One ChatGPT link could hijack accounts

Hi there, this is your daily ☕️ Cyberpresso.

ChatGPT bug let shared links steal chats LINK

• Researchers found a serious ChatGPT bug that let a malicious shared conversation run attacker-controlled code inside another signed-in user's session, reading private chats and sending stolen data to an outside server through a single crafted link.
• The attack chained ChatGPT's HTML Preview frame with the MathLive math library, which accepted messages without checking their origin, then used a YouTube endpoint to run code as the trusted ChatGPT site about 4.5 seconds after opening.
• Parameter reported the flaw on October 18, OpenAI fixed it on October 26 by rejecting the risky MathLive messages, rated it P1, and paid a $5,000 bounty; no exploitation in the wild was mentioned.

Bitcoin wallets hit by thefts LINK

• BTCPay Server urged everyone running its self-hosted payment software to take their instances offline yesterday after reports that attackers were accessing and draining hot wallets, the Bitcoin stores that keep signing keys on the server.
• The project told administrators to run the shutdown command while it investigates, but has not revealed the cause, how many servers were hit, or how much Bitcoin was stolen from affected merchants.
• The theft follows two recent problems: an emergency update (v.2.4.7) released on October 29 to patch a flaw, and an August exploit that drained Lightning Network keys from several nodes, including one run by Foundation.

New malware ranks victims by wealth LINK

• A newly found Windows data-stealer called VOLTA-AUTODOXER grabs everything from an infected PC, then asks an AI model to rank the victim's valuables by how much cash they could fetch, Cisco's Talos researchers report.
• The malware steals browser passwords, cookies, cards, email profiles, crypto wallets, and Wi-Fi passwords, then builds a dossier with home address and employer before sending it to OpenRouter using Anthropic's Claude by default, switching models if one refuses.
• Much of its token theft bypasses Chrome's App-Bound Encryption by launching Chrome without a window; blocking that process stops the Chrome theft, and victims should rotate all keys, passwords, and move funds to a fresh wallet.

Hackers exploit Ivanti VPN flaws LINK

• Hackers are actively exploiting two flaws in Ivanti Connect Secure VPN software, prompting CISA to add both bugs to its Known Exploited Vulnerabilities list on Friday after attacks were spotted in the wild.
• A threat group called UTA0576 chained the flaws, including privilege escalation bug CVE-2026-111357, with an earlier authentication bypass to gain root access, then stole credentials, Active Directory data, administrator passwords, and BitLocker recovery keys rather than planting malware.
• Ivanti has released patches in its latest supported versions, and federal agencies were ordered to fix the privilege escalation flaw by today, with the second bug, CVE-2026-118527, due by November 13, 2026.

Linux flaw lets attackers hijack clusters LINK

• A critical certificate flaw in the Linux container tools LXD and Incus lets remote attackers skip login checks and seize control of clusters and the virtual machines they manage, without needing a password or key.
• The service proves a client owns the first certificate in a TLS handshake but never checks the rest of the chain, so an attacker can attach a trusted public certificate and be accepted as its owner despite lacking the private key.
• Incus rates it a maximum score and Canonical tracks it as CVE-2026-112816; neither advisory reports exploitation, and the fix is updating to a patched release since no configuration workaround exists, only limiting listener access.

Strategies & Tactics

> How to Hunt Malicious IP-KVMs on Your Endpoints: Hunt endpoints for IP-KVM hardware that lets remote attackers pose as local users, confirming legitimacy through device identity, usage context, and onboarding patterns.

> Supabase From a Pentester's Perspective: Methodology and Where the Real Risks Hide: Test Supabase apps by checking whether database row permissions actually block one user from reading or changing another user's data across tables, storage, and functions.

> AI agent security in Kubernetes: Why prompt injection isn't the right term: Limit AI cluster agents to narrow read access and verify their actions, because poisoned logs can hijack them into leaking every secret they can reach.

> The first ten lines of a command policy for AI coding agents: Give each AI coding agent its own scoped identity and an allowlist of approved commands enforced outside the model, because agents will exploit anything you forget to forbid.

> Cloud incident response: what changes when you do not own the host: In cloud environments where servers vanish automatically, configure evidence preservation and retention beforehand because forensic data disappears before responders can react to an alert.

Other news you might like

• Critical Linux kernel TCP vulnerability can allow remote code execution (CVE-2026-98432) LINK

• Chainalysis discloses data breach from "offensive agentic techniques" LINK

• Synology warns of C3RB3R ransomware attacks targeting NAS devices LINK

• New wave of cyberattacks targets European supermarket freezers LINK

• Fake nuclear warnings in Ukraine as Moscow, Kyiv report separate cyberattacks on emergency apps LINK

• Android’s new ‘SMS of Death’ exploit can crash your phone without you doing anything LINK

• TightVNC Pre-Auth RCE Vulnerability Lets Hackers Execute Code on Windows PCs, PoC Released LINK

Trending tools

Harden: a free, local security tool that inspects AI coding agent tool calls before they run, keeping your repo and output on your machine LINK

VibeDefend: embeds security and business rules into AI coding agents like Cursor and Copilot, catching vulnerabilities and malicious packages before code reaches your PR. LINK

Axari: an AI security teammate that completes recurring tasks and goals directly in Slack or Teams, reducing time spent managing security workflows. LINK

Plango: monitors AI coding agents on your Mac, protecting secrets and sensitive files, blocking suspicious network activity, and scanning projects for vulnerabilities locally. LINK

chat-recall: unifies AI assistant histories from Claude Code, Codex, Cursor, and OpenCode into one searchable log, redacting secrets and flagging leaked keys locally. LINK

Koreshield: screens customer messages, retrieved documents, and tool calls before your AI agent acts, catching data leaks, hidden instructions, and unsafe actions while logging every decision. LINK

Trending papers & reports

Vulnerability-detection agents get a self-improving wrapper that automatically rewrites the scaffolding around the model, helping it tell genuine security fixes from harmless code tweaks and transfer those gains to models it never trained on. LINK

RAG poisoning defenses get a sharper scorecard showing that popular success-rate metrics hide the fact that some defenses actually introduce new wrong answers while blocking attacks, flipping which defenses look best. LINK

Telecom network security adds a guardrail that checks AI control decisions against the original approved instruction, cutting attack success rates from ~92% to ~29% as carriers hand network management to language models. LINK

AI agent memory can be taught to update stale facts while rejecting malicious planted instructions, a simple tuning recipe that more than doubled reliability by checking the agent used correct, attack-free evidence. LINK

Network intrusion detection pairs a neural model with human-readable rules so that with just 50 labeled examples per attack it catches far more threats and cuts false alarms roughly tenfold, while showing analysts why it flagged each alert. LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!