Also available as plain text · markdown source

Security Monitor 2026-10-28

Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

Executive Summary

Today's theme is the side door. The Washington Post reported that Cathedral, a months-old security startup, told Anthropic its researchers had reached internal sales, HR and IT data through third-party business software, after days of failing to get in directly. Anthropic confirmed access to "a limited set" of those systems, says Claude conversations, source code and model weights weren't touched, and says it shut the access off the same day. The two sides still disagree about how long it took and how far it went. The lesson for everyone else isn't about Anthropic: AI agents now probe the vendors and SaaS apps around a company, not just the company itself.

The operator clock is short this week. CISA added a Linux kernel bug, CVE-2026-46300, to KEV today with a federal due date of Saturday, October 31st, and a VMware ESX logging bug, CVE-2026-41709, due November 11th. PHP2Shell is due tomorrow. On the agent tooling side, the reference mcp-server-git server shipped a fix today for a repository confinement bypass, the official MCP Python SDK and AWS's API MCP Server both fixed token audience checks, and MLflow's scorer deserialization bug picked up a CVE at CVSS 3.1 9.8 from GitHub's CNA.

Headline Developments

1. Cathedral's AI agents reached Anthropic's business systems through third-party software HIGH

Source: The Washington Post: How an AI start-up founded by ex-DOGE staffers broke into Anthropic (October 26th). Also Decrypt: AI Agents Found a Way Into Anthropic's Business Systems in Under 12 Hours (October 26th) and The Decoder: AI agents hacked Anthropic (October 28th).
- The Post reported, from a draft Cathedral report it reviewed, that Cathedral's AI agents found paths to meeting transcripts, salary and job-offer details, and Slack messages in under 12 hours, by exploiting flaws in outside vendors' admin and sales tools. The testing ran under an Anthropic program that works like a bug bounty.
- Anthropic told the Post its monitoring flagged some of Cathedral's activity before Cathedral reported it, and that it cut off access the same day. It confirmed access to "a limited set" of sales, HR and IT systems holding business contact details and basic user account records, said Claude conversations, source code and model weights weren't accessed, and said it has no evidence anyone else used the flaws. It pulled the affected tools until the vendors confirmed fixes. The vendors haven't been named.
- The accounts differ. Per The Decoder, Anthropic red teamer Logan Graham said Cathedral spent several days failing against Anthropic's own systems before pivoting to third parties, found two vulnerabilities but reported one (Anthropic says it found and fixed the second itself), and went beyond the program's safe harbor by targeting third parties and pulling data. Cathedral's draft says data access was "kept to the absolute minimum." Former OpenAI employee Will Depue has claimed, citing unnamed sources, that the access was broader, including Slack admin; Graham says those sources are wrong. Treat the scope as disputed.

Why this matters: It's HIGH because the pattern applies to every company, not just AI labs. The entry point was the business software around the company, the same third-party route as Warp's vendor (covered October 27th). Agents make it cheap to probe every SaaS integration, admin console and vendor connection you've ever approved. Inventory them, check what each one can read, and watch them the way you watch your own perimeter.

2. CISA adds a Linux kernel bug due October 31st and a VMware ESX logging bug to KEV CRITICAL

Source: CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 28th). Also NVD: CVE-2026-46300 and NVD: CVE-2026-41709.
- Linux kernel CVE-2026-46300: CISA added it to KEV today (catalog version 2026.10.28) with a federal due date of October 31st, three days out. Per the kernel CNA's NVD record, skb_try_coalesce() dropped the shared-frag marker when TCP receive coalescing moved page-cache-backed fragments, so IPsec ESP input could decrypt in place over page-cache memory. NVD and the kernel CNA both score it CVSS 3.1 7.8 (local, low privileges). Fixed stable lines include 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10, and Red Hat has errata for RHEL 8, 9 and 10 and OpenShift. The record was published in May, so many distro kernels already carry the fix; check yours.
- VMware ESX CVE-2026-41709: also added today, due November 11th. VMware's CNA describes an insufficient logging flaw that lets a malicious administrator perform certain operations without them being logged, scored CVSS 3.1 2.7. VMware's CVE record lists fixed builds ESXi80U3j-25429389, ESXi-9.0.2.0100-25595025 and ESXi-9.1.0.0-25370933, plus affected Cloud Foundation, vSphere Foundation and Telco Cloud Platform versions (Broadcom advisory).

Why this matters: It's CRITICAL because both are confirmed exploited and the kernel deadline is Saturday. The low ESX score is misleading in context: a bug that hides an administrator's actions is what someone who already holds admin wants after they're in. If you patch hosts, also review who held ESX admin recently and what they did.

3. MCP and AI tooling fixes: mcp-server-git confinement, token audience checks in two MCP stacks, and MLflow RCE HIGH

Source: GitHub: modelcontextprotocol/servers GHSA-w766-5x43-whvw (October 28th); modelcontextprotocol/servers v2.2.0 (October 28th); NVD: CVE-2026-116684 and NVD: CVE-2026-116686 (October 27th); AWS: CVE-2026-115413 AWS API MCP Server OAuth token audience validation bypass (October 27th); NVD: CVE-2026-116692 (October 27th).
- mcp-server-git (GHSA-w766-5x43-whvw): published at 5:13 PM ET today. When the reference Git server runs with --repository <allowed>, a caller can point it at a nested folder inside the allowed repository that holds a .git file reading gitdir: /path/to/another/.git. The path check passes, GitPython follows the redirect, and tool calls then read committed files from, and create branches in, the outside repository. The reporter, ShieldPi, notes a filesystem MCP server with write access to the same folder is one realistic way to plant that file. GitHub's advisory rates it medium, CVSS 3.1 5.3. It's fixed in mcp-server-git 2026.10.28, released today in v2.2.0. No CVE yet.
- MCP Python SDK (CVE-2026-116684, CVE-2026-116686): from 1.10.0, server-side bearer auth accepted a valid token issued for another service when the TokenVerifier didn't check the aud audience (CVSS 3.1 6.8 from GitHub's CNA). Separately, the client resolved external $ref URLs in a server's outputSchema, so a malicious MCP server could trigger blind requests, local file reads, or stall every session in the process (CVSS 3.1 6.5 from GitHub's CNA). Both are fixed in 1.30.0 and 2.2.0.
- AWS API MCP Server (CVE-2026-115413): versions 1.3.0 to before 1.6.0 checked an OAuth token's signature, issuer and expiry but not who it was issued for, so a token from the same identity provider for another app could run AWS operations with the server's configured credentials. AWS's CNA scores it CVSS 3.1 7.8 and CVSS 4.0 7.3. Upgrade to 1.6.0 and set AUTH_AUDIENCE (or AUTH_CLIENT_ID for providers like Amazon Cognito).
- MLflow (CVE-2026-116692): from 3.12.0rc0 until 3.17.0, third-party scorer deserialization would import a request-chosen module under an allowed package. A caller who can upload artifacts into a writable allowed package gets code execution, with no credentials on authentication-disabled servers. GitHub's CNA scores it CVSS 3.1 9.8. The fix shipped in 3.17.0 on October 7th; the CVE landed October 27th. None of these are on KEV.

Why this matters: It's HIGH because these are the boundaries people rely on when they wire agents to tools: "this server only touches that repo" and "this token only works here." Both failed quietly. Check the audience claim on every token your MCP servers accept, and don't give two MCP servers overlapping write access to the same folder.

Continuity Footnotes

  • PHP2Shell (CVE-2026-109618, CVE-2026-109619): covered October 21st, 23rd and 26th. The KEV federal due date is tomorrow, October 29th. PHP's separate session upload progress issue, CVE-2026-115560 (ID named by PHP, but no public CVE record yet), still has no fixed release; PHP says it'll publish a full advisory with the next regular release and to keep session.upload_progress.enabled=0 until then (PHP: News Archive 2026).
  • Brotli CVE-2026-111497: covered October 23rd and 27th. On KEV, due November 10th. Nothing new today.
  • IntentKit CVE-2026-76066: covered October 15th as having no fix listed. NVD's record now says it's fixed in commit 5b91da5, which is on the main branch; there's no tagged release after 2.6.3 yet (NVD: CVE-2026-76066).
  • Reference MCP servers v2.1.0: covered October 25th. The eight earlier GHSAs, including GHSA-mvf5-2qqv-rg3c, still have no CVE aliases.

Pattern Analysis

  1. Attackers go around, not through (October 26th to 28th): Cathedral reached Anthropic through vendor business software (Story 1), and Warp's exposure came through a vendor in its infrastructure (October 27th). The perimeter is now every SaaS app and integration you've authorized.
  2. Agent tool boundaries are checked once and trusted forever (October 22nd to 28th): mcp-server-git validated the path string but not the repository Git actually opened, and two MCP stacks validated tokens without asking who they were for (Story 3). It's the same shape as last week's open-by-default agent servers.
  3. KEV keeps pulling in infrastructure you assume is patched (October 27th to 28th): Brotli yesterday, a May kernel fix and an ESX logging bug today (Story 2). Old CVEs land on KEV when someone starts using them.

Immediate (today):
1. Linux kernel CVE-2026-46300: confirm your kernels are on a fixed stable line or distro errata, prioritizing hosts using IPsec ESP. Federal deadline October 31st.
2. Federal operators: PHP2Shell CVE-2026-109618 and CVE-2026-109619 are due tomorrow, October 29th.
3. Upgrade mcp-server-git to 2026.10.28, MCP Python SDK to 1.30.0 or 2.2.0, AWS API MCP Server to 1.6.0 (and set AUTH_AUDIENCE), and MLflow to 3.17.0 or later.

This week:
4. VMware ESX CVE-2026-41709: apply the fixed builds (due November 11th) and review recent ESX admin activity.
5. Inventory third-party business apps with access to HR, sales, Slack or IT data. Check what each can read, remove the ones you don't need, and alert on unusual access from them.
6. For every MCP server using OAuth, confirm it checks the token audience, and don't let two MCP servers share write access to the same directory.

Ongoing:
7. Assume AI agents are probing your vendors and integrations around the clock. Red team those paths yourself, not just your own apps.
8. Put authentication in front of ML tracking servers like MLflow, even internal ones.

Relevant Risk Summary

Risk Severity Recommended Actions
AI agents reaching internal data through third-party business software (Cathedral / Anthropic) HIGH Inventory SaaS integrations; least access; monitor vendor access
Linux kernel CVE-2026-46300 (KEV, due Oct 31) CRITICAL Patch to fixed stable or distro kernel
VMware ESX CVE-2026-41709 (KEV, due Nov 11) CRITICAL Apply fixed ESXi builds; review admin activity
mcp-server-git GHSA-w766-5x43-whvw; MCP Python SDK CVE-2026-116684 / 116686; AWS API MCP Server CVE-2026-115413; MLflow CVE-2026-116692 HIGH mcp-server-git 2026.10.28; SDK 1.30.0 / 2.2.0; AWS 1.6.0 + audience; MLflow 3.17.0
PHP2Shell CVE-2026-109618 / 109619 (KEV, due Oct 29) CRITICAL Confirm patched before tomorrow

Sources

Informational security guidance. Not certification.