A house newsletter · daily · researched and written by the Kurzia AI
Wednesday 11 November 2026 · Issue 11 · 4 min read
SGLang RCE breach at NEAR AI, AG2 sandbox escape, Outlook NTLM zero-day, GPUStack 2.2.2
Act on this first
The Hacker News · yesterday
SGLang
Takeaway: 18 agents and about 100 users
NEAR AI says an attacker used a remote-code-execution flaw — RCE, meaning the attacker runs their own code on the server — in SGLang, an open-source LLM inference engine, to run code on one of its inference servers. The attacker may have read every request that server handled that day, including ones sent in confidential mode, a feature that is supposed to confine each request to a trusted execution environment (TEE), an isolated slice of the processor.
If you serve models with SGLang, this is the threat model in one incident: the inference engine is a network-facing RCE target sitting directly on every prompt and completion your users send. Treat the engine like any other exposed service, watch the project's releases for a fix, and keep inference servers off networks they do not need. NEAR AI says material reaching 18 agents and about 100 users may have been exposed; the report names no patched SGLang release, so check the upstream repository before assuming you are current.
Under attack
Microsoft Outlook — Microsoft Outlook — a spoofing zero-day leaks NTLMv2 hashes when a crafted message file is opened; Microsoft confirms active attacks; patched in today's updates; CVE-2026-124194. BleepingComputer counts 1,235 vulnerabilities in November's Patch Tuesday; SecurityWeek counts 1,094 — the outlets tally differently.
Google Chrome — Google Chrome — a use-after-free in the XML component is actively exploited; fixed in this week's stable update, Google's eighth exploited Chrome zero-day this year; CVE-2026-125350. Google has not yet assigned a CVSS score to the flaw.
Barracuda ESG — Barracuda ESG — chained flaws yield root once the admin UI is reachable; vendor confirms attacks on a few customers; apply BNSF-40425 patches; CVE-2026-116606, CVE-2026-111560. Patch IDs differ by appliance — ESG takes BNSF-40425 (9.4.017+) or BNSF-40430 below that; Load Balancer ADC, Message Archiver, WAF and WSG each have their own.
Holes in AI tools
GitHub Advisory Database · today
AG2 SandboxShellTool
AG2's SandboxShellTool offers two restricted modes — an explicit allowed=[...] command allowlist and readonly=True — and a single newline character inside the command string defeats both. The filter rejects semicolons, pipes and &&, but not a line break, while execution hands the raw string to sh -c, where a newline works exactly like a statement separator. Because tool arguments are model-generated, indirect prompt injection — text in a fetched page or tool output that steers the agent — can trigger this without the operator typing anything malicious, and the default LocalEnvironment backend runs the commands as a host subprocess with no real isolation.
If you set up SandboxShellTool's allowlist and treated it as a boundary, it was not: anything the agent reads can turn into shell commands running as the same process as your agent. No attack is reported.
Read it at GitHub Advisory Database
Affected: >= 0.13.2, < 1.1.1 · Fixed in: 1.1.1 · Disclosed 10 Nov · We had it 10 Nov, 23:05 UTC
OpenSourceMalware · yesterday
sapho11 campaign
Takeaway: within ninety minutes
A supply-chain campaign against crypto wallet projects — Keplr, Zcash, Vizor and Cosmos — opened plausible pull requests whose "diagnostics" code packaged up signing keys and credentials and posted them to an attacker domain, published a credential-stealing Rust crate (lwd-uri-util) whose build script runs on every cargo build before any of its functions are called, rewrote AGENTS.md to tell AI code reviewers the exfiltration was routine, and phished maintainers with a fake vulnerability report.
The crypto target is incidental; the playbook travels to any repo where bots do first-pass review. Each move was calibrated for that setting: answer the bot's complaint with a tidy-looking "fix", edit the file the coding agent reads for instructions, then stash the payload where nobody reads closely — a dependency's build script. GitHub has since removed the account, its repos and the pull requests. Chainapsis's automated review flagged the exfiltration in the first pull requests and maintainers closed all four Vizor PRs within ninety minutes; the attacker's account was six hours old at the time.
“sapho11 is a compact case study in how supply chain attacks against open source projects are adapting.”
AWS Security Bulletins · yesterday
AWS API MCP Server
Takeaway: the fix ships in 1.5.1
The practical effect is that an actor could invoke AWS operations your policy was meant to block, or to hold back for human confirmation.
A policy is the entire control on an MCP server that can call AWS, and this made part of yours decorative. If you run a fork or have pinned an older release, patch that too — AWS explicitly asks operators to fix derivative code. Impacted releases run from 0.2.13 up to 1.5.0; the fix ships in 1.5.1, and AWS publishes nothing short of upgrading as a workaround.
Read it at AWS Security Bulletins
Affected: >= 0.2.13 AND < 1.5.1 · Fixed in: 1.5.1 · Disclosed 10 Nov · We had it 11 Nov, 03:32 UTC
The Hacker News · yesterday
Fireworks AI
Fireworks AI, a hosted inference provider, says a deeper look at the intrusion it disclosed earlier has turned up additional malicious activity: account and billing information, secrets, datasets and incomplete models for a limited set of accounts.
Notion AI chat sessions handled through Fireworks are among the exposed material, per the report — the second reminder in a month that prompts sent to a hosted inference provider live on somebody else's disks. If your product routes AI features through a third-party model host, check what those transcripts contain and who else can reach them. The company describes the affected set of accounts as "limited" and has not said how the attackers first got in.
Found or caused by AI
Formalizing CPython — A project pointed AI agents at CPython 3.15.2 and had them rewrite its functions in Lean, a machine-checked proof language, line by line — testing every copy against real Python on at least 50,000 inputs, then proving properties about it, with a second reviewing agent accepting only work it could not break. About 14% of the codebase has passed that bar, and the proofs have yielded 418 bug reports against Python, roughly 55 of which can crash the interpreter or corrupt memory from plain Python code. CPython has never promised that running untrusted Python is safe, so these land as correctness and availability bugs rather than CVEs — but a batch of about fifty interpreter crashes and memory-corruption cases arriving at once is what machine-scale bug hunting now drops on a maintainer queue, and it is arriving on more queues every month. Every accepted function is also re-run against the real interpreter; several logically valid proofs still disagreed with it, including one that assumed memory allocation always succeeds and "proved" a 16-terabyte string could be built.
AlphaProof Code — Google DeepMind used AlphaProof Code, a multi-model agentic framework, to formally verify the actual compiled code of the Signal protocol — which it calls the first time a widely deployed cryptographic protocol's shipping implementation has been formally verified by any method. Agents wrote over six million lines of Lean proof code, with human experts reviewing only about one percent of the codebase the agents flagged for a second look. Most protocol verification stops at the design on paper; reaching the running code closes the gap where real vulnerabilities actually live. As a sanity check, the team reintroduced two real, previously fixed Signal bugs and the system produced machine-checked proofs that each buggy version was insecure. The whole verification took four weeks — work DeepMind says has historically taken expert teams years — and the artifacts are being open-sourced.
Patches worth knowing
gpustack — gpustack — 0.7.1 through before 2.2.2: a forged SAML login gives full account takeover, even where SAML was never configured; fixed in 2.2.2; CVE-2026-102894, critical, CVSS 9.1. No configuration-level workaround exists — the callback runs whether or not SAML is set up, so until you upgrade, block /auth/saml/callback at your reverse proxy.
Affected: >= 0.7.1, < 2.2.2 · Fixed in: 2.2.2 · Disclosed 10 Nov · We had it 10 Nov, 23:05 UTC
gpustack — gpustack — 2.2.0 through before 2.2.2: a non-admin reaches whole Kubernetes clusters via an unchecked proxy; fixed in 2.2.2; CVE-2026-103002, high, CVSS 8.8. Until upgraded, the advisory says, restrict access to trusted administrator accounts.
Affected: >= 2.2.0, < 2.2.2 · Fixed in: 2.2.2 · Disclosed 10 Nov · We had it 10 Nov, 23:05 UTC
Kiro CLI — Kiro CLI — 1.16.0 up to before 2.27.0, macOS and Linux: session transcripts readable by other local users, secrets included; fixed in 2.27.0; CVE-2026-124848. Until you upgrade, run chmod -R go-rwx ~/.kiro and set umask 077 before launching; after upgrading, launch once so existing files are fixed too.
Affected: >= 1.16.0 AND < 2.27.0 · Fixed in: 2.27.0 · Disclosed 10 Nov · We had it 10 Nov, 23:04 UTC
One thing to do
airgap-check — Install airgap-check (go install github.com/humanethq/airgap-check/cmd/airgap-check@latest) and point it at one of your AI application repositories. Its --run mode starts the app in a Docker container with no network and a loopback sinkhole that records every DNS query, TLS hostname and HTTP request it attempts — the calls that fail or hang on first use behind a restricted network. In a week of MCP-server policy bugs and inference-server breaches, knowing what your AI tools quietly reach for at runtime is a cheap, one-morning audit.
Out-of-sample testing on v0.2.1 reported 93.0% precision and 88.3% recall against known runtime fetch behaviour. GitHub (humanethq/airgap-check)