Threat Library

A newly identified data-extortion group called Helix is targeting organizations' SharePoint environments using identity-focused attack techniques, including voice phishing (vishing), device code phishing, and MFA abuse. The group's approach bypasses traditional malware-based detection by exploiting human trust and authentication weaknesses to gain access and exfiltrate sensitive data for extortion purposes.

Attackers compromised the GitHub repository of Injective Labs' SDK project and published a malicious version of the package to npm. The trojanized package harvested cryptocurrency wallet private keys and mnemonic seed phrases from developers and downstream applications that installed it.

A contributor to the OpenMandriva Linux distribution reportedly attempted to sabotage the project following an internal dispute among maintainers. The distribution's team detected and responded to the incident, though specifics on the exact method and scope of the sabotage attempt remain limited in the initial reporting.

Schneider Electric's Easergy MiCOM Px40 Series protection relays contain hard-coded credentials (CWE-798) exposed via the SNMP protocol, allowing an unauthenticated remote attacker to access basic device identification information. The vulnerability affects a wide range of firmware versions across nearly all Px40 relay models used in medium, high, and extra high voltage protection applications worldwide.

OpenPLC v3's legacy web UI program-upload workflow allows an authenticated user to write arbitrary files anywhere on the filesystem due to unsanitized handling of the prog_file parameter. This flaw can be escalated to full native code execution as the OpenPLC runtime user by planting a malicious C++ source file that gets auto-compiled during normal program build operations, posing a severe risk to industrial control environments in Critical Manufacturing, Energy, Transportation, and Water/Wastewater sectors.

Schneider Electric PowerChute Serial Shutdown versions 1.4 and earlier contain seven distinct vulnerabilities spanning path traversal, CRLF injection, weak authentication throttling, uncontrolled resource consumption, and sensitive information logging. Successful exploitation could allow attackers to overwrite critical files, forge log data, exhaust system resources, or expose sensitive information, though no public exploitation has been reported. Schneider Electric has released version 1.5 to remediate all identified issues.

Hermes WebUI versions before 0.51.788 expose an embedded terminal API that lacks authentication, allowing remote attackers to open a PTY session and execute arbitrary shell commands with only four HTTP requests. Given the CVSS score of 9.8 and the trivial exploitation path, this vulnerability poses a severe risk to any internet-facing or internally exposed Hermes deployment.

A critical authentication bypass in Hermes WebUI (versions before 0.51.307) allows unauthenticated attackers to spoof local-origin IP restrictions using a forged X-Forwarded-For header, gaining access to onboarding endpoints intended only for local administrators. This enables server-side request forgery against internal infrastructure, hijacking of LLM provider configurations and API keys, and abuse of OAuth device-code flows to mint persistent access tokens. Given the CVSS score of 9.1, this vulnerability poses severe risk to any deployment exposing Hermes WebUI to untrusted networks.

A path equivalence vulnerability has been identified in Progress MOVEit Transfer's File Upload modules, affecting versions before 2025.0.8 and 2025.1.0 before 2025.1.4. The flaw carries a low CVSS score of 3.5, indicating limited exploitability or impact compared to prior MOVEit vulnerabilities, but it warrants patching given the product's history as a target for mass exploitation.

CVE-2026-60002 is a use-after-free vulnerability in OpenSSH clients prior to version 10.4, triggered when a malicious or compromised server changes its host key during a key re-exchange. Exploitation could lead to client-side memory corruption, potentially enabling denial of service or code execution on systems initiating SSH connections.

CVE-2026-13020 is a weak password recovery mechanism vulnerability in Esri Portal for ArcGIS (versions 12.1 and earlier) that allows a remote, unauthenticated attacker to hijack a user's account by manipulating the forgotten-password flow. Organizations running ArcGIS Enterprise on Windows, Linux, or Kubernetes are at risk of unauthorized account access without prior credentials.

This is a routine tech news article by Simon Willison describing OpenAI's new GPT-5.6 model family (Luna, Terra, Sol), pricing, benchmark comparisons against Claude, and new API features like programmatic tool calling and multi-agent support. It contains no evidence of a security vulnerability, exploit, or attack against AI agents or agent infrastructure.

The self-hosted HTTP transport of the DeepSeek MCP Server exposes the /mcp endpoint without any authentication, allowing any network-reachable client to initialize a session, enumerate tools, and invoke server-side functionality. This includes the deepseek_chat tool, which can consume the operator's own DEEPSEEK_API_KEY, leading to unauthorized API usage and potential cost/data exposure. The issue is patched in version 1.8.0.

The DeepSeek MCP Server fails to bind session IDs to authenticated users or transport sessions, allowing any caller to enumerate active sessions and hijack another user's conversation context. This lets an attacker read and continue a victim's private chat history, exposing sensitive data and enabling impersonation within the session. The flaw is patched in version 1.7.0.

Langroid versions before 0.65.2 contain a critical flaw where LLM-generated tool messages evaluated via Python's eval() with a supposedly empty 'locals' dict can still access all built-in functions, since '__builtins__' is implicitly injected into globals. This allows any attacker capable of influencing LLM output (e.g., via prompt injection) to achieve full unauthenticated remote code execution on the host running the agent.

Langroid's file read/write tools fail to properly restrict operations to a configured working directory, allowing an LLM agent or user-controlled tool call to escape that directory using path traversal sequences. This lets an attacker read arbitrary files (e.g., secrets, credentials) or write files anywhere the process has permissions, despite the framework appearing to sandbox file access to a project workspace. The issue is patched in version 0.64.0.

Langroid's SQLChatAgent uses an incomplete regex denylist to block dangerous SQL functions before executing LLM-generated queries against a live database. Because the denylist omits PostgreSQL file-reading functions (pg_read_file, pg_stat_file, etc.) and certain SQL Server/SQLite file-attach primitives, an attacker who can influence the generated SQL—directly or via prompt injection in ingested data—can craft ordinary SELECT statements that read arbitrary files from the database host, bypassing the agent's strict default safety configuration entirely.

Langroid's Neo4jChatAgent forwards LLM-generated Cypher queries directly to the Neo4j driver without validation, statement allowlisting, or an opt-out mechanism. An attacker who can influence the prompt—either directly or via indirect content ingested through RAG—can manipulate the LLM into generating destructive or data-exfiltrating Cypher queries, and potentially achieve OS command execution if APOC or dbms.security procedures are enabled on the server. This mirrors a previously patched SQLChatAgent vulnerability (CVE-2026-25879) whose fix was never extended to the Neo4j module.

This is a routine blog post from Simon Willison announcing Meta's Muse Spark 1.1 model API release, including an evaluation report and a new CLI plugin for accessing the model. There is no security vulnerability, attack, or agent threat described in this content; it is purely informational product coverage.

Researchers demonstrate that LLM agents frequently hallucinate plausible-sounding resource names (repos, skills, packages) when performing tasks like cloning or installation, and these hallucinations are predictable and transferable across models. Attackers can preemptively register these hallucinated resource names to host malicious payloads, causing agents that autonomously fetch and execute them to become compromised at scale, effectively forming a botnet without needing any direct prompt injection channel.