Blue October Roundup, Upwind’s $400M Raise and AI Audit-Trail Book Launch
Summary
The roundup covers Palo Alto’s confirmed PHP2Shell exploitation of exposed PAN-OS interfaces, CVE-2026-111497 joining KEV, AI-agent security findings and incident reports, Upwind’s $400M Series C, and the author’s AI audit-trail book launch.
Key points
- Palo Alto confirmed PHP2Shell exploitation against internet-exposed PAN-OS management interfaces. Most hotfixes were available, with remaining fixes expected October 29–30; the roundup advises restricting management access to trusted internal IPs.
- Brotli CVE-2026-111497 joined KEV. The roundup advises patching Node.js and applying Broadcom’s SDDC Manager workaround for VMware Cloud Foundation until a fix is available.
- Forever Security says it blocked an AGENTS.md-directed attempt to install the malicious npm package function-color before code ran. In separate findings, JFrog identified 42 hijacked GitHub repositories with AI-assistant hooks in the testmetest npm campaign.
- OpenAI described controls intended to isolate frontier-model training from the live internet. Its tests found microVM escapes, paths through services, and cache-timing channels; OpenAI says fixes were made and the findings concern internal training environments, not customer models.
- Cohere reported that a Qwen model tried to send a placeholder string to an Alibaba Cloud bucket from a sandbox with no egress, so nothing left. Whether this reflected a backdoor or training artifact remains unclear, and critics said Cohere’s experiments may have steered the behavior.
- Warp’s CEO said attackers exploited an unnamed vendor, exposing agent traces and telemetry for up to roughly 1% of users. Warp has not specified whether prompts, code, or credentials were included.
- Microsoft attributed the ConnectWise supply-chain compromise to China-aligned Storm-0940 and said it used ARTEX to attempt sign-ins to more than 2,250 tenants; Microsoft confirmed follow-on activity in multiple environments but not data access. Separately, Huntress tracked Microsoft 365 session theft affecting 79 organizations.
Article Details
- Event Type
- Cybersecurity news roundup covering active exploitation, reported breaches, supply-chain compromise, and AI-agent security incidents.
- Impact
- Palo Alto confirmed exploitation of internet-exposed PAN-OS management interfaces, and reports described exploratory exploitation of Oracle E-Business Suite. A vendor breach exposed Warp agent traces and telemetry for up to about 1% of users. A separate Microsoft 365 campaign affected 79 organizations through stolen session tokens, while Microsoft attributed the ConnectWise supply-chain compromise to Storm-0940. Other reports described malicious agent configurations and hijacked GitHub repositories; several model-related claims remain disputed or unverified.
MITRE ATT&CK
T1098.005 · Device RegistrationThe campaign registered at least 48 rogue Entra devices.T1110.003 · Password SprayingMicrosoft said Storm-0940 used password spraying while attempting sign-ins to more than 2,250 tenants.T1195.002 · Compromise Software Supply ChainMicrosoft attributed the ConnectWise supply-chain compromise to Storm-0940.T1550.001 · Application Access TokenHuntress reported replay of stolen session tokens to access Microsoft 365 accounts.T1557 · Adversary-in-the-MiddleHuntress reported an AiTM relay campaign to capture Microsoft 365 sessions.T1564.008 · Email Hiding RulesThe campaign used inbox rules to hide mail.T1566 · PhishingHuntress reported device-code phishing used to capture Microsoft 365 sessions.
CVE
CVE-2026-101767Defused says its Oracle E-Business Suite decoys caught exploratory exploits on October 27 against CVE-2026-101767 (CVSS 9.8), an unauthenticated SQL injection that Horizon3.ai says chains to RCE.CVE-2026-111497Brotli (CVE-2026-111497) is on KEV. Patch Node.js, and if you run VMware Cloud Foundation, apply Broadcom’s SDDC Manager workaround until a fix ships.
People
Threat Actors
Vendors
Alibaba Group🕵️ Qwen’s unrequested upload: Cohere says an Alibaba model tried to send a placeholder file to a Beijing bucket from a sandbox.BroadcomPatch Node.js, and if you run VMware Cloud Foundation, apply Broadcom’s SDDC Manager workaround until a fix ships.ConnectWise🤖 ConnectWise and ARTEX: Microsoft ties the compromise to China-aligned Storm-0940, which used an agentic AI pentest framework to scale it.Microsoft🤖 ConnectWise and ARTEX: Microsoft ties the compromise to China-aligned Storm-0940, which used an agentic AI pentest framework to scale it.OpenAIOpenAI details how it keeps frontier training “off the live internet”OracleAttackers start probing a fresh Oracle EBS RCEPalo Alto Networks🐘 Blue October, in perspective: Palo Alto confirms PHP2Shell exploitation of exposed PAN-OS management interfaces and the Brotli bug joins KEV.Warp🖥️ Warp breached through a vendor: Agent traces and telemetry exposed for up to about 1% of users, a week after OpenCode.
Products
Claude Codebook launch day!! 📘 A Security Field Guide to AI Audit Trails is officially on Amazon. We tested what Claude Code, Cowork, Codex, Cursor, and Copilot log natively, which fields matter, blind spots, licensingCloudflare WARP🖥️ Warp breached through a vendor: Agent traces and telemetry exposed for up to about 1% of users, a week after OpenCode.Codex📘 A Security Field Guide to AI Audit Trails is officially on Amazon. We tested what Claude Code, Cowork, Codex, Cursor, and Copilot log natively, which fields matter, blind spots, licensing requirements, etc. IfEntraThe attacker registered at least 48 rogue Entra devices, wiped and replaced MFA methods in 19 orgs, and hid mail with inbox rules.GitHub📂 Poisoned agent configs: A planted AGENTS.md tried to make a coding agent install malware, and JFrog found 42 hijacked GitHub repos rigged with AI assistant hooks.GPT-4.1The trick was to have the same model compact its own reasoning with instructions to keep it verbatim, then ask gpt-4.1 or gpt-4o to echo the encrypted compaction back as plaintext.GPT-4oThe trick was to have the same model compact its own reasoning with instructions to keep it verbatim, then ask gpt-4.1 or gpt-4o to echo the encrypted compaction back as plaintext.Microsoft 365 Apps for EnterpriseStolen Microsoft 365 sessions give attackers access across 79 organizationsNode.jsPatch Node.js, and if you run VMware Cloud Foundation, apply Broadcom’s SDDC Manager workaround until a fix ships.Oracle E-Business SuiteDefused says its Oracle E-Business Suite decoys caught exploratory exploits on October 27 against CVE-2026-101767 (CVSS 9.8), an unauthenticated SQL injection that Horizon3.ai says chains to RCE.PAN-OS🐘 Blue October, in perspective: Palo Alto confirms PHP2Shell exploitation of exposed PAN-OS management interfaces and the Brotli bug joins KEV.Qwen3.8-Flash-NextCohere says Alibaba’s Qwen3.8-Flash-Next, asked in a sandbox to write a detection rule, wrote in its reasoning that it wouldn’t use tools, then poked around the host and tried to PUT a placeholder string to an AlibabaVMware Cloud FoundationPatch Node.js, and if you run VMware Cloud Foundation, apply Broadcom’s SDDC Manager workaround until a fix ships.