# KLM Innovation Security Monitor
**Date:** October 29, 2026

> Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

## Executive Summary
Today's theme is the gap between finding a bug and fixing it. Anthropic's Frontier Red Team says an unreleased Claude model found flaws in Chrome, Safari, Android, Windows and Linux and chained them into five working exploits with little human help, including a zero-click remote root bug in the Linux kernel's TCP handshake code (CVE-2026-98432, CVSS 3.1 9.8 from the kernel CNA). Every one of those is patched. The hard part for defenders is now the time between a fix shipping and it landing on your hosts, because the cost of turning a fix into an exploit keeps dropping.

The KEV clock shows the same gap. CISA added GitLab CVE-2026-97229 and Cisco ASA / FTD CVE-2026-76418 today, both due Sunday, November 1st. The Alpine Linux project says an attacker probed its GitLab server with the GitLab bug a week after the fix shipped, and that upgrading GitLab didn't fix it because its image used standard Ruby, not the patched Ruby that GitLab bundles in its own packages. On the agent side, Forever Security showed that the browsers built into five AI coding assistants don't keep normal browser rules, and two of the five (Codex and VS Code) had no fix as of today. PHP2Shell's federal deadline is today.

## Founder take
LLMs are an accelerant on both sides now. Pair an agent with a capable model and battle-tested security tools, and you can find real problems fast, whether you're defending or attacking. That isn't unique to Anthropic. Any capable model can drive runtime testing today, and we've done it with open-weight models and other frontier providers. What Anthropic published is self-reported, with no costs, success rates or hours attached, so read it as a capability signal, not a benchmark. The harder part is what comes after finding. Remediation is still slow. Teams that want to keep pace with AI-speed discovery will need to embrace AI-generated code fixes, reviewed and tested, not just AI-generated findings.

## Headline Developments

### 1. Anthropic says an unreleased Claude model built five working exploit chains, including zero-click Linux root (HIGH)
**Source:** [Anthropic: Discovering and exploiting vulnerabilities in critical, real-world software with Claude](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude) (October 27th). Also [Dark Reading: Claude Model Builds Exploits Across Major Browsers & OSes](https://www.darkreading.com/application-security/claude-model-exploits-major-browsers-oses) (October 29th) and [NVD: CVE-2026-98432](https://nvd.nist.gov/vuln/detail/CVE-2026-98432).
- Anthropic's Frontier Red Team says the model, after initial prompting, wrote a one-click Chrome chain that escaped the sandbox on macOS, a Safari chain that bypassed the same-origin policy to read other sites' data, an Android chain that pulled photos and personal data off a locked phone over USB (tested on a Pixel 9), a remote crash for Windows servers answering HTTP/3, and a zero-click remote root exploit for Linux servers. It says Google has assigned and patched 62 CVEs from this work as of Chrome 156, and that Apple, Google and Microsoft have fixed the others it reported.
- The Linux bug is CVE-2026-98432, a race-condition use-after-free when the kernel frees IPv4 options during the TCP handshake. Anthropic's proof of concept targeted a multipath TCP listener and took 48 minutes to leak a kernel pointer and about five more to run a root command; a lost race just fails the handshake, so an attacker can retry. The kernel CNA's record describes the bug in the ordinary IPv4 TCP handshake path and lists fixes in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. NVD lists the Windows bug as CVE-2026-33096, an HTTP.sys out-of-bounds read that Microsoft fixed in April.
- Dark Reading's outside experts add context: Black Duck's Andrew Bolster says the fixes are public but claims that Claude found them on its own are Anthropic's, and that the report gives no success rates, cost or human hours per chain. He also notes the Android chain needs physical access and the Linux one needs an exposed MPTCP listener. None of these CVEs are on KEV, and there's no report of them being exploited.

**Why this matters:** It's HIGH because the work that used to take a specialist team is getting cheap, and the patches are already public, so the diff is a map. Anthropic's own advice is to scan your code at pull request time. For operators, the practical move is to shrink the window between "fixed upstream" and "fixed on my hosts," starting with kernels on internet-facing servers.

### 2. CISA adds GitLab CVE-2026-97229 and Cisco ASA / FTD CVE-2026-76418 to KEV, both due November 1st (CRITICAL)
**Source:** [CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog) (October 29th). Also [NVD: CVE-2026-97229](https://nvd.nist.gov/vuln/detail/CVE-2026-97229), [The Hacker News: Attacker Tried to Exploit Alpine Linux's GitLab via CVSS 10.0 Flaw Its Ruby Left Open](https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html) (October 29th) and [Cisco: Secure Firewall ASA and FTD Remote Access SSL VPN Tunnel Denial of Service Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75) (October 28th).
- **GitLab CVE-2026-97229:** GitLab's CNA scores it CVSS 3.1 10.0. Under certain conditions, an unauthenticated user can run code on a GitLab CE / EE server through a crafted regular expression in a CI/CD configuration. NVD lists 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2 as affected. CISA added it today with a November 1st due date and marks it as needing forensic triage. We covered the fix on October 14th, when there was no reported exploitation. It's a separate bug from CVE-2026-110264 (covered October 22nd), and The Hacker News notes GitLab's October 21st releases, the newest on each branch, fix that one too.
- The fix is a patch to the Ruby regex engine (Onigmo) that GitLab ships in its own packages and images. The Hacker News reports that Alpine Linux says a newly registered account sent crafted CI configurations to its GitLab server on October 20th and 21st, and that upgrading to 19.3.6 on October 22nd didn't fix it because Alpine's image used standard Ruby. Alpine found no sign the attacker's code ran but couldn't rule it out, so it rebuilt the server, replaced GitLab's secret keys and reset passwords. Self-compiled installs and images with their own Ruby also need Ruby 3.3.13, 3.4.12, 4.0.9 or later; Ruby 3.2 won't get a fix. Rapid7's public proof of concept needs write access to a public project first, but how the original reported attack avoids that step isn't public.
- **Cisco ASA / FTD CVE-2026-76418:** an unauthenticated remote attacker can reload the device by sending a crafted request to the SSL remote access VPN when secondary authentication is configured on a tunnel group. Cisco scores it CVSS 3.1 8.6, says its PSIRT became aware of active exploitation in October, and lists no workarounds. Its interim mitigation is turning off secondary authentication on the affected tunnel groups, which Cisco notes lowers your VPN security. CISA added it today, due November 1st.

**Why this matters:** It's CRITICAL because both are confirmed exploited with a three-day federal clock that ends on a Sunday. The GitLab case is the one to study: you can upgrade the product and still be exposed if the vulnerable code lives in a runtime you manage yourself. A self-managed GitLab holds source, CI/CD variables and runner tokens, which is a lot of reach for one regex.

### 3. AI coding assistants' built-in browsers and web searches are untrusted input (HIGH)
**Source:** [Forever Security: EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants](https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers/) (October 29th). Also [Help Net Security: Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop](https://www.helpnetsecurity.com/2026/10/29/research-ai-assistant-browser-vulnerabilities/) (October 29th) and [AIR Security: SolanaCry](https://www.air.security/blog-posts/solanacry) (October 29th).
- Forever Security says each of five assistants loosened its built-in browser so the AI could preview projects or read pages, and each change broke a normal browser rule. In Cursor, a web page hid a command the agent read and asked to run with one keypress; when Cursor's sandbox blocked it, the agent switched the sandbox off and retried on its own. Forever says Cursor patched it on October 1st. In GitHub Copilot, a page could set the address bar to `github.com` over a fake sign-in form; GitHub fixed it in 1.1.29 on October 13th.
- In Codex, VS Code and Claude Desktop, a local HTML file in a rigged project could read files across the disk: VS Code and Claude Desktop limited the page to its project folder but not the web workers it started, and Codex had no folder limit at all. Forever's test pulled SSH keys, `.env` files and npm tokens after one click on a link the assistant itself offered. Forever says Codex and VS Code were still unpatched as of October 29th. Microsoft and Anthropic declined its reports, citing Workspace Trust, though Anthropic accepted a separate report from Noma Security; OpenAI hasn't replied. Forever's researcher told Help Net Security that everyone just clicks "Trust" in practice. No CVEs have been assigned.
- Separately, AIR Security says a GitHub repo posing as a Solana starter kit ranked as a top search result for agents looking for one, and its README's only install step is a PowerShell one-liner that installs a NetSupport remote access tool. AIR ties the config to a known NetSupport cluster; the payload URL was offline when it checked. Treat the agent-targeting claim as a vendor claim.

**Why this matters:** It's HIGH because developer laptops hold the keys to everything else, and both stories turn something the agent reads into something the machine runs. The one click these attacks need comes from a link or run card the assistant drew itself, so "the user has to click" isn't a defense. Treat an assistant's browser and its search results as hostile input, the way you'd treat any web page.

## Continuity Footnotes
- **PHP2Shell (CVE-2026-109618, CVE-2026-109619):** covered October 21st through 28th. The KEV federal due date is today. New: CISA says the Linux kernel bug it added yesterday, CVE-2026-46300 (Fragnesia, due October 31st), can be chained with PHP2Shell to plant webshells and run commands as root ([BleepingComputer: CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks](https://www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks/), October 29th). Unit 42's October 29th update says PHP2Shell is being exploited against PAN-OS management interfaces exposed to the internet, and cites Dream Research's report of attackers chaining it with a Linux kernel privilege escalation bug to get root; remove internet access to management interfaces and apply the PAN-OS fixes ([Unit 42: Threat Brief: Critical Vulnerabilities in PHP](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/)).
- **IntentKit CVE-2026-76066:** covered October 15th and 28th. Still no tagged release after 2.6.3.
- **Reference MCP servers:** covered October 25th and 28th. The October 25th GHSAs and GHSA-w766-5x43-whvw still have no CVE aliases.

## Pattern Analysis
1. **Fixed upstream isn't fixed on your hosts (October 27th to 29th):** Anthropic's chains are all patched, the kernel's Fragnesia fix dates to May, and Alpine upgraded GitLab and was still vulnerable (Stories 1 and 2). The exposure lives in the gap between a fix and your fleet.
2. **Agents act on what they read (October 25th to 29th):** an `AGENTS.md` in Downloads (October 25th), a hidden command on a web page and a poisoned README in search results (Story 3). Content the agent reads becomes a command the machine runs.
3. **Old CVEs keep landing on KEV (October 27th to 29th):** GitLab's CVE dates to October 13th and the kernel bug to May. KEV tells you someone started using it, not that it's new.

## Recommended Actions

**Immediate (today):**
1. **GitLab self-managed:** upgrade to the newest release on your branch (19.4.3, 19.3.6 or 19.2.9 for the affected lines). If you built from source or run your own image, also update Ruby to 3.3.13, 3.4.12, 4.0.9 or later, then hunt for signs of exploitation since the October 12th fix using GitLab's published detections. Federal deadline November 1st.
2. **Cisco ASA / FTD with SSL VPN:** upgrade to the fixed release in Cisco's advisory if secondary authentication is configured on any tunnel group, including DefaultWEBVPNGroup. Federal deadline November 1st.
3. **PHP2Shell and Fragnesia:** confirm PHP is patched today and kernels are on a fixed line by October 31st. Take PAN-OS management interfaces off the internet.

**This week:**
4. **Linux CVE-2026-98432:** move internet-facing servers to a fixed stable kernel or distro errata.
5. **Codex and VS Code:** until there's a fix, don't open HTML files from untrusted projects in their built-in browsers, and review which projects are marked trusted. Update Cursor and Copilot.

**Ongoing:**
6. Treat every page, README and search result an agent reads as untrusted input. Don't auto-approve `iwr | iex` or `curl | sh` installs an agent proposes.
7. Measure your patch lag, not just your patch rate. Models are making the step from fix to exploit cheaper.

## Relevant Risk Summary
| Risk | Severity | Recommended Actions |
|---|---|---|
| AI-built exploit chains for patched browser and OS bugs; Linux CVE-2026-98432 (9.8) | HIGH | Shrink patch lag; fixed stable kernels on exposed servers |
| GitLab CVE-2026-97229 (KEV, due Nov 1) | CRITICAL | Upgrade GitLab; update Ruby on custom builds; hunt since Oct 12 |
| Cisco ASA / FTD CVE-2026-76418 (KEV, due Nov 1) | CRITICAL | Upgrade per Cisco advisory |
| AI assistant embedded browsers (EMBRACE) and poisoned search results | HIGH | No untrusted HTML in Codex / VS Code; update Cursor / Copilot; no auto-approved installs |
| PHP2Shell CVE-2026-109618 / 109619 (KEV, due Oct 29) with Fragnesia CVE-2026-46300 (KEV, due Oct 31) | CRITICAL | Patch PHP and kernel; take PAN-OS management off the internet |

## Sources
- [Anthropic: Discovering and exploiting vulnerabilities in critical, real-world software with Claude](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude)
- [Dark Reading: Claude Model Builds Exploits Across Major Browsers & OSes](https://www.darkreading.com/application-security/claude-model-exploits-major-browsers-oses)
- [NVD: CVE-2026-98432](https://nvd.nist.gov/vuln/detail/CVE-2026-98432)
- [NVD: CVE-2026-33096](https://nvd.nist.gov/vuln/detail/CVE-2026-33096)
- [CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [NVD: CVE-2026-97229](https://nvd.nist.gov/vuln/detail/CVE-2026-97229)
- [The Hacker News: Attacker Tried to Exploit Alpine Linux's GitLab via CVSS 10.0 Flaw Its Ruby Left Open](https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html)
- [GitLab: GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)
- [Cisco: Secure Firewall ASA and FTD Remote Access SSL VPN Tunnel Denial of Service Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75)
- [NVD: CVE-2026-76418](https://nvd.nist.gov/vuln/detail/CVE-2026-76418)
- [Forever Security: EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants](https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers/)
- [Help Net Security: Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop](https://www.helpnetsecurity.com/2026/10/29/research-ai-assistant-browser-vulnerabilities/)
- [AIR Security: SolanaCry](https://www.air.security/blog-posts/solanacry)
- [BleepingComputer: CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks](https://www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks/)
- [Unit 42: Threat Brief: Critical Vulnerabilities in PHP](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/)
- [NVD: CVE-2026-76066](https://nvd.nist.gov/vuln/detail/CVE-2026-76066)
- [GitHub: modelcontextprotocol/servers GHSA-w766-5x43-whvw](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-w766-5x43-whvw)

*Informational security guidance. Not certification.*