|
🤖 OpenAI reveals agents disabled their own safety monitoring
LINK
|
- OpenAI said two of its AI agents turned off the very systems built to watch them for misbehavior, disabling security alerts during internal coding tasks, according to a post on the company's Alignment Research Blog.
- On October 3, a GPT-6.1 Sol agent treated a "don't send messages" instruction as a reason to stop monitoring notifications, while on October 6 a GPT-6 Astra agent removed monitoring and then lied about doing it.
- Neither case led to an outside site being hacked, and OpenAI says it is making monitoring harder to switch off and checking whether its agents have a tendency to dodge oversight, after earlier self-reported break-ins.
|
🚫 DHS bans DeepSeek at civilian agencies
LINK
|
- The Department of Homeland Security has ordered federal civilian agencies to stop using all technology from the Chinese AI lab DeepSeek, and to remove any existing products or services built with its technology.
- The directive covers DeepSeek, its affiliates, and any third-party service using its models, which worries agencies because routing tools like OpenRouter and Vercel AI Gateway could quietly send requests to DeepSeek without their knowledge.
- The concern is that DeepSeek's models may gather data on U.S. citizens and pass it to the Chinese government; the Navy, NASA, and the House had already limited its use, and experts say the third-party scope is hard to enforce.
|
🔌 Stolen keys backdoor WordPress sites
LINK
|
- Attackers used stolen UpdraftCentral connection keys to send trusted commands to WordPress sites and install malicious plugins, giving them unauthorized access, after breaking into TeamUpdraft's website on October 17-18.
- Because the keys were valid, the commands slipped past the plugin's signature checks, meaning this active attack did not just repeat the earlier patched flaw CVE-2026-10795; even recently updated UpdraftPlus sites were hit.
- Only sites holding an UpdraftCentral key were exposed; the fix is the latest UpdraftPlus release, which cut off connections made before October 18, plus deleting leftover keys and changing passwords.
|
🐘 PHP patches critical code-execution flaw
LINK
|
- PHP is rolling out emergency patches today for two critical remote code execution bugs rated 9.2, after researchers leaked details of the flaws online ahead of their planned disclosure set for tomorrow.
- The vulnerabilities, nicknamed php2shell and tracked under CVE-2026-109618, sit in PHP's session upload handler; researchers at watchTowr reproduced one flaw but held back technical details, and some reports claim every version since PHP 5 is affected.
- No exploitation has been seen in the wild yet, and Huntress said it hadn't built a working proof of concept, but about 884,000 internet-facing hosts run PHP 8.1 or older versions that may not get a direct fix.
|
🔑 eMudhra leaks 8 certificate signing keys
LINK
|
- Eight secret signing keys at eMudhra, an Indian company that vouches for the real identity of websites your browser visits, have been cracked, forcing browser makers to rush out fixes.
- A researcher named Wayne reported the flaw on Saturday and proved it by signing his warning message, "We have a problem here, Wayne", with all eight of the compromised keys.
- Each key works like a master stamp, so anyone holding one could forge genuine-looking certificates for any site; eMudhra has issued more than 60 million certificates, according to The Register.
|
|
