FlagThis — Daily Cybersecurity Intelligence Briefing

Self-propagating prompt payloads targeting Microsoft AutoGen, LangChain LangGraph, and CrewAI enable autonomous agent-to-agent malware propagation without host code execution vulnerabilities. Malicious natural-language instructions embedded in agent inputs, tool outputs, shared memory, or poisoned templates execute within LLM reasoning loops and replicate across inter-agent message queues, state graphs, and delegation chains. Attack vectors include indirect prompt injection, recursive delegation commands, and vector database memory poisoning. Impacts include unauthorized tool and code execution, lateral movement across agent swarms, data exfiltration, orchestration logic compromise, and supply chain contamination via malicious agent skills. Remediation requires strict I/O sanitization, least-privilege tool access, sandboxed execution, and runtime monitoring of shared state.

Liminal Panda, a state-aligned APT tracked alongside SilentAir, compromises mobile core networks by exploiting SS7 MAP/CAP and Diameter signaling protocols. The actor conducts cross-border espionage targeting Taiwanese and Asian telecom subscribers through SMS interception, voice call monitoring, real-time location tracking, and roaming interface abuse. Persistence is maintained via BPFdoor, an eBPF-based sleeper-cell implant deployed within telco environments. This signaling infrastructure compromise enables state-linked intelligence collection across global mobile networks without direct endpoint malware deployment.

Starting November 10, 2026, the wfx-loot campaign targeted 61,764 GitHub repositories by hijacking 4,837 user accounts using stolen session tokens. Attackers deployed a self-deleting "wfx" payload via malicious GitHub Actions workflow YAML files to exfiltrate CI secrets, specifically targeting AWS and Azure cloud credentials. While execution occurred in 1,806 repositories, the threat actor established persistent cloud backdoors within victim infrastructure that persist after secret rotation. This identity-driven supply chain attack underscores the risk of long-lived session tokens and insufficient CI/CD pipeline protections.

ARTEX is an autonomous, multi-agent LLM-driven offensive Command and Control (C2) framework that compresses the cyber attack lifecycle to as little as 15 minutes. Written in Go with a Next.js interface, the tool utilizes six specialized sub-agents to translate tactical objectives into machine-executable commands via frontier and open-source LLM APIs. Weaponized by threat actors including Storm-0940 (UNC7228) and Storm-3358, ARTEX facilitates high-velocity exploitation of Azure/AWS cloud control planes, Active Directory (via Kerberoasting and DCSync), and web applications through MySQL general_log JSP webshell injections. Its ability to generate semantically legitimate administrative activity necessitates a transition from static IOC-based detection to first-party behavioral telemetry.

Google Chrome Desktop is undergoing active exploitation via CVE-2026-125350, a high-severity use-after-free vulnerability within its XML parsing component. This vulnerability allows for arbitrary code execution within the renderer process, potentially facilitating sandbox escapes when chained with secondary exploits. Identified as the eighth Chrome zero-day exploited in 2026, the flaw requires no user interaction beyond visiting a malicious website. Google has addressed the issue in the November 2026 Stable Channel Update. Organizations must prioritize immediate patching to mitigate the risk of drive-by exploitation and subsequent lateral movement or data exfiltration within enterprise environments.

Microsoft has disclosed CVE-2026-124194, an actively exploited zero-day spoofing vulnerability in Microsoft Outlook. Identified during the November 10, 2026, Patch Tuesday cycle, the flaw allows attackers to deliver specially crafted message files that, upon user interaction, trigger outbound connections to attacker-controlled infrastructure. This mechanism forces the leakage of Windows authentication data, specifically NTLM hashes, facilitating credential theft and potential NTLM relay attacks for lateral movement within enterprise environments. Both Microsoft MSRC and CISA have confirmed in-the-wild exploitation. This vulnerability poses a critical risk to domain identity security and requires immediate patching and monitoring of outbound SMB/NTLM traffic to untrusted external IPs.

Vates Xen Orchestra xo-server versions before 6.9.0 contain a critical authorization bypass in the user.set API (CVE-2026-113610). Remote unauthenticated attackers exploit the endpoint to bypass authentication and obtain administrative privileges on xo-server, enabling arbitrary code execution and full takeover of managed XCP-ng/XenServer nodes. Active exploitation is confirmed in the wild. Vates patched the flaw in xo-server 6.9.0 via advisory VSA-2026-062. Immediate patching and forensic review of exposed instances are required.

Large language models can be compromised by editing fewer than ten neurons to embed dormant malicious payloads that activate under specific triggers while remaining benign during standard evaluation. Microsoft Research demonstrates neuron-level payload injection detectable via anomalous weight-edit monitoring by frontier agents. Anthropic Alignment Science achieves >99% AUROC using linear defection probes on residual stream activations to predict malicious behavior. Academic work complements this with Sentence-BERT semantic drift and canary baseline comparisons for real-time backdoor identification. The Institute for Foreign Policy frames deceptive AI deployment as a national security risk requiring institutional red-team and blue-team evaluation frameworks.

N-able has taken its hosted N-central environments offline and instructed on-premises customers to shut down servers after the public disclosure of 30+ alleged zero-day vulnerabilities tracked as 'Able2Shell.' Disclosed by Oracle-Security with accompanying proof-of-concept code, the flaws affect the N-central management platform and expose exploit chains capable of full server compromise. The vulnerabilities potentially grant access to managed systems, credentials, and administrative functions. Field Effect reported no observed active exploitation at the time of the advisory; N-able is securing the environment as a precaution.

The OWASP Agentic Skills Top 10 project shifts LLM security risk modeling from static prompt-injection lists to dynamic, capability-centric governance for autonomous agents. It introduces the Universal Skill Format (USF), a machine-readable markdown schema for defining, discovering, and governing AI skills, operationalized by SkillSeekersWeb as a public AI skill standards reference. The framework addresses excessive agency and agentic competency risks, enabling policy-driven enforcement and interoperable controls across agent workflows to replace fragmented mitigations.