Introducing Agent Activity: See What Your AI Agents Are Actually Doing
TL;DR For the past year, the first question security teams asked about AI was simple: do we have agents running, and where? That question now has an answer. The harder one is what comes next: what are those agents actually doing? Today we’re introducing Agent Activity, now in early access as part of OX.VibeSec and […]
Security Tool Sprawl: How to Consolidate SAST, SCA, and CNAPP
What Is Security Tool Sprawl? Security tool sprawl is the accumulation of security tools bought to fill one gap at a time, each with its own console, policy set, and finding format, until their coverage overlaps in some places and leaves gaps in others. The result is more findings, more consoles, and less certainty about […]
PHP2Shell, Day 5: The Panic Hasn’t Turned Into Patching
5 days after emergency fixes shipped, 93.6% of measurable PHP instances are still exposed On October 21, the PHP project shipped emergency releases for PHP2Shell, a pair of critical flaws (CVE-2026-109618 and CVE-2026-109619) that give an unauthenticated attacker remote code execution inside the PHP engine itself. Security agencies issued urgent advisories, and some organizations pulled […]
PHP2Shell: 24 hours in, 99.3% of Measurable PHP Instances Are Still Unpatched
OX Security tracked over 2.2 million publicly exposed PHP instances following disclosure. Within 24 hours, only 14,151 affected systems visible on Shodan had been patched. The rate at which critical vulnerabilities are discovered continues to outpace our ability to remediate them at scale Overview On October 21, PHP released emergency fixes for PHP2Shell, two critical […]
Node.js Brotli Decoder Out-of-Bounds Write (RCE) – CVE-2026-111497
On October 21, 2026, Node.js shipped security releases across all supported lines fixing a high-severity out-of-bounds write in the bundled Brotli decoder. A Node.js process that decompresses attacker-controlled Brotli data — including Brotli-encoded HTTP responses it fetches — can be driven to write past the end of its buffer, leaking memory or executing code with […]
Three Critical Pillow CVEs: RCE and Heap Overflows in Python’s Imaging Library – CVE-2026-112900 CVE-2026-112393 CVE-2026-112403
Three CVSS 9.2 vulnerabilities in the Python imaging library, allow remote code execution and heap corruption via a single malicious image upload Overview Three critical Pillow vulnerabilities (CVSS 9.2, disclosed 2026-10-19) let a crafted EPS, TIFF or JPEG file trigger command execution or heap corruption in any Python service that processes user-supplied images. All are […]
LiteLLM 1.107.0 Compromised With A RAT InfoStealer
LiteLLM got hijacked again: the AI gateway used to route traffic to dozens of LLM providers shipped a credential stealer with remote access built in Overview On October 21, 2026, a malicious version of LiteLLM (version 1.107.0) was published to PyPI. LiteLLM is one of the most popular open source gateways for routing requests to […]
CVE-2026-109618 & CVE-2026-109619: Two Vulnerabilities Allow Unauthenticated RCE in PHP
Two critical vulnerabilities, CVE-2026-109618 & CVE-2026-109619, allow unauthenticated remote code execution RCE across nearly 2 million exposed PHP servers. Immediate upgrades to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 are required TL;DR On October 21, 2026, the PHP core team issued an out-of-band security release addressing two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. PHP is a widely […]
PHP CVE-2026-109618 & CVE-2026-109619: What to Do Before the Details Drop
Uncertainty creates ample room for speculation and malicious activity. Essential dos and don’ts until the official patch drops. Two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are set to be patched today. The PHP security team rates both CVSS v4.0 9.2, and researchers describe them as unauthenticated remote code execution. Beyond that, there’s very little […]
By Default, Insecure: Apache Airflow Disables SSH Host Key Verification
Vulnerability Details CVE-2026-94134 – SSH hook default, both providers CVE-2026-94135 – Async SFTP path Severity: High – CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) CWE: CWE-322 (Key Exchange without Entity Authentication) Affected packages: apache-airflow-providers-ssh and apache-airflow-providers-sftp – both through version 6.0.1 Fixed in: apache-airflow-providers-ssh 7.0.0 (CVE-2026-94134), apache-airflow-providers-sftp 7.0.0 (CVE-2026-94135) Overview OX Security Research discovered that Apache Airflow disables SSH […]
“Shai-Hulud: Here We Go Again” – “tensorlake” npm Package Hit With Malware
Shai-Hulud is back for another round, this time hijacking the Tensorlake package, 12k weekly downloads Breaking News: Shai-Hulud malware affecting “tensorlake” package version 0.5.144, Overview A malicious version of tensorlake (version 0.5.144) was published to npm with Shai-Hulud malware. The malware also contains an Ethereum contract address, which is tied to a wallet containing 12.44$ […]
SSRF in Harbor Webhooks: Any User Can Reach the Server’s Cloud Credentials
OX Research disclosed an SSRF vulnerability in Harbor, the CNCF open-source container registry. Any registered user who can create a project can point a webhook at the cloud metadata endpoint and walk away with the server’s IAM credentials. No admin role, no user interaction, and no need to stay online. Set the webhook, wait for […]
CVE-2026-93355: Account Takeover in LiteLLM
One request carrying an unverified email claim grants immediate access as the victim and permanently mutates account TL;DR What: OX Research found a way to use a legitimately signed login token to authenticate as another existing LiteLLM user, including an admin. LiteLLM is an open-source gateway used by companies to manage access to OpenAI, Anthropic, […]
PhantomSub: Malicious npm Campaign Secretly Adds Users to WhatsApp Spam Channels
490K downloads, quiet follower inflation, and a mysterious Dan from Indonesia. OX Research is tracking a malicious npm campaign making spam accounts look legitimate. The attackers use Baileys to silently make developers follow spam channels on WhatsApp. Overview The OX Research team identified 101 npm packages as part of a malicious WhatsApp group subscriber campaign. […]
How MCP Is Bypassing a Decade of Cloud Security Best Practices
OX Security Research reveals a governance gap in the MCP ecosystem, with servers hosted in China, Russia, and private homes Enterprise security spent a decade building governance around the cloud: Data residency requirements, Zero Trust boundaries, Granular IAM policies and continuous supply-chain audits. Security teams know how to ask where their data lives, who operates […]
How Do You Build Security for AI Agents That Don’t Exist Yet?
AI agents are rapidly evolving toward more autonomy, more context, greater reach and more authority to act. We have to build security now for what’s coming next. We are making enormous bets right now about how to secure software two years from now, at exactly the moment when software is changing too quickly for anyone […]
OX Security Launches OX Cloud, Redefining Cloud Security for the Agentic Era
OX Cloud introduces a new class of cloud security built for AI agents that access data, call tools and take action – with real-time visibility into what they can reach, what they are doing and when they cross intended boundaries NEW YORK, Sept. 16, 2026 — OX Security today launched OX Cloud, a next-generation cloud […]
OX Cloud: CNAPP Coverage Plus Runtime Security for AI Agents
Built for a new class of active, dynamic risk that traditional cloud security wasn’t built to see. TL;DR OX Cloud is the runtime pillar of the OX AINAPP platform, and our answer to a question most cloud security tools still aren’t built to ask: what is actually happening in your cloud right now, and does […]
Four Critical CVEs, the Same Trust Issue
Last week, 4 unauthenticated critical CVEs turned up in 24 hours, all sharing the same mistake: a component trusting the layer next to it Read our technical analysis of these 4 critical CVEs Within a single 24-hour window last week, four critical vulnerabilities landed across widely deployed infrastructure: two in Next.js, one in Netty, one […]
Technical Analysis: Netty CVE-2026-75595, Next.js CVE-2026-75604, GHSA-2xp9-vwfh-vxw4 & GitPython CVE-2026-78676
In this blog we’re breaking down each CVE separately, including the root cause, technical overview and patch details. Read our analysis of these 4 critical CVEs Netty CVE-2026-75595 Root Cause A TLS record begins with a 5-byte header, and the handshake message inside it begins with its own 4-byte header: one byte of handshake type, […]