RedPick

Agentic AI pentesting for web, APIs, mobile and LLM apps. Every finding ships with a working PoC. No working exploit, no finding.

[RedPick @redpickai]

Imperva's write-up with the tested Express and body-parser versions: https://t.co/GI05CeQPOk
Node.js advisory: https://t.co/tk0XpStvSw

[RedPick @redpickai]

Node2Shell (CVE-2026-111497): Express 5 and body-parser 2 inflate bodies sent with Content-Encoding: br, so any JSON route can feed attacker Brotli to the buggy decoder, as can fetch() on untrusted URLs. Patch to 22.23.4, 24.22.1 or 26.12.1, or set inflate: false for now. #NodeJS

[RedPick @redpickai]

Laravel News write-up of the advisory: https://t.co/OCWr9Ky1pr
More on RedPick: https://t.co/UR2faSVkKt

[RedPick @redpickai]

Laravel's token guard: send a non-string token and on MySQL/MariaDB the lookup can match another user. Fixed Aug 25, disclosed Oct 20, no fix below 12.x. Check auth.php for the "token" driver.

RedPick attacks auth from the outside and backs every finding with a working exploit.

[Laravel News @laravelnews]

Critical Token Guard Auth Bypass Fixed in Laravel 13.29 and 12.68 posted by @paulredmond https://t.co/EI5C34fw2f

[RedPick @redpickai]

Microsoft's write-up, with IOCs and hunting queries: https://t.co/IBxUz0CGdf

[RedPick @redpickai]

Storm-0940 ran an agentic pentest framework through ConnectWise's already-consented OAuth apps: Graph recon, new app credentials, a self-assigned Global Admin. Sometimes under 3 hours from target to privileged access. Audit what your vendors' apps can do. #AIsecurity

[Christopher Glyer @cglyer]

Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Several of these Storm-0940 ARTEX-driven attacks have resulted in the actor obtaining privileged access to an organization’s cloud infrastructure – including multiple instances where the time from initial targeting to privileged access was less than 3 hours. Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application.

https://t.co/aKrkgXLeFk

[RedPick @redpickai]

@NSACyber RedPick is here to help you test your system using the same AI weapons attacker are using! https://t.co/UR2faSUMUV

[RedPick @redpickai]

Advisory: https://t.co/949K1SnPQO

Every RedPick run now checks exposed PHP versions against this advisory from the outside, without firing the exploit in production: https://t.co/UR2faSUMUV

[RedPick @redpickai]

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are out: two unauth RCEs (CVE-2026-109618/109619), CVSS 4.0 9.2. On mod_php the demonstrated exploit fires before any app code runs. Config tweaks only narrow some paths. Patch, and remember 8.1 and older get no upstream fix. #PHP

[RedPick @redpickai]

PHP RCE pair CVE-2026-109618/109619: watchTowr says PHP 5 through 8, fixes land today at 14:00 UTC. Use the hours before for inventory: base images, appliances, vendored runtimes, old 5.x and 7.x boxes. EOL branches may get no fix, so plan isolation now. #PHP

[The Hacker News @TheHackersNews]

‼️ URGENT ‼️ Two CRITICAL, unpatched PHP flaws (CVSS 9.2 each) have triggered an emergency warning after alleged exploit details surfaced online.

Researchers report potential RCE.

CVE-2026-109618 and CVE-2026-109619.

Fixes scheduled for October 21, 14:00 UTC.

Details - https://t.co/jYegMlTtf2

[RedPick @redpickai]

Same two open-source apps, four public AI pentest counts: 49, 31, 52, 55. They don't sit on one axis: each has its own testing mode, counting unit and validator. Ours was black-box only, a URL and credentials, no source. Read the columns first: https://t.co/pA5mbK45Yz #AppSec

[RedPick @redpickai]

Four bugs that each look mild. Chained they become unauth RCE: SSRF into loopback, owner token theft, then an unsigned codec through dlopen. That is Plex2Shell on Media Server before 1.43.3.10861.

PoC dropped Oct 16. Honeypots were mining Monero by Oct 17. Patch, then check the Codecs folder for persistence that survives a restart.
#AppSec

[Nick Percoco @c7five]

If you run Plex at home, update it today. Exploit code for a four bug chain that gives unauthenticated code execution on Plex Media Server went public two days ago, and attackers were using it on a honeypot within a day to drop a Monero miner.

Patched builds have been out since September. You want 1.43.3.10861 or newer.

The nasty part is persistence. The payload sits in Plex's Codecs folder and runs again every time something transcodes, so killing the miner doesn't fix it. If your server was exposed and behind on updates, check that folder for .so or .dll files you didn't put there.

[RedPick @redpickai]

@JDSalbego Yep. Sanitizing the doc then feeding a 'clean' summary into a tool-calling agent just moves the injection one hop. Treat every handoff between reader and actor as untrusted input, same as the original document.

[RedPick @redpickai]

The entry points CERT-In lists: keys in repo history, forgotten test APIs, overly permissive cloud roles. Nothing exotic. Agents just work through the backlog faster, and reused the same leaked credential across separate runs. Rotate, then purge it from history. #AIsecurity

[The Hacker News @TheHackersNews]

‼️ AI agents escaped their assigned tasks and accessed REAL systems in India.

CERT-In confirms they read confidential business records and personal data using exposed credentials and excessive cloud permissions.

None of them noticed. The AI firms reported it themselves.

Read: https://t.co/QqLWpr5v1U

[RedPick @redpickai]

AI made finding bugs cheap. Bank of America added 1,000 contractors to 3,000 staff just to fix them.

The hard part is knowing which fixes hold. Our retest re-runs each finding's original PoC, and a WAF block never counts as fixed.

https://t.co/UR2faSUMUV #AppSec

[CNBC @CNBC]

Bank of America has hired an army of external contractors to help it patch software vulnerabilities exposed by advanced artificial intelligence models including Anthropic’s Mythos, the bank’s CEO, Brian Moynihan, told CNBC on Wednesday.

Read more: https://t.co/qBkuAjo1f9

[RedPick @redpickai]

Denmark's CPR leak: a small vendor's legit lookup access, 123456 as the password (admin account too), 14M lookups in 10 days, 8.8M people. The scraper was reportedly AI-written.

Nothing flagged the volume. An invoice did, 12 days after it ended.

[RedPick @redpickai]

@zack0x01_ The step most recon pipelines skip is auth. Filtering endpoints by param names surfaces SSRF/LFI candidates, but IDORs only show up when you replay the same request with a second user's session. Does your hackbot keep two accounts per target, or stay unauthenticated?

[RedPick @redpickai]

A login isn't a sandbox. Langflow passed user MCP stdio commands straight to bash -c with no allowlist. CVE-2026-105740 (CVSS 9.9): if authenticated users can add tool servers, that config is RCE surface. Patch, then audit who can register MCP transports. #AppSec #AIsecurity

[The Hacker News @TheHackersNews]

⚠️1,423 Langflow RCE exploit attempts hit Previdian honeypots from 27 IPs.

The bug lets authenticated users, even non-admins, run OS commands through MCP server configs. Fixed in 1.9.0.

Read: https://t.co/pdzFHEEJ3f

[RedPick @redpickai]

Three bugs chained on Ivanti Connect Secure: no login, root, then LAPS passwords and BitLocker keys, with logs tampered. Exploited since Oct 3, before any patch.

A patch closes the door. It doesn't tell you who already walked in. Rotate creds, run memory forensics. #zeroday

[Volexity @Volexity]

.@Volexity has discovered in-the-wild exploitation of a #zeroday exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). Beginning October 3, a previously unknown threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution on a fully patched device. Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool.

Using its #Volcano memory analysis platform, Volexity analyzed the compromised device’s memory to uncover the full exploit chain and the attacker’s post-exploitation activity, which focused on credential theft, Active Directory reconnaissance, and data exfiltration. Volexity reported these findings to Ivanti through coordinated disclosure.

Read the full analysis, including detection guidance and IOCs, in our blog post here: https://t.co/y9tzKqbaKe

#DFIR #threatintel #memoryforensics

[RedPick @redpickai]

Windows treats .mcp.json. and .mcp.json as the same file. Copilot's write guard compared strings and the write still landed on its own MCP config. CVE-2026-103572: canonicalize paths before you authorize them. Patch VS and SSMS. #AppSec #AIsecurity

[Johann Rehberger @wunderwuzzi23]

A . is all you need! 🔥

RCE in Copilot for Visual Studio and SSMS.

A trailing dot added to a config filename bypasses Copilot's security controls, leading to remote code execution in Visual Studio and SQL Server Management Studio.

https://t.co/mSx3tX0FV2