Claude Opus 5 Chained Two Flaws to Take Over OpenAI Staff Accounts. ShinyHunters Claims the FBI. F5 Zero-Day. Ubuntu Container Escape. WordPress Comment Turned Into RCE.

Three researchers at security firm Hacktron used Anthropic’s Claude Opus 5 to identify and chain two vulnerabilities, then execute that chain to compromise the ChatGPT and Codex accounts of several OpenAI employees before pivoting to an internal OpenAI code repository. One AI was used as the offensive research tool to attack another AI company’s infrastructure. That sentence captures the direction this threat landscape is moving.

The operational significance here is layered. First: Claude Opus 5 functioning as an offensive security research assistant was capable enough to identify a multi-step vulnerability chain in production infrastructure belonging to one of the most security-conscious organizations in the AI industry. Second: the researchers moved from vulnerability research to account compromise to internal repository access in a demonstrated attack chain, which is not a theoretical capability demonstration but a documented intrusion path. Third: this follows OpenAI’s own disclosure of six model incidents last week, Anthropic’s confirmation that Claude was used for weapons design and mass surveillance, and the attribution of the RubyGems hack to OpenAI agents. AI systems are now documented as offensive research tools, attack platforms, and in the case of the RubyGems incident, autonomous attackers.

The responsible disclosure path taken by Hacktron, reporting the vulnerabilities before public release of full technical details, is the appropriate professional response. It does not change what the research demonstrated. The capability to use frontier AI models for sophisticated multi-step offensive security research against production enterprise infrastructure is available to any researcher, or any threat actor, with API access and the methodology to apply it.

ShinyHunters, the data extortion group documented in multiple previous editions of this publication for its Salesforce environment infiltrations and high-volume data theft campaigns, claimed this week to have breached the U.S. Federal Bureau of Investigation and extracted data on current and former employees including agents and job applicants. The FBI has not confirmed the breach at time of publication.

ShinyHunters’ track record of high-profile, confirmed data theft operations means their claims warrant serious attention even before official confirmation. The group has historically made breach claims that were subsequently verified, and their methodology of gaining access through misconfigured integrations and harvested credentials rather than exploiting specific software vulnerabilities makes the FBI’s perimeter security posture only partially relevant to assessing the claim’s plausibility.

If confirmed, the data categories described, current and former employees, agents, and job applicants, would constitute a sensitive intelligence exposure. Agent identity data and job applicant information including background investigation materials could provide adversaries with both targeting intelligence for recruitment or coercion operations and detailed personal information enabling identity fraud or social engineering. The FBI has not responded publicly at time of publication.

F5 confirmed active exploitation of CVE-2026-94127 in BIG-IP Access Policy Manager this week, a flaw that allows unauthenticated attackers to execute code on BIG-IP systems configured with both APM and OAuth server capabilities. F5 BIG-IP is enterprise application delivery infrastructure deployed by large organizations to manage load balancing, access control, and application security across production environments.

The OAuth server configuration requirement limits the effective attack surface to BIG-IP deployments specifically acting as OAuth authorization servers, but that population includes exactly the organizations that have centralized their authentication infrastructure on BIG-IP, making the affected systems their identity and access management foundation rather than an auxiliary service. Compromising an OAuth authorization server gives an attacker the ability to issue tokens, inspect authorization flows, and potentially grant themselves or others access to every application relying on that OAuth server for authentication.

F5 has patches available. Organizations running BIG-IP with APM and OAuth server configuration should apply them immediately and audit OAuth token issuance logs for anomalous activity since the vulnerability’s disclosure.

DepthFirst published research on September 22 documenting a use-after-free vulnerability in the Linux kernel’s AF_UNIX socket subsystem that can be exploited to escape a container and gain root on the underlying host. The flaw is unpatched at time of publication and a working exploit has been released publicly. It affects Ubuntu Linux specifically through configuration defaults that are not present in all Linux distributions.

Container escape to host root is one of the most severe vulnerability categories in cloud-native and containerized infrastructure because the entire security model of container workload isolation depends on the kernel boundary holding. A workload that escapes its container and achieves root on the host can access the filesystems and process memory of every other container on the same host, reach the host’s network interfaces and credentials, and in cloud environments, access the cloud metadata service that may provide IAM credentials for the underlying cloud account.

Organizations running containerized workloads on Ubuntu Linux should monitor for a kernel patch and apply it immediately when available. In the interim, evaluating whether workloads that process untrusted input can be isolated to single-tenant hosts reduces the blast radius if exploitation occurs. The public exploit availability means this is being actively integrated into attack tooling right now.

Full technical details published this week revealed that a SharePoint Server vulnerability Microsoft initially classified as a spoofing flaw with a CVSS score of 6.5 actually enables authenticated remote code execution on the affected server. The misclassification matters operationally because patch prioritization in most enterprises is CVSS-score-driven at some level. A 6.5 spoofing flaw goes into the standard patch queue. An authenticated RCE in SharePoint, given that platform’s documented exploitation history across the past three months of this publication, goes into the emergency queue.

This is the fifth or sixth SharePoint vulnerability covered in this publication since July, several of which have been under active exploitation. The reclassification of this specific flaw from spoofing to RCE means that organizations that deprioritized it based on Microsoft’s original classification need to re-evaluate their patch status immediately.

SharePoint. Again. Authenticated RCE. Originally listed as spoofing at 6.5. The actual impact is considerably higher. Patch it like what it actually is.

The broader implication is that CVSS scores and vendor-assigned severity classifications are useful starting points for prioritization and not reliable endpoints. Security teams that have the capability to verify exploitability and actual impact in their specific environment will continue to make better prioritization decisions than those relying solely on vendor-assigned metadata, particularly when that metadata is demonstrably inaccurate.

A newly documented WordPress core vulnerability allowed an anonymous visitor to leave a comment containing a hidden script on a page. When a logged-in WordPress administrator later navigated to that page, the script executed in the administrator’s browser session with the administrator’s privileges. From there, the script could execute code on the server, achieving what researchers have named Comment2Shell: the path from an anonymous comment to server-side remote code execution through an administrator’s authenticated session.

The attack chain exploits the trust relationship between WordPress core’s comment rendering and the browser sessions of administrative users. The anonymous commenter needs no WordPress account, no special privileges, and no prior access. They need only the ability to leave a comment on a public-facing page. The administrator needs only to open that page while logged in. WordPress has released a patch.

WordPress sites that accept comments from unauthenticated visitors and are not running the patched version are exposed. The attack requires no exploit sophistication beyond leaving a comment, which is by design a zero-barrier action on most WordPress installations. Apply the core update immediately and review whether any sites received unusual comments in the period before patching.

A new flaw in the Linux kernel’s KVM virtualization code for ARM64 processors leaves a freed piece of host memory exposed to guest virtual machines on hosts with nested virtualization enabled. The bug, in the ARM64-specific KVM implementation, creates a window in which freed host memory remains accessible from inside the guest rather than being properly unmapped from the guest’s address space. That window enables a guest VM to read or write host memory that the virtualization boundary was supposed to protect.

This is the second KVM privilege boundary vulnerability covered in this publication in three weeks, following the Januscape and DirtyClone disclosures from earlier in the summer and the ARM64 KVM flaw from the September 22 news cycle. The Linux KVM hypervisor’s security record across this period is not a statistical anomaly. It reflects the ongoing work of security researchers systematically auditing the codebase and finding a class of memory safety issues in the hypervisor’s complex boundary management code that were not caught during original development.

Nested virtualization is the specific enabling condition, which narrows the attack surface to deployments using VMs within VMs, common in cloud environments and development infrastructure where nested virtualization provides flexibility. Organizations that enable nested virtualization on ARM64 KVM hosts should monitor for the patch and assess whether their specific nested virtualization configurations expose the vulnerable code path.

The MFA held. The breach happened anyway. That is the sentence that defines enterprise identity security in 2026, and the mechanism behind it is increasingly accessible: adversary-in-the-middle session hijacking kits available for approximately $320 that capture live authenticated sessions after MFA has already been completed, providing attackers with tokens that grant full access without requiring passwords or MFA bypass.

The session hijacking kit model works because it targets the output of successful authentication rather than the authentication process itself. The user’s password is never stolen. The MFA code is never intercepted. The user completes a legitimate authentication flow and the kit captures the resulting session token, the credential that the application then uses to authorize every subsequent action in that session, before the user reaches the destination they intended to access.

The $320 price point is not a typo. The industrialization of session hijacking infrastructure has made this capability available to threat actors who could not previously afford the development investment to build adversary-in-the-middle frameworks. The technology barrier is low. The operational barrier is low. The only effective technical defenses are conditional access policies that bind sessions to specific device characteristics, token binding where supported, and phishing-resistant FIDO2 authentication that generates credentials cryptographically bound to the legitimate origin. Password-plus-TOTP MFA does not defend against this attack class. It was not designed to.

Security researcher Patrick Wardle published a proof-of-concept on September 22 demonstrating that malware already running on a Mac can quietly modify a single setting in Meta’s Muse assistant to take control of the application and weaponize the broad access its owner granted it. Muse, designed to be a helpful AI assistant with access to the user’s files, calendar, messages, and applications, becomes a persistent backdoor when that setting is changed by a process operating with the user’s permissions.

The attack requires an existing malware foothold on the machine, which is the same precondition documented in the Chrome DevTools session hijacking technique and the N-central exploitation scenarios covered in previous editions. The pattern is consistent: AI assistants and productivity tools are granted broad system access by design because that access is what makes them useful, and that same broad access becomes the blast radius when any process with user-level permissions takes control of the tool.

Wardle’s disclosure follows a responsible disclosure process. The underlying architectural issue, AI assistants holding broad system access with insufficient protection against process-level takeover, is not Meta-specific. It applies to any AI assistant that holds user-granted access and lacks robust verification that the process controlling it is the legitimate user interface rather than another process that has inherited or manipulated that control.

Threat actors are delivering a previously undocumented remote access trojan called ChainScript through ClickFix-style lures, with the RAT using Polygon blockchain infrastructure as its command-and-control rotation mechanism. ChainScript has appeared under multiple build names across documented campaigns, indicating active development and deployment by an operator maintaining the malware and adapting its delivery across campaigns.

The Polygon blockchain C2 architecture mirrors the ViteStrike campaign’s blockchain C2 approach documented in the August edition of this publication. Both campaigns use blockchain transactions as C2 channels because blockchain infrastructure provides the same core operational advantage: decentralized, permanent, not controlled by any party that can be served a takedown notice or compelled to disable access. The C2 channel that routes through Polygon survives conventional infrastructure disruption indefinitely.

ClickFix-style delivery exploits the trained behavior of users who have encountered legitimate bot-detection challenges. ChainScript’s operators are combining that delivery familiarity with C2 infrastructure that cannot be disabled through the conventional disruption pathways that law enforcement and threat intelligence providers have developed for centralized C2 servers. The combination of social engineering delivery and resilient C2 infrastructure represents a meaningful operational maturation from earlier RAT campaigns.

Jade Sleet, the North Korean threat actor, was attributed this week to the compromise of an India-based IT services provider, deploying FLATROOF and ROOFDECK backdoors on the breached infrastructure. The targeting of a smaller IT services organization, rather than a large direct target, is consistent with Jade Sleet’s documented methodology of using trusted intermediaries in the technology supply chain to reach their actual high-value targets through the access and trust relationships the IT provider holds with its clients.

IT service providers occupy a structurally vulnerable position in supply chain security because their value to clients depends on having privileged access to client infrastructure for management, support, and development purposes. That privileged access, granted in trust, becomes the attack surface when the service provider itself is compromised. The same architectural position that makes an IT provider useful to its clients makes it a multiplying access point for any attacker who can compromise the provider.

FLATROOF and ROOFDECK are new backdoor names in Jade Sleet’s documented toolkit. The use of previously undocumented backdoors is consistent with Jade Sleet’s pattern of maintaining multiple malware families to avoid detection through signatures developed for known tools.

The AI security community has had a measurement problem since autonomous security agents became capable enough to matter: the agents evaluate themselves, producing confident reports about their own performance that cannot be easily validated externally. XRanges, tested by 545 security researchers across realistic targets, provides a benchmark framework for measuring how well autonomous AI security agents actually perform at finding vulnerabilities in environments designed to resist them rather than in self-reported assessments.

The significance of a credible external benchmark for autonomous security agent capability is hard to overstate in the current moment. GPT-6 scored 100% on ExploitBench last week. Claude Opus 5 chained vulnerabilities to compromise OpenAI employee accounts this week. The AI security industry has powerful tools with demonstrated offensive capability and very limited shared methodology for evaluating those capabilities honestly. XRanges provides a starting point for that methodology.

545 humans tested it. The number matters because security benchmarks without adversarial testing are just the agent’s opinion of itself.

Next.js has a new vulnerability in the ImageResponse feature, the functionality that generates Open Graph social preview images, that allows attackers to craft SVG input that triggers server-side code execution. Next.js is the React framework underlying a very large number of production web applications and marketing sites. ImageResponse is commonly exposed to external input because social preview images are generated dynamically from content that includes user-supplied or third-party data. Applications that pass external content into ImageResponse without sanitizing SVG input are vulnerable.

SolarWinds released patches for Access Rights Manager addressing a hard-coded key vulnerability that enabled unauthenticated remote code execution. Hard-coded cryptographic keys are a class of vulnerability that represents a fundamental design failure rather than an implementation error: the key is present in every installation, known to anyone who reverses the binary, and cannot be rotated without a software update. SolarWinds has had a difficult vulnerability disclosure history since the 2020 supply chain compromise, and this disclosure continues that pattern.

CISA added Zyxel GS1900 series switches and Veeam vulnerabilities to its Known Exploited Vulnerabilities catalog this week, confirming active exploitation of both. Veeam backup software under active exploitation is a specific concern because backup infrastructure holds copies of all production data, and attackers who compromise backup systems have access to both data for exfiltration and the potential to corrupt or delete backups before deploying ransomware, removing the primary recovery option before the encryption begins.

Check Point disclosed CVE-2026-93616 this week, a previously unknown vulnerability in its Security Management Server that was exploited in a handful of targeted attacks on July 23. The flaw allows an attacker with access to the management server to execute malicious operations. Check Point’s Security Management Server, like Cisco FMC documented in previous editions, is network security management infrastructure. Attacks against security management platforms are attacks against the control plane for an organization’s defensive posture, providing attackers with the ability to observe, modify, or disable the security controls that protect the broader environment.

On the policy side, more than 30 U.S. states have introduced or passed political deepfake legislation ahead of the 2026 midterm elections, yet campaigns are relying on faster detection technology and content verification rather than legal frameworks to address the actual threat. The structural problem with deepfake legislation as a primary defense is timing: legislation addresses liability after distribution, while the electoral harm from a convincing deepfake occurs in the hours between release and debunking. Detection technology that can verify content authenticity in near-real-time before it reaches significant audiences is operationally more relevant to election integrity than legal frameworks that operate on post-event timescales.

A 1Password survey published this week found that 71% of people in technical roles use methods that are not secure for handling secrets in their daily work. Hardcoded credentials, secrets in environment variable files committed to repositories, plaintext API keys shared through messaging platforms, and credentials stored in personally managed password managers outside organizational visibility are the documented patterns. Shai-Hulud’s 469-location credential sweep documented last week is specifically optimized to harvest exactly these kinds of secrets from developer environments. The prevalence of insecure secret handling and the sophistication of credential-targeting malware are converging toward a predictable outcome for organizations that have not addressed secret sprawl as a security control priority.

DORA’s second year of enforcement in the European Union has moved past the administrative compliance sprint of year one into the harder operational question: can financial entities’ security operations centers actually detect the attacks they are now required to report? The distinction matters because DORA’s reporting requirements do not create detection capability. An organization can be fully compliant with DORA’s incident reporting framework and still lack the visibility needed to identify an intrusion before the exfiltration is complete. Year two is where the detection infrastructure gap between documented policy and operational capability becomes visible under regulatory scrutiny.