Security Monitor 2026-10-26

Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

Executive Summary

Today's theme is the middle box. HiddenLayer shows that a compromised LLM gateway or inference server can fingerprint the coding agent behind it, infer which approvals and sandbox settings are already in place, and inject tool calls that look like they came from the model. Across more than 4,000 sessions it measured, short tools such as file reads were almost always unambiguous from timing alone. No product bug is required; the gateway's place in the path is enough. That trust-boundary shift lands the same week LiteLLM's own supply-chain compromise made the risk real.

In parallel, Wiz is tracking Gheist: stolen GitHub tokens planting ci-sync-* workflows that base32-encode every repository secret into the Actions log, download it through GitHub's own API, and delete the run. More than 13,500 planted branches across more than 850 accounts. GitHub's public-repo approval hold stops the public runs; private repos and GitHub Enterprise Server still execute. And Google Cloud's MCP Toolbox for Databases has CVE-2026-93328, a critical path-traversal and missing-authorization bug in its cloud-storage source that lets an unauthenticated caller copy host files to any bucket and overwrite local files. Fixed since v1.5.0; the defaults still allow all buckets and paths unless you set them.

Separately, CarryoverBench measures what happens after a prompt injection plants a payload: on five frontier models, Autonomous (heartbeat) and Latent (memory) triggers re-fire with no decay over five rounds. Textual defenses cut planting more than triggering. The authors point at runtime controls: write quarantine, egress allowlists, and cross-session gates.

And this evening CISA added the two PHP2Shell CVEs (CVE-2026-109618 and CVE-2026-109619) to KEV, with a federal due date of October 29th.

Headline Developments

1. A compromised LLM gateway can fingerprint your coding agent and inject tool calls that look like the model HIGH

Source: HiddenLayer: Man-in-the-Model: Hijacking Coding Agents in Transit (October 22nd)
- HiddenLayer Research shows that whoever sits between a coding agent and the model (an LLM gateway, proxy or inference server) can identify the harness from request headers and tool catalogs. Codex sends a codex-tui marker; Claude Code sends claude-cli; open harnesses such as Hermes advertise themselves through the tool list they register.
- The same traffic carries permission state. Codex requests include approved command prefixes and sandbox flags, and the x-codex-turn-metadata header exposes whether auto_review_enabled is on. When it is, a failed command that needs more permission can be re-reviewed automatically instead of going back to the user.
- Timing fills the gaps. Across more than 4,000 captured sessions, only 4.7% of short-runtime tool calls (file reads, writes, listings) fell in HiddenLayer's ambiguous timing range, versus 25.5% of shell calls. Across more than 35,000 file reads, only 1.0% were ambiguous. A short tool that pauses for several seconds is a strong signal the agent is waiting for approval.
- With that map, the intermediary injects tool calls into a model response and can strip them (and their results) from what the user later sees. Demo 1: Hermes in manual approval mode, which only prompts for commands it classifies as dangerous. Injected file edits plus a python3 run exfiltrated secrets to a webhook, then restored the file. Hermes treats ordinary file edits and python3 as allowed without a prompt. Demo 2: Codex with an already-approved git prefix and a writable .git directory ran git -c diff.external='sh -c "cat .env"' diff --no-index /dev/null .env without another prompt, returning .env contents through the transcript.
- A quieter variant: the gateway rewrites a dependency name before the agent sees it (requests becomes reqiests), so the lookalike lands in the project's dependency file and only runs later at install time. HiddenLayer names LiteLLM's async_pre_call_hook / async_post_call_success_hook as one place an attacker with gateway control could do this. No CVE; the paper is research. HiddenLayer also notes LiteLLM's 2026 supply-chain compromise and third-party LLM routers caught injecting code.

Why this matters: It's HIGH because the attack doesn't need a bug in Codex, Claude Code or Hermes. It needs control of the path the agent already trusts. Sandboxes and approval prompts reduce blast radius; they don't prove a tool call came from the model you thought you were talking to. Treat every LLM gateway and managed inference hop as a trust boundary with its own access, logging and change controls, and keep secrets out of gateway logs.

2. Gheist: stolen GitHub tokens plant workflows that print every secret into Actions logs HIGH

Source: Wiz: Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles (October 25th). Also The Hacker News (October 26th).
- Wiz Research has tracked Gheist since September 15th, 2026. For each repository a stolen token can reach, the tool creates a branch named ci-sync- plus six random characters, commits .github/workflows/sync-check.yml with the message ci: sync config, and lets the push trigger the workflow. The workflow base32-encodes env and toJSON(secrets) into its own log (base32 bypasses GitHub's verbatim secret masking), then the tool downloads the log through the GitHub API and deletes the run seconds later. API requests carry the user agent gheist.
- permissions: {} restricts the job's GITHUB_TOKEN but does not restrict the secrets context. When the repo has deployment environments, a job matrix with environment: ${{ matrix.environment }} dumps environment-scoped secrets too, often production credentials. There is no attacker domain to block; the secrets leave through GitHub's own API.
- Wiz has recovered more than 13,500 planted branches from more than 850 compromised accounts, from personal projects to enterprise private repos. As of October 24th the campaign was still evolving, and about two-thirds of implicated accounts were no longer available on GitHub after Wiz reported the activity. Credential sources Wiz could trace include infostealer logs and earlier supply-chain exposures.
- GitHub's July 28th control holds potentially malicious workflow runs in public repositories until a collaborator approves them. Every public Gheist run Wiz checked sits at action_required and never ran. That hold does not apply to private repositories or GitHub Enterprise Server; audit logs there show completed-then-deleted runs on ci-sync-* branches, and CloudTrail shows victim org workflows on those branches assuming AWS roles.
- Since October 19th, Tool B has also pushed a self-hosted sync-host job that writes .gdmp_pat, .gdmp_patg and .gdmp_sweep, logs stages under ===== gdmp-pivot:, and searches the runner for 31 token formats (including Anthropic, Hugging Face, Groq and NVIDIA keys), private keys, .env files, Terraform state, shell history, cloud instance-role credentials and runner credential files. Wiz notes the job is buggy (wrong runner key file, broken URL-credential regex, no GCP/Azure token collection) but still treats a self-hosted runner that ran it as compromised. Distinct from GhostAction.

Why this matters: It's HIGH because private and GHES repos still run the payload, secrets leave through a channel you can't egress-block, and deleting the branch or the run does not undo the exposure. Hunt ci-sync-[0-9a-z]{6} branches and the gheist user agent, rotate every secret the affected repos could see, revoke the pushing tokens, and don't approve held sync-check runs. Prefer GitHub Apps or short-lived fine-grained tokens over long-lived PATs, and keep production secrets behind environment reviewers and OIDC trust scoped to protected branches.

3. Google Cloud MCP Toolbox for Databases: unauthenticated path traversal and overwrite via cloud-storage source CRITICAL

Source: NVD: CVE-2026-93328 (published October 26th). Also GitHub Advisory GHSA-2gc9-c85v-5vwr and googleapis/mcp-toolbox PR #3454.
- NVD describes path traversal and missing authorization in the cloud-storage source of Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0. An unauthenticated remote attacker who can invoke the tool can exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files through crafted tool parameters. The CNA rates it CVSS 4.0 9.3. It is not on KEV.
- The fix landed in v1.5.0 (June 18th, 2026) via PR #3454, which added allowedBuckets and allowedLocalRoots. Current releases are well past that (v1.15.0, released October 22nd). The docs still say that if those lists are omitted, all buckets and all local paths are allowed, so upgrading alone isn't enough if the allow-lists were never set.
- GHSA-2gc9-c85v-5vwr was published October 26th and points at the same CVE. Treat any install still on 1.2.0 through 1.4.0 as exposed until upgraded and configured.

Why this matters: It's CRITICAL because the caller doesn't need credentials, and the default posture is allow-all. MCP tools that touch cloud storage or the local filesystem need explicit allow-lists before they face any untrusted prompt or network path. Upgrade to at least 1.5.0 and set allowedBuckets and allowedLocalRoots.

4. CarryoverBench: planted agent payloads keep firing after the attacker leaves CONTEXT

Source: arXiv:2610.28425 After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents (submitted October 20th; HTML)
- Researchers at the Chinese Academy of Sciences' Institute of Automation, Zhongguancun Academy and SenseTime Research introduce CarryoverBench: 12 personal-assistant scenarios and 101 attack tasks (35 Instant / same-turn prompt injection, 30 Autonomous / heartbeat-scheduled, 36 Latent / memory-resurfaced), run on the Nanobot harness across five models. A rule-based verifier scores planting and triggering separately.
- Overall attack success rates: GPT-5.4 11.9%, Claude Sonnet 4.6 18.8%, Gemini 3.1 Pro 51.5%, GLM-5 27.7%, Qwen3-235B-A22B 63.4%. Persistence doesn't decay over five rounds once a payload is planted. Once it's planted, four of five models trigger it more than 80% of the time under Autonomous and at least 66% under Latent.
- Textual defenses (system-prompt principles, explicit edit authority, harness spotlighting) mostly cut planting, not triggering. On the Hermes runtime (Latent channel), ASR dropped but wasn't eliminated (2.8% to 27.8% depending on the model); Hermes' scanner matched 0 of 89 payload files, and its review pipeline never invoked remove/replace. The authors recommend runtime controls: capability sandboxing, outbound-egress allowlists, and persistent-state write quarantine. No CVE; research only. The arXiv listing says the paper was accepted to the EMNLP 2026 Main Conference.

Why this matters: It's CONTEXT, but the operational takeaway is clear. Defenses that only inspect the turn the attacker is present miss the later heartbeat and memory triggers. If your agent can write durable state or schedule itself, treat those writes as a gated control plane, not freeform notes.

Continuity Footnotes

• CISA KEV due today: Arista VeloCloud Orchestrator (CVE-2026-114625) and Collabora's built-in CODE Server app for Nextcloud (CVE-2026-110447), covered October 23rd, were due Monday, October 26th. CISA's catalog moved to version 2026.10.26 this evening (1,758 entries), adding the two PHP2Shell CVEs below (CISA Known Exploited Vulnerabilities Catalog).
• PHP2Shell (CVE-2026-109618, CVE-2026-109619) now on KEV: covered October 23rd. New today: CISA added both CVEs to KEV on October 26th, with a federal due date of October 29th (CISA Known Exploited Vulnerabilities Catalog). BleepingComputer reports that Adel Karimi (Perplexity) recorded confirmed remote code execution with usable memory disclosure against an Apache mod_php PHP 8.4.26 honeypot, and Marcus Hutchins (Expel) called it the highest-quality confirmation of in-the-wild exploitation he'd seen (BleepingComputer, October 26th). Separately, Unit 42's October 25th update says it can't confirm that the European government agentic post-exploitation case was initial access via the PHP2Shell CVEs, and it retracted its October 23rd update on that point (Unit 42). Our October 23rd brief now carries an update noting the retraction.
• Brotli / Node2Shell (CVE-2026-111497): covered October 23rd and 25th. New: Microsoft shipped .NET 8.0.33 / 9.0.22 / 10.0.14 (plus .NET 11 RC3), Visual Studio 2019/2022/2026 and PowerShell 7.4/7.5/7.6 fixes on October 25th (SecurityWeek, October 26th). PHP rebuilt its Windows packages as 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 with Brotli 1.2.1; the vulnerable decoder is reachable through the cURL extension when automatic HTTP response decompression is enabled (php.net, October 26th). Still not on KEV.
• Reference MCP servers v2.1.0: covered October 25th. All eight GHSAs (including GHSA-mvf5-2qqv-rg3c) still have no CVE aliases as of this evening.
• Wasmtime Cranelift sandbox escapes: CVE-2026-115889 (all architectures, GHSA-897f-g5gm-fmxm) and CVE-2026-115893 (aarch64 only, GHSA-mghf-wjfp-p5xm), both CVSS 3.1 9.9 per Bytecode Alliance, fixed in 36.0.19 / 43.0.0 and 36.0.19 / 48.0.7 / 49.0.4. Advisories published October 19th; THN covered October 26th. Not on KEV; no attacks reported. Relevant if you compile untrusted Wasm (agent sandboxes, edge compute).

Pattern Analysis

1. The trust boundary moved off the model (October 21st to 26th): HiddenLayer's gateway-as-attacker (Story 1) and LiteLLM's own gateway compromise earlier this week both say the same thing. Whoever shapes the traffic the agent consumes can spend the permissions the user already granted. Approval prompts and sandboxes help; they don't authenticate the model hop.
2. Secrets still leak into CI and gateway logs (October 21st to 26th): Gheist's base32 dump through Actions logs (Story 2) is the same failure mode as LiteLLM tokens in gateway logs. Encoding beats masking; deleting the run doesn't un-leak the secret. Secrets belong in a vault or NHI store, not in a workflow context an untrusted branch can print.
3. Persistence outlives the attack turn (October 20th to 26th): CarryoverBench (Story 4) and Forever's AGENTS.md-in-Downloads report (October 25th) both show durable agent state (memory, heartbeats, machine-wide config) as the lasting foothold. Defenses aimed only at the planting turn miss the later trigger.

Recommended Actions

Immediate (today):
1. Inventory every LLM gateway, proxy and managed inference hop your coding agents use. Treat each as a trust boundary: who can change its config and callbacks, what it logs, and whether those logs can hold tokens. Prefer short-lived credentials and scrub request/response bodies before storage.
2. Hunt Gheist: look for branches matching ^ci-sync-[0-9a-z]{6}$ whose only change is .github/workflows/sync-check.yml with commit message ci: sync config, for deleted workflow runs on those branches, and for user agent gheist. On self-hosted runners, look for .gdmp_pat, .gdmp_patg, .gdmp_sweep and gdmp-pivot in logs. If you find any, rotate every secret the repo (and its environments) could see and revoke the pushing tokens. Don't approve held sync-check runs.
3. If you run Google Cloud MCP Toolbox for Databases, upgrade past 1.4.0 (at least 1.5.0; current is 1.15.0) and set allowedBuckets and allowedLocalRoots. Don't leave the defaults.
4. KEV clocks: confirm Arista VCO CVE-2026-114625 and Collabora CODE Server CVE-2026-110447 are remediated against today's federal deadline, and patch PHP for PHP2Shell (CVE-2026-109618, CVE-2026-109619), now on KEV with an October 29th deadline.

This month:
5. Scope GitHub OIDC and environment protection so production secrets only unlock on protected branches or required reviewers, and prefer GitHub Apps / fine-grained tokens over long-lived PATs.
6. Gate durable agent state: cross-session memory writes, heartbeat schedules and machine-wide agent config changes should need an explicit allow or human approval, not a freeform tool call.
7. Patch Brotli consumers you haven't hit yet: Microsoft .NET / Visual Studio / PowerShell builds from October 25th, and PHP Windows packages *-1 with Brotli 1.2.1.
8. If you compile untrusted Wasm with Wasmtime, move to 36.0.19+, 43.0.0+, 48.0.7+ or 49.0.4+ as your release line requires.

Ongoing:
9. Keep gateway and CI logs out of the secrets path; vaults and NHI stores hold the keys.
10. Assume a planted agent payload can re-fire after the attacker is gone; design detection around later triggers, not just the planting turn.

Relevant Risk Summary

Sources

• HiddenLayer: Man-in-the-Model: Hijacking Coding Agents in Transit
• Wiz: Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
• The Hacker News: Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
• NVD: CVE-2026-93328
• GitHub Advisory: GHSA-2gc9-c85v-5vwr
• googleapis/mcp-toolbox PR #3454
• googleapis/mcp-toolbox v1.5.0
• arXiv:2610.28425 After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents
• arXiv HTML: 2610.28425
• CISA Known Exploited Vulnerabilities Catalog
• NVD: CVE-2026-114625
• NVD: CVE-2026-110447
• Unit 42: Threat Brief: Critical Vulnerabilities in PHP (Updated October 25)
• BleepingComputer: PHP2Shell security flaws now successfully exploited in the wild
• SecurityWeek: Node2Shell Brotli flaw triggers patching across Microsoft, Node.js, Python packages
• php.net: Updated PHP Windows builds for Brotli security fix
• NVD: CVE-2026-111497
• GitHub: modelcontextprotocol/servers GHSA-mvf5-2qqv-rg3c
• NVD: CVE-2026-115889
• NVD: CVE-2026-115893
• Bytecode Alliance: GHSA-897f-g5gm-fmxm
• Bytecode Alliance: GHSA-mghf-wjfp-p5xm
• The Hacker News: Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes

Informational security guidance. Not certification.