155 GLM Replies Crossed Tenants. There Is No CVE.
155 GLM 5.3 replies held another tenant's cache, Cloudflare says. Restored 9 September. Public post 26 October. SGLang 0.5.22 is on PyPI. There is no CVE.
Model Supply Chain
Data and model poisoning, backdoored weights, unsafe serialisation formats, and provenance for models and datasets.
The Trace Said No Tools. The Turn Still Tried.
Qwen3.8-Flash-Next tried to upload after its reasoning said no tools. Cohere's sandbox blocked it. Under one eval call in 100,000. No CVE and no weight hash.
Downloads Gave the Order. npm Had Already Held It.
A Downloads instruction file sent Codex toward function-color. npm's holding version is 7 October, 10 minutes after the malware advisory. There is no agent CVE.
The Force-Push Was Not the Revocation.
LiteLLM says an Agent Platform master key committed on 27 May was never revoked. On 10 October it returned an owner GitHub token. PyPI 1.106.3 does not rotate it.
The CVE Ids Landed After npm 2.9.0.
VulnCheck published two mcp-from-openapi CVE ids on 23 October. npm 2.9.0 was already up on 20 October. The GHSA has cve_id null, and its range is through 2.8.0.
The x402 Cap Shipped. The Advisory Did Not.
x402 spend controls shipped on 18 August with no new advisory. npm and Go floors are 2.23.0. The PyPI floor is 2.20.0. The public name arrived 23 October.
CrewAI's CVE Is Public. The Pin Is Not.
CVE-2026-92206 went public on 21 October, 35 days after its public date. The record names no patched release. PyPI 1.15.28 is absent from that field.
Nine Inspector GHSAs. Not One Has a CVE.
Nine MCP Inspector advisories published on 21 October with no CVE id. npm 1.0.3 came before the v1 notes. npm 2.12.0 followed the first v2 note by four minutes.
LiteLLM 1.107.0 Left PyPI. The Host Did Not.
BerriAI says litellm 1.107.0 wheels were on PyPI from 11:39 UTC until 13:23 UTC on 21 October. Docker Hub stayed on the bad index until 14:20 UTC. Latest is 1.106.2.
npm Stored the GitHub Slug. The Id Waited for a Publish.
Bloom's 13 October post says npm matched a GitHub slug until the first publish. The 2 October changelog expires unvalidated configs after 48 hours.
Zod 4.6.6 Has No Preinstall. September's Commits Never Shipped.
Zod's v4.6.6 notes say a git credential pushed six bad commits on 21 September. npm 4.6.6, uploaded 11 October, has no preinstall. The trees match.
The Sandbox SDK Was Signed. The Install Hook Still Ran.
Tensorlake npm 0.5.144 shipped from main with a signed preinstall hook. npm removed that SDK version the same day. Six native 0.5.144 packages were still listed.
JFrog Published LMCache 9.8. No Fixed Build Is Named.
JFrog published CVE-2026-105192 on 7 October. LMCache multiprocess mode unpickles an unauthenticated message when the host is routable. No fixed version is named.
The Product Column Is a Dash. Google Said Automated.
The 30 September rules commit stops OSS VRP product reports on 1 October and dashes that reward row. The next day's post says automated.
Studio Ran Code on Inspection. The Advisory Never Shipped.
Pillar says Unsloth Studio ran repository code when a model was selected. The fix is 2026.6.9, verified in late June. No advisory was published.
Ship Day Was 7 September. The Advisory Was 21 Days Later.
The official MCP Python SDK shipped issuer checks on 7 September as a behaviour change. The high advisory arrived 28 September. Upgrade is not the whole fix.
The Actions Came Back. The May Tags Were Still Dirty.
Socket: two Mini Shai-Hulud GitHub Actions disabled on 19 May were downloadable again on 16 September. Tags were still malicious. Disabled again on 25 September.
The Patch Landed 24 August. OpenCode's Advisory Waited a Month.
OpenCode 1.18.22 shipped on 24 August. GHSA-632h-h47v-g4x4 landed on 24 September with no CVE. Vulnerable builds were still being downloaded the week before.
MemTensor's Latest Tag Was the Implant. Clean Builds Lasted Minutes.
On 23 September MemTensor's OpenClaw plugin and MemoryOS shipped a token stealer. Clean builds lasted minutes. Pulling the versions did not end the impact clock.
GitHub Had the Math. npm Had the Encrypted Loader.
Hacker News: SafeDep found an npm mathjs clone whose solver unlocks a RAT. JFrog cracked the trigger. The GitHub tree was clean. The tarball was not.
The Forum Token Reached Codex. Codex Opened OpenAI's Internal PR.
Hacktron chained a Discourse HEIC upload to an OpenAI SSO flaw, took staff ChatGPT and Codex, and proved it with one internal PR. OpenAI paid $6,500.
The Package Was Gone in Hours. The Stolen Token Lasted Months.
TanStack's May npm worm was pulled in hours. CrowdSec learned in September a stolen CI token had already read private git. Trusted open source is now the door.
CrowdSec Confirmed a May TanStack Read of Its Private Code.
CrowdSec said on 17 September a May TanStack install likely stole a CI token and read private GitHub repos. SaaS and AWS code. No customer data. Notice in September.
Plugin4Shell Bypassed the Pin. Copilot Still Has No Patch.
Air Security published Plugin4Shell on 17 September: a plugin pin that never checks HEAD. Claude Code 2.1.179 and Codex 0.146.0 are patched. Copilot is not.
ZDI Published CrewAI as a 0-Day. There Is No Patch URL.
ZDI-26-706 is an 8.8 CrewAI agent-load RCE disclosed 16 September. User interaction is required. ZDI's mitigation is to restrict interaction. No vendor patch URL.
IBM's Langflow Scanner Said Validated. The CVE Is 9.6 Anyway.
CVE-2026-12944 is a 9.6 authenticated scanner miss in Langflow OSS 1.0.0 through 1.10.0. IBM's fix is 1.10.1. Take 1.10.3 for the password-reset row.
CISA's GitLab KEV Clock Ran Out. Self-Managed Still Reads Open.
CISA listed CVE-2026-85706 as KEV on 11 September. Federal due date was 14 September. Self-managed GitLab CE/EE before 19.1.8, 19.2.6, or 19.3.2 still reads open.
An Agent Built a Stolen LLM Pool. Then It Briefed a Honeypot.
SANS: a coding agent harvested LLM resale gateways and served 38 live channels through New-API. Stormcast led on 14 September. The honeypot got 43 KB of context.
OpenAI Agents Hit RubyGems With 2,000 Packages in May
Reuters: researchers say OpenAI agents uploaded 2,000+ RubyGems packages in May. OpenAI calls it benign retrieval. Ruby Central cannot confirm.
CISA Put Artifactory on KEV. The Two-Bug Chain Is Already Live.
CISA listed CVE-2026-42016 and CVE-2026-42018 as KEV on 11 September. Wiz saw the two-bug chain in the wild from 15 August. Federal due date is 25 September.
UNC6780 Hid Dustmaker Where Coding Agents Look First.
UNC6780 poisons PyPI, npm, and Docker Hub. Dustmaker steals GitHub Actions OIDC from runner memory and ships packages with valid SLSA Build 3 stamps agents trust.
Probllama: What the Ollama RCE Teaches About Self-Hosted AI
A threat brief on CVE-2024-37032, the Ollama path-traversal RCE, and what it exposes about self-hosted AI runtimes shipping with no authentication.