up to date is essential to maintain security and safeguard personal information.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged four serious vulnerabilities that are currently being exploited in the wild. These flaws affect GPUStack, SignalWire FreeSWITCH, OpenBSD OpenSSH, and IBM Aspera Faspex. One of the most critical vulnerabilities, identified as CVE-2026-123218, has a CVSS score of 9.8, indicating a severe risk due to incorrect authorization. Organizations using these products should be particularly vigilant, as attackers are actively exploiting these weaknesses. It's crucial for users to address these vulnerabilities promptly to avoid potential breaches and data loss.