ctxsec

• Update: run claude --version; you want 2.1.321 or later (2.1.322 shipped Nov 10). Auto-update users get it automatically.
• Why the OAuth fix matters: a remote MCP server, or anything able to redirect its OAuth endpoint, could have received a refresh token meant for another host, and refresh tokens usually outlive sessions. See the tip for what to revoke.
• Separately: the Edit-tool TOCTOU sandbox escape CVE-2026-88968 (GHSA-5xjx-9qx6-jcrv, CVSS 4.0 7.7, macOS) circulating today was fixed in 2.1.251 in August; its CVE record was published Nov 3.

• Template left half-finished: each instance names its own domain but still contains the placeholder [naming_here] for the platform name, which suggests a kit not fully configured.
• Tells the agent to use persuasion triggers, authority framing, urgency and social proof, and calls any mention of alternatives a 'critical protocol violation'.
• Example domain: bitgrokesai[.]com; the full list of 26 is in Unit 42's IOC file.
• For agent builders: strip or flag hidden text (display:none, zero-size, off-screen) before page content reaches the model, and never let fetched page text change an agent's role or recommendations.

• What Profero describes (high level): layer 1 is the agent sandbox container; layer 2 is the account's dedicated VM running Docker and a supervisor; layer 3 is the shared EC2 host. Profero says it could not cross into other customers' VMs. The reported path stays inside one account: sandbox → unauthenticated Docker API on the VM → privileged container with the VM disk attached → credentials copied from container config → remote use of the exec service (static auth token local) and the control plane's long-lived renewal credential.
• Blast radius (per Profero): every agent on the account shares one Linux user, one filesystem and one credential set, so one bad instruction in any agent exposes imported browser sessions (saved in plaintext JSON; Chrome remote debugging also open with no auth), the gateway token that drives connected mail/files/calendar connectors, and every object in the account's persistent S3-backed store — including the ability to plant files that sync into future sandboxes. Persistence is claimed to survive vendor token rotation because a listener on the VM's plaintext proxy-to-sandbox link can collect each new per-account token.
• Entry point: Profero treats "one command from the agent" as the premise that fails — via prompt injection on a web page the agent reads, a malicious repository, a poisoned package, or a hostile tool. No malware dropper is required once that command runs.
• "Rootkit" framing: Profero is not claiming a kernel rootkit was shipped on purpose. It argues the exposed, unauthenticated control plane plus static secrets and plaintext management traffic behave like one: remote shell, secret theft and persistence with no login record. Eight issues were scored (several Critical on CVSS 3.1 in their table); none have public CVEs in the report.
• Disclosure (Profero's timeline): testing Aug 22–23 on accounts they paid for; full report to xAI and Cursor security teams Aug 24; Cursor automated bug-bounty reply Aug 25; follow-ups to xAI Aug 27–28, Sep 8, Sep 18 (30-day notice), Oct 1 and Nov 8; re-tests through Sep–Oct on new builds with findings unchanged; publication in November, more than 75 days after first report. Profero says more than 240 sandbox builds shipped in that window without closing the chain.
• Vendor status as of this write-up: we found no public statement from xAI, Cursor or Grok Bot acknowledging the report or claiming a fix. Patch status beyond Profero's own re-tests is unverified here; do not read this item as an independent confirmation that the issues remain live today.
• Why it matters beyond one product: the failure modes Profero lists — secrets baked into images, local management APIs reachable without auth, boot scripts that grant root, management traffic forwarded in plaintext, and one shared identity for every agent — are design risks for any hosted agent sandbox, not only this one.

• Exposed: ESG appliances whose Admin UI is reachable by the attacker. CVE-2026-116606 (CVSS 4.0 9.3, ESG only) lets an unauthenticated request run admin-only handlers after a deliberately failed password change; CVE-2026-111560 (8.6) is a root command injection through the restored system_timezone setting and also affects Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway.
• Fix: Barracuda patches BNSF-40425 (ESG 9.4.017 and later) and BNSF-40430 (older ESG), plus BNADC-16586, BNMA-32468, BNWF-60060 and BNYF-24789 for the other products. watchTowr tested 9.4.0.029 as fixed; the Mandiant-assigned CVE record and the Cyber Centre list ESG before 9.4.0.030 as affected, so go to the latest firmware rather than stopping at .029.
• If auto-patching was off or the box is several firmware versions behind, Barracuda says you may need more than one update; check the version the device actually reports.
• Barracuda hasn't said who is exploiting it or how it found the activity. Treat any ESG with an internet-facing Admin UI that was unpatched after Nov 5 as possibly compromised (see the hunt item).

• Why it matters: an RMM server can push scripts and remote sessions to every managed endpoint at every client. Huntress says the published chains include three paths to remote code execution and one to root; reported bug classes include anonymous credential theft, admin creation, XXE, XSS-to-OGNL and a stack overflow.
• What N-able says to do: keep hosted and on-prem N-central offline until it confirms they can be restored. Ecoverse services under N-able Login (n-able.app) stay up for asset view, patching, scripting and Take Control.
• Hotfix: N-able first targeted midday ET Nov 10. As of its latest updates on Tuesday afternoon (Rapid7 and The Hacker News relayed a 12:42 PM ET update saying validation was still under way), the release was in final validation and not yet generally available; N-able says a new status post will announce GA with upgrade guidance. Don't reconnect servers until that post exists and the server reports the fixed build. This is the fourth batch of serious N-central flaws this year, after CVE-2026-18556 in August and the exploited CVE-2026-86218 in September.
• See the playbook for an RMM-outage checklist.

Update Nov 10, HF2 released: build 2026.4.1.26 strengthens authentication and permission checks, removes legacy mobile device management, adds validation to file upload and log handling, and hardens Agent-to-Probe communication. Upgrade order matters: a Probe on 2026.4.1.26 can't talk to older Agents or PME, so upgrade Agents first, then Probes (PME is pushed automatically). Built-in remote control is temporarily disabled in this build; Take Control still works. HF2 supersedes 2026.4 and HF1 (2026.4.0.32). Patching doesn't clean a server that was exposed between Nov 8 and the upgrade, so still review logins, new admin accounts, scripts and remote sessions from Nov 8 on.

• This is Initia's second halt in under three weeks, after the Oct 23 MoveVM mint exploit (about $2.7M).
• The lesson for bridge and rollup operators: escrow on the hub trusts whatever the rollup's keys sign, so those keys need the same HSM, quorum and monitoring treatment as the escrow itself.
• Initia warns users to ignore unofficial links and "refund" messages.

• Web/proxy logs in front of the Admin UI: POSTs to /cgi-mod/index.cgi from addresses outside your admin ranges, especially multipart bodies containing new_password, retype_password, pu_bayesian_upload or bayesian, and responses carrying "Error: Password Change".
• Appliance audit log: failed_password_change entries for admin that nobody made, followed by a configuration restore you didn't run.
• Configuration: a system_timezone value that isn't a plain zone name (look for ', ;, # or backticks), and unexpected changes to admin accounts, relays, forwarding or allowed hosts, since a restore rewrites the global config.
• Response: if you find hits, Barracuda Support should be your first call. Given the 2023 ESG zero-day history, don't assume a firmware update removes an implant; collect evidence before re-imaging.

• Listener paths ESET observed: /owa/sdds/, /AUTODISCOVER/PROXYSERVICE/, /MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/ on 443. Check HTTP.sys URL reservations and IIS/HTTPERR logs for these prefixes; bad requests get redirected to an Exchange-like error page.
• DLL hijack spots: CerealLoader dropped as ncobjapi.dll or wbemcomn.dll in C:\Windows\System32\wbem\, loaded by WMI. Compare against known-good hashes.
• Native image cache: malicious files named like Microsoft.Exchange.Search.Mdb.ni.dll planted in the .NET native image cache; one sample activates only under Exchange's search service. Look for NI images whose hashes don't match ngen output on a clean server.
• Collection: CerealBox stages messages with .doc/.docx/.pdf attachments that match hardcoded sender, recipient, subject or filename lists into encrypted files on disk; commands also pulled mailboxes via EWS, queried AD, ran WMI and read LSA secrets.
• ESET says IoCs are in its white paper and GitHub repository.

• Process lineage: explorer.exe (Run dialog) or a browser spawning cmd.exe, powershell.exe or Windows Terminal; encoded commands and execution-policy bypasses.
• Files: ZIPs such as cf_verify.zip or verify_pkg.zip in %TEMP%, extracted into random hex-named folders under C:\ProgramData (e.g. f8f33b09aed97a47, 7168f7f870a45fbb) with a signed Microsoft binary, a rogue DLL and 1.bat; C:\ProgramData\ShService holding an SSH private key.
• Persistence: Run keys and scheduled tasks like CertEnrollCtrl_*, SysyService or a Run key named DuskDesk launching node.exe.
• Cache-seeded variant: cmd /c for /r loops over browser profile cache folders filtering on file size, then copying to %TEMP%\t.bat.
• Network: unexpected outbound SSH from workstations; Huntress lists 23.227.199[.]41 and 167.148.201[.]104:3861 among its IOCs.
• Huntress advises hunting the sequence of behavior rather than hashes, since names and payloads change.

• Who did the review: the Department of the Prime Minister and Cabinet with the National Cyber Security Coordinator, Office of AI, Australian Signals Directorate, Australian AI Safety Institute and Services Australia.
• What's still missing: legislation text and timing; the government says details will follow after consultation.
• Why it matters for defenders: it's one of the first national responses that treats an autonomous agent's unauthorized access as a reportable cyber incident in its own right.

• What it does and doesn't cover: the proofs assume the cryptographic primitives are secure and trust contracts for some low-level routines; no new Signal vulnerabilities were reported.
• Why it matters: if agents can make formal verification cheap, it becomes a defensive counterweight to AI-driven bug hunting. The Lean development is published for others to reuse.

• Audit weights like code: diff every checkpoint against its declared base model before deployment and after updates. Fine-tunes and quantizations change weights broadly; implanted neurons change a few vectors a lot, so flag statistical outliers and reject models without a verifiable base.
• Treat third-party fine-tunes, merges, quantizations and adapters as untrusted until audited; pull checkpoints only from the original publisher and verify hashes; serve from a private registry rather than public hubs at runtime.
• Contain the blast radius: least-privilege agent identities, sandboxed code execution, egress allowlists, and human approval for high-impact tool calls, so a triggered model can't do much.

• List public IPs of ESG, WAF, ADC, Message Archiver and Web Security Gateway boxes, then test the admin ports from outside (a cloud VM or your external scanner), not from the office.
• Restrict the Admin UI to a management network or VPN with an allowlist; Barracuda recommends trusted internal networks only.
• Turn automatic patching back on if it was off, then confirm the device reports the patched firmware.
• Repeat the same check for other edge appliances; most of this year's edge exploitation started at an exposed management page.

• Start with servers that reach source code, cloud consoles, mail or tickets (GitHub, Google, Microsoft, Atlassian, Slack connectors).
• Revoke in the provider's authorized-apps page, not just with claude mcp logout, which only clears the local copy.
• Check the provider's audit log for token use from unfamiliar IPs since you first connected.
• Remove remote MCP servers you don't run or no longer use.

• On Windows, a GPO can remove the Run dialog for standard users, and WDAC or AppLocker rules can deny execution from %LOCALAPPDATA%\Temp and %PROGRAMDATA% subfolders that aren't on an allowlist.
• Pair the controls with an easy report path so users who did paste something tell IT fast.

• Use policy Insights to see which workflow runs would be blocked.
• Either keep the default block, switch the workflow to pull_request, or allow pull_request_target for specific workflow files in an Actions event policy.
• Applies to public repos on GitHub Free, Team and Enterprise Cloud.

• Security relevance: shared-kernel containers have been the weak boundary for multi-tenant and agent code-execution platforms; this gives a VM boundary without a dedicated instance per workload.
• Caveat from AWS's docs: the isolation is a security boundary, not a performance reservation, and supported instance types are limited.

• Exposed fields (per AG): names, DOBs, home addresses, SSNs, hospital account numbers, diagnoses, insurance info, and clinical transcription content including meds and lab/diagnostic results.
• Lesson: MFA on remote access and alerting on the detections you already collect would have shortened a two-month dwell.