Risky Bulletin: PwnEscape vulnerability lets you escape KVM

This newsletter is brought to you by Sondera. You can subscribe to an audio version of this newsletter as a podcast by searching for "Risky Business" in your podcatcher or subscribing via this RSS feed. You can also add the Risky Business newsletter as a Preferred Source to your Google search results by going here.

The Linux kernel team has patched a major vulnerability that lets virtual machine guests escape the KVM Linux virtualization module and run code on the underlying host operating system.

Codenamed PwnEscape (CVE-2026-99999), the bug occurs because the Linux networking stack allows the VM guest to modify IP packets after they've already been validated as safe by the kernel.

This allows a skilled malicious guest to read host memory and potentially modify it for code execution.

PwnEscape impacts KVM running on x86 CPU architectures, which is the most common setup used by most shared cloud environments.

The vulnerability has a very broad impact radius because KVM is widely used to power most virtual machine and sandbox technologies these days. It impacts everything from cloud environments, to CI/CD pipelines, malware analysis tools, AI servers, and more.

While other KVM escapes like ITscape, Januscape, and Zapscape were also discovered and disclosed earlier this year, PwnEscape is considered more dangerous because it's easier to exploit—because it exploits the networking stack rather than specific and narrow VM configuration scenarios.

The bug was found by Pwn.ai security researcher Paulos Yibelo using AI vulnerability research tools.

Yibelo started looking for PwnEscape in August, after cloud hosting platform Vercel launched a hacking contest with a $1 million total prize pool for exploits that could escape its cloud sandbox.

The researcher received $50,000 for the PwnEscape report, the maximum reward in the hacking challenge, and was also the only report to receive a "Critical" severity status.

Why bother breaking Vercel’s isolation when you can break Linux itself? PwnEscape, CVE-2026-99999 (also the perks of being a CNA)

— rz1027 (@the_rz1027) October 16, 2026

Risky Business Podcasts

The main Risky Business podcast is now on YouTube with video versions of our recent episodes. Below is our latest weekly show with Pat, James and guest co-host Brad Arkin at the helm!

Breaches, hacks, and security incidents

OpenCode hit: A threat actor has compromised OpenCode user accounts to carry out distillation attacks against AI frontier labs over the weekend. The attack impacted roughly 1.4% of users of the OpenCode Console open-source AI coding agent. Several users reported losing hundreds and even thousands of US dollars in incurred costs. OpenCode says it notified all affected users. [OpenCode]

Cyberattack hits Romania's stock market agency: A cyberattack has hit Romania's Central Depositary, the agency that handles Romania's stock market transactions. The attack targeted the agency's online user portal. Officials said the hackers accessed a database storing the personal data of all registered users. Hackers allegedly stole data such as names, home addresses, national ID card details, emails, phone numbers, and bank numbers. The Depositary says the attackers didn't alter any data. [Economica.net // Profit.ro]

Cyberattack impacts US bankruptcy courts: A cyberattack has disrupted a platform used by US courts to handle federal bankruptcy cases. The attack impacted the Bankruptcy Noticing Center, a platform managed by BAE Systems. The BNC, along with other websites managed by BAE, are offline. [US Courts // The Record]

Cali DoE breach impacts California students: Hackers have stolen the data of seven million California students from the state's Department of Education. The Department says the hack targeted the file transfer platform of the Education Testing Service, an exam testing platform managed by an outside non-profit. The hackers used a compromised account to access the platform on multiple occasions between May and September. Stolen data includes personal student details, educational data, and disability details. [California Department of Education // California OAG // Politico]

Burger King Japan hack: Hackers have stolen 11.18 million user records from Burger King Japan. The files were taken from a server managing the company's smartphone app. The stolen data includes names, dates of birth, email addresses, phone numbers, and gender. [Japan Today]

South Korea fires employee who sold patient data: The South Korean government has fired an employee of its National Health Insurance Service for selling patient data. The scheme went for two years and the employee made hundreds of thousands of US dollars. The employee was fired in July but the agency has yet to notify any of the affected individuals. [The Chosun Daily]

AI agents hacked Indian sites: AI agents broke into Indian websites and accessed sensitive and confidential data. The intrusions took place during AI model testing operations. India's cybersecurity agency says AI companies notified it of the improper behavior. The agency didn't go into details about what sites were compromised. [CERT-IN // Reuters]

ConnectWise Cloud Backup supply chain attack: A threat actor is hacking into enterprise networks using a compromised ConnectWise cloud application. According to security firm Huntress, the attacker compromised the Microsoft API key for ConnectWise's Cloud Backup app, formerly known as SkyKick. The hacker has used the app to gain access to Microsoft 365 environments and then deploy their own, more powerful apps. [Huntress // SpecterOps]

AOMEI targeted with short-burst supply chain attacks: Hackers have backdoored the servers of backup provider AOMEI in a novel, first-of-its-kind supply chain attack. According to Google, hackers replaced backup software on the company's servers in short bursts of five to ten minutes. The bursts took place across multiple windows between May and July. Users who downloaded AOMEI backup software during the bursts got infected with the CROSSROAD downloader and SHINYROAD backdoor. [Google]

Gamdom hacked for $4.2m: Hackers have stolen $4.2 million from crypto gambling platform Gamdom. The incident was traced back to an unauthorized connection on an automation server. [Cryptopolitan // Gamdom]

Pirate Chain hacked for $10m: Hackers breached the Pirate Chain cryptocurrency and minted more than $10 million worth of new tokens. The newly minted funds represented a fifth of the token's supply, causing a 25% drop in the token's exchange rate. The minted funds were quickly laundered out of the Pirate Chain network. [Crypto Briefing // Pirate Chain]

Hackers breach VPS provider FirstVDS: Hackers have breached over the weekend Russian virtual private server provider FirstVDS. The hackers entered by exploiting a vulnerability in the VMmanager virtualization management platform. Once inside, they deployed a script that collected passwords, access keys, configuration files, and crypto-wallet information. FirstVDS says it already notified all customers whose servers were compromised. [FirstVDS on Telegram]

Ukrainian hacktivist deface school testing system: Pro-Ukrainian hacktivist groupBlack Spark has hacked and defaced a Russian school testing system with anti-Putin and anti-government messages. The hack impacted Edutest, a school testing platform developed by Russia's Federal Service for the Supervision of Education and Science (Rosobrnadzor). Disruptions to ongoing tests were reported mainly in the Moscow region. The group previously also hacked companies in Russia's oil sector. [Ekaterina Mizulina on Telegram // Caliber.az]

General tech and privacy

Intel discontinues SGX: Intel will discontinue its SGX (Software Guard Extensions) trusted execution environment. The Intel Xeon platform, code-named Diamond Rapids, will be the last to include SGX. SGX support will run into the early 2030s. Intel says it will focus its development on its TDX (Trust Domain Extensions) trusted execution environment, which is more widely used in cloud environments. [Intel]

Edge rolls out silent security updates: Microsoft has added a new Edge feature that silently downloads security updates in the background and applies them when the user is away and the browser is idle. A popup window announces the restart to make sure it is not interrupting user activity. The new "Restart to update on idle" is disabled by default. [Windows blog // Microsoft Support]

Meta admits it throttled Lula accounts: Social media giant Meta has admitted that it throttled the accounts of Brazilian President Lula ahead of the country's election and favored his rival, right-wing politician Flavio Bolsonaro. This is the latest such incident at Meta, where the accounts of right-wing politicians are intentionally given more visibility. [The Rio Times]

Meta takes down No Kings account: Meta also admitted to have banned the Instagram account of the organizers of the No Kings anti-Trump protests over the weekend. Meta called it a "bug," those who know better know it's not. [Meidas News]

TikTok bans Musk documentary account: Also in social media censorship, TikTok admitted to banning an account that promoted a documentary on Elon Musk and his DOGE days. TikTok joins YouTube and Meta, all of which have also banned ads for the documentary. [TechCrunch]

GitHub expands malware advisories to eight services: GitHub has expanded its Malware Advisories database to cover eight package repositories. The database previously showed only malware detections on npm. Starting last week, the database also includes warnings for malicious packages on PyPI, Maven, RubyGems, NuGet, Go, Rust Crates, and PHP Composer. [OpenSSF // GitHub Malware Advisories]

PyPI adds email reputation checking: The Python Software Foundation has rolled out email reputation checks for all new PyPI accounts. The measure specifically targets disposable email providers. The Foundation has also restored the ability to register PyPI accounts with Outlook and Hotmail domains. PyPI blocked the two domains in June 2024 after they were used for mass-registering malicious accounts. [PyPI]

RubyGems adds security warnings: The RubyGems portal has added security warnings to its package repository to warn users of gems with known security issues. The warning data is pulled hourly from sources like the GitHub Advisory Database and the Open Source Security Foundation's OSV database. Alerts cover both malware detections and known vulnerabilities. [RubyGems]

Government, politics, and policy

US guide for AI IR: CISA, NIST, and the NSA have published a guide on how to perform incident response for incidents involving AI training and testing operations. [CISA]

MEPs targeted by deepfake porn: An investigation by the Agora Digital Transformation has found deepfake pornographic content for 50 members of the European Parliament, 46 of which are women. [ADT]

Romania kept buying Kaspersky: More than 80 Romanian government institutions kept buying Kaspersky security software even after the government banned it in March 2023. According to Romanian journalists, buyers include city halls, hospitals, schools, and even a military and NATO research institute. Romania banned Kaspersky products after Russia's invasion of Ukraine, citing national security concerns. [PublicRecord.ro]

Server seizure scandal in the Netherlands: The Dutch Parliament has launched an inquiry into the Dutch Police after agents seized the servers of Italian hacktivist and hacker collective Autistici/Inventati. The servers were seized at the request of US authorities on claims that the group facilitated left-wing and Antifa terrorist activities. The US designated Antifa a terrorist organization last year and the Autistici/Inventati group in August. The designations have not been echoed by any other country. Dutch officials are investigating why police complied with the order. [Dutch Parliament // NRC]

Drone strikes hit VK data centers: Almost 45% of VK's server infrastructure went down on Sunday after Ukrainian drones hit the Russian tech giant's data centers near Sankt Petersburg. The attack caused the VKontakte social network to go offline for several hours. VK is the second Russian tech company to see a major outage after its data centers were hit by drones. Three Yandex data centers were also targeted earlier this month. Ukraine started targeting data centers after Russia first targeted data centers in Ukraine last month. [United24 Media]

❗️Ukrainian strike drones attacked the data center of the Russian social media giant VK in St. Petersburg last night, causing a fire, after which outages began on the VK network.

[image or embed]

— 🪖MilitaryNewsUA🇺🇦 (@militarynewsua.bsky.social) October 18, 2026 at 9:27 AM

VK (AS47541), Russia's largest social network, lost ~45% of its reachable network from ~03:45 Moscow time tonight. VK says drones attacked its data centre in Leningrad Oblast and that services work as normal. ~27% is still missing 2.5h later. https://t.co/TERTMuXNQJ https://t.co/zJsk4QUysf

— WatchTheNet.com (@watchthenetcom) October 18, 2026

Sponsor section

In this Risky Business sponsor interview, James Wilson chats with Sondera co-founder and CEO Josh Devon about how AI agents are highly capable, but they’re not the best rule followers or decision makers.

Arrests, cybercrime, and threat intel

Arrested Qilin member linked to Synnovis hack: A Russian national currently in German police custody is believed to be behind the ransomware attack that crippled UK blood testing company Synnovis in 2024. 28-year-old Vladimir K. was arrested in May in Japan and extradited to Germany this month. He is being investigated for hacking a German logistics company while in the Qilin ransomware group. British police are also investigating him for the Synnovis hack, a patient's death linked to the attack. [BBC]

Scammers return to scam centers after arrests: The National Police of Timor-Leste says foreign nationals arrested in cyber scam compounds have returned to their previous work places after being arrested and paying modest fines. The police says they've arrested almost 450 suspects on cyber scam activities since July. Officials say local laws are not useful in stopping cybercrime activity since there's no prison time for one-time or even repeat offenders. [PNTL on Facebook // OCCRP]

SMS blasters arrested in Manila: Philippine authorities have detained four suspects who drove with an SMS blaster device in a rented car across Manila. The device sent spam messages to nearby phones. The detained suspects included two Filipinos and two Chinese nationals. The Chinese men allegedly paid the Filipinos $32/day to drive around with the device. Authorities also found drugs, guns, and SMS blaster components at an apartment rented by the Chinese men. [CommsRisk]

PREY-0059 social engineering campaign: A threat actor is currently involved in a social engineering campaign that impersonates internal IT help-desk staff over Microsoft Teams, delivering Windows update-related files that infect users with a Java-based RAT. [Arctic Wolf]

Silent Ransom Group leaks: GuidePoint Security has published its own hot takes on the leaks of internal chats from the Silent Ransom Group from earlier this month. [GuidePoint Security]

Yahoo Boys adopt AI tools: Cyber scam groups operating across West Africa, commonly referred to as Yahoo Boys, have now adopted AI tools for their operations, mainly synthetic voice-cloning and face-swapping. [OpenMeasures]

New GhostAction campaign: A new cluster of 92 malicious GitHub Actions workflows linked to the GhostAction campaign have been found in the wild, with this one using fake font files to hide infostealer payloads. [OpenSourceMalware]

Malware in WP plugin: Versions of the Rank Math SEO Pro WordPress plugin downloaded between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC contained malware that backdoored WordPress sites. [Rank Math // Wordfence]

AI-powered infostealers: Infostealer developers are adopting AI technology to aggregate stolen data in extremely detailed victim profiles. The profiles are intended to help the buyers of stolen data in better understanding and breaching their victims. According to security firm BI.ZONE, the developers of Avengers and Bee Stealer have already developed AI profiling agents. [BI.ZONE]

TAG-217 targets South Korean banks: Recorded Future has published a profile on the hacking group that has used AI tooling to attack South Korean banks and financial institutions this month. According to the company, the group started assembling infrastructure for the hacks in mid-August. [Recorded Future]

Malware technical reports

HypeAgent: RT-Solar researchers have reverse-engineered HypeAgent, a new Windows RAT spotted in the wild. [Rostelecom]

QuartzLine (CLOUDHAZE): Researchers have published a teardown of a backdoor hidden in a fully-working PDF viewer. [Expel // RogueAuthority]

WebSockets backdoor: Security researcher dmpdump looks at a new backdoor suspected to have been used by an Iranian threat actor against Iraqi targets. [dmpdump]

Romulus: Forescout researchers have discovered a new web platform for automating the creation and delivery of ClickFix infection pages, going by the name of Romulus. [Forescout]

Sponsor section

In this edition of the Snake Oilers podcast, Sondera's Josh Devon talks about Sondera technology designed to intervene when AI models start doing the wrong thing by statefully tracking their trajectories. This isn't a permissions suite for AI agents, it's a way to stick agents in a harness and make sure they adhere to hard policy boundaries.

APTs, cyber-espionage, and info-ops

CL-UNK-1211 adopts AI tools: PAN's Unit42 has spotted a new cyber-espionage campaign that's adopted AI-developed tools for its operations. This campaign targeted Linux environments. [Palo Alto Networks]

ARMORY CASTLE abuses BeyondTrust zero-day: A Chinese hacking group has exploited a zero-day in BeyondTrust's Remote Support servers since August. The hackers elevated privileges, dumped credentials, and then pivoted to a victim's internal network. Google says the threat actor showed a deep understanding of BeyondTrust appliance internals during the intrusions. The group has been active since 2023 and is known to exploit vulnerabilities in edge appliances. [BeyondTrust blog // CVE-2026-102764 // Google]

Vulnerabilities, security research, and bug bounty

Security updates: Apache Airflow, BeyondTrust, Chrome, MOVEit, SiteGuard.

SiteGuard abuse: Threat actors are exploiting a recently patched vulnerability to take over SiteGuard web application firewalls. The attacks are exploiting an OS command-injection vulnerability tracked as CVE-2026-106931. [SiteGuard]

Apache Airflow failed host key verifications: The Apache Airflow team has patched two bugs that caused the server to disable SSH host key verification by default in its SSH and SFTP providers. [GitHub // Apache mailing list // Ox Security]

TP-Link Tapo camera: Two vulnerabilities can allow threat actors to take over TP-Link Tapo cameras. The first allows attackers to bypass authentication while the second can grant admin access over the device. TP-Link released patches for the two bugs, and four more, at the start of the month. [OPSWAT // TP-Link patches]

BlockStrap write-up: Sansec researchers have published a technical teardown of BlockStrap, a new CVSS 10 remote code execution bug in Adobe Commerce and Magento stores. This was patched last week. Still no attacks (yet). [Sansec]

Big Fish vulnerability: Calif researchers have found a memory corruption bug that affects every FreeBSD version ever released over the past 37 years. [Calif]

PhantomBuffer technique: Red teamer Two Seven One Three has discovered a new technique to evade EDR security solutions using the WriteProcessMemory API. [Zero Salarium]

PostgreSQL RCE: Varonis researchers have found a remote code execution bug in Snowflake-hosted PostgreSQL databases. [Varonis]

Infosec industry

Threat/trend reports: Check Point, Cisco Talos, CyberSN, Dashlane, Hacken, IBM X-Force, Intruder, N-Able, Red Hat, and Sonatype have recently published reports and summaries covering various emerging threats and industry trends.

US infosec job postings fell 25%: The number of cybersecurity job postings decreased by more than a quarter this year, down to 235,000 job listings from 320,000 last year. The vast majority of jobs are for defensive and blue team-related roles. Listings for AI security and data science engineers saw the biggest rise from last year. [CyberSN]

Acquisition news #1: Thoma Bravo-owned cybersecurity company Proofpoint will acquire enterprise security firm Varonis for $6.3 billion in cash. [Proofpoint // Varonis]

Acquisition news #2: Anthropic has acquired Opaque Systems, an AI security firm that rose from Berkley's research labs a decade ago. [Opaque Systems]

BalCCon 2026 videos: Talks from the Balkan Computer Congress 2026 security conference, which took place last month, are available on YouTube.

Risky Business podcasts

In this edition of Seriously Risky Business, Tom Uren and Amberleigh Jack talk about Russian targeting of Ukrainian data centres. That's not good, but it looks like Russia is very poorly prepared for Ukraine's retaliatory strikes. Karma!