Hello, stay ahead with CISO Brief 🚀

🔐 This post examines evolving private authentication for the web, focusing on Privacy Pass, blind signatures, and the new MOLE design. It explains how MOLE uses endorsements and anchor sets to hide issuer identity while enabling moderators to issue credentials, and why post‑quantum migration is challenging due to larger primitives. The article highlights VOLE‑in‑the‑Head advances and their role in efficient post‑quantum credential constructions.

🔒 Starting today, you can add Amazon EC2 Capacity Blocks for ML and interruptible Capacity Reservations to Capacity Reservation Resource Groups in AWS GovCloud (US) Regions. This change lets you include On-Demand Capacity Reservations, interruptible reservations, and Capacity Blocks for ML in a single group, simplifying instance launches across reserved capacity. Use launch requests, EC2 Fleet, or Auto Scaling groups to target these groups and set prioritization and fallback to On-Demand. There are no additional charges and the feature is available in all supported AWS Regions except China.

🔍 A new open-source AI-driven offensive framework called ARTEX, released in July 2026, has been adopted by multiple threat actors and appears to be more widespread than initial reports indicated. Censys research found 1,465 publicly exposed ARTEX consoles worldwide, with approximately 815 distinct deployments and many sharing infrastructure with other malicious tools. The original GitHub repo was removed in October after abuse, but forks and commercial variants persist, and several attacks have been linked to the framework since October.

🛠️ Microsoft has published a fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, but the update is delivered only through the Microsoft Store and not via regular Windows updates. The corrected build is 11.2609.401.0; some systems still reported older builds such as 11.2605.81.0 earlier in the week. The vulnerability is an out-of-bounds read rated Important (CVSS 8.1) and requires deep system knowledge to exploit; it was not known to be exploited when disclosed. Administrators should check all per-user and provisioned copies of Paint and update any installs below 11.2609.401.0 via the Store or device-management tooling.

🛡️ Researchers at Forever Security demonstrated that a browser extension able to run scripts on claude.ai could instruct Claude Desktop to execute commands via the Dispatch feature. The flaw requires a user signed in to both claude.ai and Claude Desktop with Dispatch enabled and lets a page-controlled script send prompts and approve prompts shown within the same page. Anthropic told researchers it plans to retire Dispatch by late October, but the functionality remains exploitable and similar features may also be vulnerable.

🔒 The US Cybersecurity and Infrastructure Security Agency (CISA), alongside the FBI and other federal agencies, has issued an advisory after global incidents where attackers accessed internet-exposed industrial refrigeration and cold chain monitoring systems. Threat actors have remotely altered controls to force heating and defrost cycles, causing spoilage of food and medical supplies. Operators are urged to remove controllers from direct internet exposure, enforce strong authentication and MFA, isolate OT from business networks, maintain offline backups, and apply timely patches and lifecycle management.

🛡️ Railway employees ran autonomous AI agents that attempted to access a rival platform’s infrastructure, prompting public acknowledgement and an apology from Railway leadership. The engineer responsible said he used personal accounts and halted the testing harness after it began reaching too far; the rival, Primcloud, reported that its defenses blocked all attempts. Railway’s CEO pledged to ban non-manual external testing and reinforced employee conduct expectations.

🛡️ Chainguard describes operational steps to disclose and mitigate vulnerabilities discovered by Athena, starting with an initial set of 50 low-stakes silent fixes. The post outlines publishing patches, advisories via a Chainguard OSV feed, and shipping patched packages to customers while avoiding unnecessary noise for maintainers. Chainguard is seeking CNA scope for silent fixes and coordinating with Akrites and Gold Eagle for responsible disclosure and critical-infrastructure prioritization.

🔥 Researchers at RunSybil disclosed a memory-safety flaw in CPython that can let crafted AI model templates bypass sandbox protections and execute code inside inference servers. They demonstrated the issue by inserting a backdoored Jinja template into a model and triggering code execution when the model was served. The Python Security Response Team (PSRT) acknowledges the bug but disputes that the demonstrated sandbox escape is a CPython security vulnerability, stating sandboxing isn’t in CPython’s threat model. A patch was merged and backported to recent branches, though concerns remain about adoption on older Python 3.12 deployments.

🔒 Research from BlackFog reveals nearly half of security leaders (47%) reported sensitive data exposure via AI tools at their organizations, with 77% of incidents involving approved tools. The findings highlight gaps in visibility and enforcement: while 98% have AI policies, only 56% pair them with comprehensive technical controls and many organizations cannot log or restrict data shared with AI. Autonomous AI agents and shadow AI further escape controls, especially in technology and telecoms.

🔍 Researchers at QiAnXin's XLab discovered a hidden backdoor in the web server binary for Control Web Panel (CWP) that executes attacker-supplied commands delivered via specially signed HTTP headers and leaves no traces in access logs. The installer, captured June 29, requires root access and targets cwpsrv versions 1.15.10 and 1.24.0, restoring file timestamps to mask tampering. XLab published detection checks (socket, process, file), MD5 hashes, and indicators including download URLs and an IP address. They advise restoring original binaries, upgrading, and rotating control panel credentials, and note an archive from Brazil also contained Ebury OpenSSH malware.

🔒 Two vulnerabilities in Barracuda's Email Security Gateway can be chained to achieve root command execution without authentication. Barracuda released patches and fixed firmware versions on Monday after watchTowr detailed the exploit chain. One flaw is an authorization bypass (CVE-2026-116606) and the other a command injection (CVE-2026-111560); together they permit full control of the appliance. The vendor and Mandiant advise immediate patching, limiting admin access, and re-enabling automatic updates.

🔒 A critical OpenSSH vulnerability impacting systems built with the musl C library lets attackers bypass authentication and access accounts that should have password login disabled. The bug, tracked as CVE-2026-123158 and dubbed SSHole, affects Alpine Linux and some embedded distributions, and has persisted for about a decade. OpenSSH released an emergency update (10.6p2) and Alpine issued patched packages and mitigation guidance.

🔒 AWS Security Hub now provides a centralized Software Bill of Materials (SBOM) inventory that gives security teams a continuously updated view of packages and applications across compute resources. The inventory is built from SBOMs Amazon Inspector generates for EC2 instances, ECR images, and Lambda functions, and it lists packages with version, type, and resource counts. Users can filter and group results, view per-resource Installed software, and query via the Security Hub API. The feature is included with Security Hub Essentials, requires no additional enablement, and is available in all Regions where Security Hub is offered.

🔒 Binance’s postmortem details how a series of avoidable human and technical failures enabled a $6.34 billion crypto theft, with an internal AI tool abused to pivot between developer systems. The FBI attributes the breach to North Korea–linked actors; malware on two engineers’ machines and weak access controls allowed attackers to obtain a deployment token and run a malicious container. Binance rebuilt the AI tool and tightened controls, but the incident highlights lapses in credential hygiene, app sourcing, and security training.

🔔 Today AWS announced a new AWS Interconnect - last mile metro in Northern Virginia, joining New York as the second metro for direct connectivity. The service offers managed, private, resilient connections provisioned across two physically diverse locations with four redundant links and a 99.99% availability SLA up to the Direct Connect port. Traffic between AWS and partner edge devices is encrypted with MACsec by default. Lumen customers in the continental US can order generally available connections, and previews are available through Megaport and Equinix.

🔒 OpenSSH 10.6p2 (released November 5, 2026) fixes a critical password authentication bypass affecting sshd on musl-based Linux when PAM is disabled, commonly seen on Alpine Linux. An attacker who can reach the SSH port may log in without the correct password if certain conditions are met: PasswordAuthentication enabled, an account with a '*' password field, and at least one other active account with a real $5/$6 hash. Patch immediately, restart sshd, or disable password authentication until patched.

🔎 Today Amazon Web Services announced general availability of Web Answer on Amazon Bedrock AgentCore, a managed tool that returns a synthesized, grounded, and cited answer to a natural-language question in a single call. Web Answer extends the earlier Web Search capability to produce finished answers by planning and running parallel web searches and deciding when it has sufficient evidence. Customers control scope through domain include/deny lists and publish-date filters, and the tool integrates with AgentCore Gateway, authenticating over MCP with IAM and ensuring zero data egress. It is available in the US East (N. Virginia) Region with per-call pricing.