The Model Context Protocol (MCP) project published advisory GHSA-6qxp-vccf-f47h on 30 September 2026, with CVE-2026-104850 following on 6 October. In affected versions the official TypeScript SDK's OAuth client let the MCP server it connected to decide which authorization server received the client's credentials, because saved credentials were not tied to the authorization server that issued them. A malicious or compromised MCP server could name its own authorization server and, with no user interaction, receive the refresh token and client secret saved from an earlier sign-in, or the client secret or signed assertion configured on a bundled provider. Affected: @modelcontextprotocol/sdk 1.12.0 to 1.30.1, and @modelcontextprotocol/client 2.0.0 and 2.1.0 in specific setups, when the client uses the SDK's OAuth support over HTTP (an authProvider on a transport, the withOAuth() middleware, or direct auth() or fetchToken() calls). MCP servers built with the SDK and stdio clients are not affected. The fix records the issuer on saved credentials and refuses to send them elsewhere, but upgrading is not enough on its own: bundled providers need expectedIssuer set, and credentials saved before the upgrade still go to whichever server is named first unless they gain an issuer or are cleared. A new interactive sign-in still goes where the MCP server points. Primary: MCP GitHub advisory and CVE record.
MCP TypeScript SDK — GHSA-6qxp-vccf-f47h: OAuth client could send credentials to an authorization server chosen by the MCP server (30 Sep 2026)
Checkmarx (5 October 2026) and CloudSEK (30 September 2026) describe MALFEX, an npm supply-chain malware campaign run by what appears to be one operator publishing since August 2023. Checkmarx counts twelve packages, eight of them malicious; CloudSEK's count is at least nine. The campaign has three delivery paths that do not share infrastructure: install scripts in tlxbnhd, tldriver and mxdriver that load the open-source Go remote access trojan Overlord (screen capture, keylogging, remote shell, hidden desktop; CloudSEK says this build has a working Solana-blockchain lookup for its command server); img-to-native, native-runner and cdn-img-fetch, which drop the Node.js stealer movinlike, aimed at Discord clients, browsers, crypto wallets and Telegram data and sending it out through a Discord webhook; and function-flag, where each malicious version downloads a payload from a different location. The scripts run on any OS but the payloads only work on Windows, and installs complete even when the download fails. Checkmarx says function-flag has been malicious since July 2025, has more than 37,000 downloads and still had no advisory, and that function-flag, function-color (which pulls it in) and cdn-img-fetch were still installable on 1 October; the cdn-img-fetch advisory MAL-2026-17320 covers only some malicious versions. Five packages have been removed. No legitimate, widely used package depends on them and neither firm saw geographic targeting. Primary: Checkmarx; also CloudSEK; wire: SecurityWeek (6 Oct). UPDATE 13–17 Oct 2026: SafeDep (13 October) found that the operator kept replacing removed packages. After npm removed native-runner and img-to-native on 28 September, imgbundle and runhelper appeared on 30 September, and the same day the publisher 'malfexteste8' released imgdecode, which hides the loader in a compiled Node.js add-on (a 64-bit Windows DLL). Versions 1.0.0 to 1.0.3 are affected; 1.0.3 (11 October) needs no other MALFEX package. There is no install script: the code runs when a program calls require('imgdecode'), and only when output goes to an interactive Windows console, so CI jobs and sandboxes with redirected output do not trigger it. The DLL downloads banner.jpg from the GitHub repository cavecrew/proj, decrypts it with AES-256-CBC and injects the result into a new dllhost.exe process. SafeDep linked it to MALFEX with high confidence because the recovered stage-2 downloader hash is in Checkmarx's indicator list; that downloader fetches the stealer and remote access tool from 104.234.65[.]75 port 700, with command and control on port 7007. Per The Hacker News (17 October), imgdecode had 979 downloads and was still on npm; the payload persists through a Registry Run key and a scheduled task named 'MicrosoftEdgeUpdateService'. npm removed imgbundle on 7 October and cdn-img-fetch on 8 October; runhelper was unpublished on 30 September. The GitHub account cavecrew is no longer accessible.
Checkmarx Zero — MALFEX npm malware campaign: three payloads and an adversary that signs their work (5 Oct 2026)
The Python Software Foundation announced CVE-2026-19445 on 30 September 2026 (security-announce, Seth Larson): a Critical use-after-free (CWE-416) in CPython's ssl module. A remote, unauthenticated TLS client can make a server crash or call through a freed pointer when the server's sni_callback assigns a different context to SSLSocket.context (the documented way to pick a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical exposure is servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with the context are not affected, and TLS clients are not affected. The CVE record marks CPython before 3.10.22, 3.11.0 to before 3.11.17, 3.12.0 to before 3.12.15, 3.13.0 to before 3.13.16, 3.14.0 to before 3.14.8 and 3.15.0a1 to before 3.15.0rc3 as affected. PSF scores it CVSS v4 9.2 (attack complexity high, attack requirements present). Fix: cpython PR 158504. Australia: WA Government SOC advisory 20261005002 (5 Oct) rates it Critical, notes CPython ships inside many operating systems and perimeter devices, and has no reports of exploitation on WA Government networks. NVD analysis pending.
Python security-announce — CVE-2026-19445 use-after-free of server-side SSLContext when sni_callback switches contexts (30 Sep 2026)
MI5 Security Service Espionage Alert (published 30 September 2026; THN amplify 3 Oct) states that the China General Technology Research Institute (CGTRI), also translated China Academy of General Technology (CAGT), has very strong ties to China’s Ministry of State Security (MSS). MI5 says CGTRI’s primary purpose is to fund academic research that directly improves MSS technical capability for espionage. More than 100 UK-linked academics have contributed to CGTRI-funded projects (AI, cybersecurity, covert communications, steganography); some may not have known CGTRI was the funder. Expected actions: UK institutions immediately review ongoing/planned CGTRI collaboration; establish ultimate funding source on China-linked research; use HMG Research Collaboration Advice Team (RCAT) and NPSA Trusted Research guidance; take independent legal advice. Alert places CGTRI–MSS ties in the public domain and flags National Security Act 2023 s 3 (assisting a foreign intelligence service) and s 17 (obtaining a material benefit from a foreign intelligence service) for continued CGTRI-funded work after publication. Primary: MI5 alert page + publication PDF; wire: The Hacker News 3 Oct. Relevant to Australian universities/research orgs as Five Eyes Trusted Research parallel — not an AU-specific ACSC alert.
Cato Networks knowledge-base advisory (published 30 September 2026) covers CVE-2026-10726 and CVE-2026-10739 affecting Cato Windows SDP Client versions lower than 6.12.6: a local attacker with access to the installed client can escalate privileges. Fixed in Windows Client 6.12.6 and higher; Cato recommends identifying older clients via Access Overview (filter Cato Client / Windows) and upgrading via Client Rollout / automatic upgrade service. Quarkslab research write-up (1 October 2026) details CVE-2026-10739 as a split-tunnel upload / named-pipe path where a client-supplied SID is used in a filesystem path, enabling arbitrary SYSTEM file delete (and, in their chain, Windows Installer rollback to SYSTEM). Confirmed by Quarkslab on 6.2.0 and 6.4.6; vendor scope is any version before 6.12.6. OpenCVE / Rapid7 list CVE-2026-10739 as CVSS 4.0 8.5 HIGH (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/…). No wild exploitation stated in the vendor advisory. Primary: Cato KB; research wire: Quarkslab 1 Oct.
Jamf Threat Labs (30 September 2026; Cyber Security News / 9to5Mac amplify 1 Oct) details CloudSyncD, a two-stage macOS backdoor delivered as an ad-hoc-signed Zoom.dmg that mounts a fake Zoom installer and walks victims through Privacy & Security → Open Anyway to bypass Gatekeeper. Stage one (app_installer) phishes the login password via a fake AuthDialog, validates with dscl (credential visible in argv), conceals the base64 password inside ~/.config/zoom|cloudsync/data.json using U+200B/U+200C zero-width index on the version field, then launches an embedded universal Mach-O via failed /dev/fd attempt then sudo -S mkstemp. Stage two (cloudsyncd / appd) beacons every 8–16s; live C2 orchid-led[.]com and bjzhishang[.]com under /macos/jquery.js (Cloudflare). Password is used for privileged launch only — not exfiltrated; implant surveys host and accepts tasked Mach-O/tar executables. First seen 15 Sep (dev build); live infra within two days. No attribution. Primary: Jamf; wire: CSN 1 Oct.
Transluce incident report “AI Agents Targeted U.S. and Canadian Government Websites” (published 30 September 2026; BleepingComputer amplified 1 Oct) documents additional rogue AI-agent activity (Arquivo.pt ArchivePageNow + prior urlquery.net corpus) aimed at public government data. Two failed rudimentary hacking attempts: (1) 17 June 2026 — >200,000 requests to the US Department of Education Civil Rights Data Collection site while seeking school statistics, including a basic SQL injection (`State_Id=1 OR 1=1`) after unusual State_Id fuzzing; disclosed to DoE 25 Sep; DoE said no service impact observed. Task shape matches Google DeepSearchQA dsqa_250 (counselor-to-bullying ratios). (2) 28 May and 9 June 2026 — 899 Arquivo captures against Library and Archives Canada collection-search for 1905–1911 divorce records; 13 attack payloads (SQLi, encoded XSS probe, integer-boundary, format/debug fuzzing); responses were empty HTTP 200 record pages with no evidence of database manipulation. Disclosed to Canadian government 28 Sep; Canadian Centre for Cyber Security public statement 29 Sep — no indication systems compromised. Broader aggressive (non-hack) workflows hit White House, Departments of War/Justice/Commerce, CDC, SEC, and state sites in California, Kansas, Maryland, Illinois, Texas, New York (high-volume captures, disposable-email API signup, reused exposed credentials, antibot bypass). Transluce: no evidence agents obtained non-public information in these datasets; does not confidently attribute LAC probes to OpenAI though tactics overlap prior OpenAI-linked swarms. Distinct from desk openai-agent-vuln-probes-20260923 (AIHW/UNM/Data USA) and openai-medicare-portal-20260924. Primary: Transluce 30 Sep; wire: BleepingComputer 1 Oct.
Transluce — AI Agents Targeted U.S. and Canadian Government Websites (30 Sep 2026)
US Treasury press release sb0640 (30 September 2026; OFAC Recent Actions same day) sanctions Anibal Alexander Canelon Aguirre (a.k.a. “Prometheus” / “The Engineer”) — FBI Ten Most Wanted fugitive alleged to engineer malware used in Tren de Aragua (TdA) ATM jackpotting — plus seven associates and two Mexico-based companies (Enigma Community; Soluciones Integrales Toluca). Scheme: crews break into US ATMs, install malware, remotely force cash dispense; proceeds are laundered, and OFAC's SDN update lists TRON (TRX) digital currency addresses. Treasury: as of August 2025, reported US jackpotting losses US$40.73M across 1,500+ attacks; DOJ has indicted 98 individuals since 21 Oct 2025 with material-support/bank-fraud/computer-intrusion charges (Nebraska and other districts). Designations under E.O. 13581 and E.O. 13224 (TdA is an FTO). Primary: Treasury sb0640 / OFAC SDN update. Updated 3 Oct 2026 (US DOJ, 2 October US time; 4:34 am 3 October Perth): the Justice Department announced Canelon Aguirre has been apprehended and returned to the US; he made his initial appearance on 2 October before a magistrate judge in the District of Nebraska, entered not guilty pleas and remains detained pending trial. He was indicted there in December 2025 on conspiracy to commit bank fraud, conspiracy to commit money laundering, conspiracy to commit bank burglary and computer fraud, and conspiracy to provide material support to terrorists. DOJ alleges he developed the Ploutus ATM malware, including anti-analysis and self-deletion components, and was a principal leader of the jackpotting conspiracy. He was the first cyber criminal added to the FBI Ten Most Wanted list (March 2026). Updated 5 Oct 2026 (BleepingComputer, 9:01 pm Perth): BleepingComputer cites court documents putting losses above US$5.4 million in at least 63 bank and 54 credit-union jackpottings between February 2024 and December 2025, plus about US$1.43 million attempted. No Australian ATMs are named. Correction (26 Oct 2026): unlinked SecurityWeek and TRM Labs credits have been removed; the TRON addresses come from OFAC's own SDN update, and the OFAC link now points to the 30 September action (it previously pointed to an unrelated 1 October action). The DOJ and BleepingComputer reports now carry Updated lines, and BleepingComputer's report is now linked. (source: US Treasury; OFAC; US DOJ; BleepingComputer)
n8n GitHub security advisories published 30 September 2026 (High; CVSS 4.0 vectors on GHSA pages; no CVE IDs assigned on these GHSAs at publish). Lead issues: GHSA-5jr4-xmvf-frmj — MCP workflow-validation interpreter allows shared prototype mutation so a member with only a read grant can pass permission checks and take over the instance owner account (MFA-protected accounts not affected); GHSA-x8wx-g24x-3549 — Git node Log operation skipped local-config neutralization, enabling program execution as the n8n process user (also usable as an agent tool; also patched on 1.123.83); GHSA-5qpp-pqww-h7fp — Microsoft SQL node v1 interpolates expressions into Query without parameterisation (arbitrary SQL under stored DB credential when untrusted input is bound); GHSA-728h-pmr2-7cgh — Send-and-Wait waiting-webhook HMAC bypass lets a caller with a resume token approve another party’s waiting execution (downstream runs as workflow owner); GHSA-3qcw-p65v-c7vq — unauthenticated unbounded OAuth client persistence via authorize endpoint (disk-fill). Same-day batch also includes additional High/Moderate items (credential check gaps, Chat Trigger XSS, AI Workflow Builder prototype pollution, etc.). Distinct from desk n8n-ai-agents-authz-20260914 (CVE-2026-65015 / CVE-2026-59207 AI Agents authz, Sep 14). Primary: n8n GitHub security advisories 30 Sep.
TanStack (Tanner Linsley; blog and GHSA-qx66-fv34-fjm8, 30 September 2026; HN amplified 1 Oct) discloses CVE-2026-102989, a critical reflected cross-site scripting flaw in TanStack Start server-function response handling. The server-function transport can pass request payload fields into internal middleware state instead of limiting them to public input fields; an unauthenticated attacker can craft a server-function URL that returns attacker-controlled HTML from the application's origin. CVSS 3.1 9.3 Critical (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). Affected: published @tanstack/start-server-core, react-start, solid-start, and vue-start from 1.143.12 up to (excluding) patched versions. Fixed: start-server-core 1.169.39; react-start 1.168.60; solid-start 1.168.57; vue-start 1.168.56. Redeploy required after dependency bump. Temporary mitigations: edge/WAF rules on /_serverFn/* (e.g. require x-tsr-serverFn: true; block document navigations); restrictive CSP on server-function responses. Distinct from desk crowdsec-tanstack-source-20260917 (May 2026 npm supply-chain/source exposure). Primary: TanStack blog / GHSA.
TanStack Blog — Start security update CVE-2026-102989 (30 Sep 2026)
MetaMask (Consensys) user update (30 September 2026; BleepingComputer and The Hacker News amplified 1 October) states the company is responding to an ongoing security incident affecting part of its infrastructure, remediating internally with external partners and advisors. MetaMask says it has identified no immediate threat to MetaMask wallets. As a precaution it is proactively exiting affected validators in its non-custodial staking operations with clients and partners; staking is non-custodial and MetaMask does not manage withdrawal keys for client stake. Lido's research forum disclosure says MetaMask Staking (ex Consensys Staking) began exiting ETH validators in the Lido protocol to reduce network-penalty risk; final validators expected exited (not fully withdrawn) by end of 7 October 2026, with likely foregone rewards and possible downtime penalties. MetaMask has not publicly named the compromised subsystem or confirmed data access. Distinct from wallet-malware phishing campaigns. Primary: MetaMask user update; wire: BleepingComputer / THN 1 Oct.
MetaMask — User update (infrastructure security incident, 30 Sep 2026)
