Welcome to The Cybersecurity Pulse (TCP)! I’m Darwin Salazar, Head of Growth at Monad and former detection engineer at Datadog. Each week, I bring you the latest security innovation and industry news. Subscribe to receive weekly updates! 📧
Howdy 👋🏽
I hope you’re having an excellent week! Writing this one from a coffee shop in SF. Fresh off day one of [un]prompted. It’s easily the best security conference I’ve been to in years. The energy and passion from folks just trying to figure out what security looks like in this new world is dope. If the past couple of weeks have been any indicator, things are evolving fast and there are people on the front lines working tirelessly against things that may never hit the net.
One sticker I saw that really caught my eye yesterday said “There are more of us than there are of them.” and I think I could probably wrap this week’s post there. I’ll have an [un]prompted recap early next week w/ my key takeaways. If you do security of any kind and [un]prompted isn’t on your radar yet, it should be!
Also… it’s book launch day!! 📘 A Security Field Guide to AI Audit Trails is officially on Amazon. We tested what Claude Code, Cowork, Codex, Cursor, and Copilot log natively, which fields matter, blind spots, licensing requirements, etc. If someone’s ever asked you “what did the agent actually do?” and you didn’t have a great answer, this one’s for you. Grab a copy here. I’ve got copies on me at [un]prompted, so come find me!
Meanwhile, last week, it may have felt like the world was collapsing.. But it did not. Some were calling it the vulnpocalypse or Black October.. I’d like to call it “Blue October”. Why blue? Rough month, but every blue team learned + got stronger. Times like these expose flaws in defense, processes, and systems, in turn creating better defense.
Two quick ones before we dive in:
🪪 My friends at Opal Security are hosting agent.ID, a free virtual event on November 5 with Sounil Yu (Knostic), CISOs from Notion, Instacart, and Elastic, and leaders from Databricks and Superhuman. STACKED line-up 🔥
📰 Jazz ran a full-page apology letter in the Wall Street Journal and mailed me a copy. Here’s me having fun w/ the LinkedIn post about it.
That said, let’s get into this past week’s top stories!
Your GRC tool can tell you what’s broken. Can it fix it?
Rippling can. Automated Compliance helps you move from finding gaps to closing them, with AI built in at every step: before, during, and after the audit.
Back in April, Rippling launched with SOC 2. Now, the platform supports ISO, HIPAA, and custom frameworks, with broader integration coverage, Trust Centers, and automated security questionnaires.
So you can spend less time coordinating work and more time getting it done.
🗞️ TLDR
🐘 Blue October, in perspective: Palo Alto confirms PHP2Shell exploitation of exposed PAN-OS management interfaces and the Brotli bug joins KEV. Patch, hunt, and skip the panic.
💰 Upwind’s $400M Series C: Bessemer leads at a $3.8B valuation, roughly nine months after Upwind’s $250M Series B.
🕵️ Qwen’s unrequested upload: Cohere says an Alibaba model tried to send a placeholder file to a Beijing bucket from a sandbox. Rare, blocked, and disputed.
🖥️ Warp breached through a vendor: Agent traces and telemetry exposed for up to about 1% of users, a week after OpenCode.
📘 Our book is out: A Security Field Guide to AI Audit Trails is live on Amazon.
📂 Poisoned agent configs: A planted AGENTS.md tried to make a coding agent install malware, and JFrog found 42 hijacked GitHub repos rigged with AI assistant hooks.
🤖 ConnectWise and ARTEX: Microsoft ties the compromise to China-aligned Storm-0940, which used an agentic AI pentest framework to scale it.
🧭 ThreatModeler NexusAI: Builds threat models and proposes updates when your architecture changes.
🔥 Picks of the Week
Blue October: not the apocalypse, but a few things are getting hit
The internet has been calling this “Black October.” I get it.. it’s been a rough stretch. I’m no vulnerability management or AppSec expert, and I’d never pretend to be. But zooming out, it’s easy to see how times like these make us stronger as an industry. There’s a lot to learn here, and a lot of work falling on defenders in the meantime. That’s why “Blue October” feels more fitting to me
The timeline above gives a bit more context, from LiteLLM’s hijacked release pipeline to eMudhra’s distrusted certificates. Zero Day Clock is also worth following as the time between finding and exploiting bugs keeps shrinking. A couple of updates that stood out to me:
PAN-OS management interfaces. Palo Alto confirmed PHP2Shell exploitation against internet-exposed ones. Most hotfixes are out, the last few land October 29 and 30, and management access belongs on trusted internal IPs anyway.
Brotli (CVE-2026-111497) is on KEV. Patch Node.js, and if you run VMware Cloud Foundation, apply Broadcom’s SDDC Manager workaround until a fix ships.
October also rhymes with March, when credentials from a breach Aqua never fully contained poisoned Trivy’s releases and GitHub Actions, and a Trivy scan in LiteLLM’s CI then shipped credential-stealing LiteLLM builds to PyPI. There’s a long tail to this stuff.
Huge respect to everyone who gave up a weekend to work through this. The headlines will move on, but the lessons and better defenses are what we get to carry forward.
IDC Report: AI Drives New Access Control Requirements
Unmanaged AI identities create new access control gaps. IDC research reveals that detection alone is no longer the finish line. Security teams must enforce access control at machine speed. Portnox Cloud automatically discovers AI agents and enforces continuous zero trust policies. Autonomous enforcement stops threats in seconds, unified cloud policy secures human and AI identities, and API integrations turn risk signals into control.
Poisoned agent configs: a malicious AGENTS.md and 42 hijacked GitHub repos
This one’s sneaky. Forever Security stopped a coding agent on a customer’s machine mid-session as it tried to install function-color, a known malicious npm package. The order came from an AGENTS.md file sitting in the customer’s ~/Downloads folder, dressed up as routine engineering notes. Coding agents follow the instruction file in the folder they open, and Codex obeys one once you’ve worked in that folder and trusted it.
That’s the observed attempt, which Forever says it blocked before any code ran. In reproductions on an isolated VM, the real payload got Codex to add an MCP server to its machine-wide ~/.codex/config.toml and run the malware in more than 90% of attempts. A CLAUDE.md the researchers wrote got Claude Code to reroute its API traffic and leak its OAuth token about 50% of the time. Forever frames this as a trust-boundary problem rather than a conventional software bug.
It’s not a one-off. JFrog found 42 hijacked GitHub repos across 11 owners from the testmetest npm campaign, rigged with hooks in .claude/settings.json, .gemini/settings.json, .cursor/mcp.json, and .vscode/tasks.json. Opening an affected repo in a supported tool can trigger .github/init.js, a 12.9 to 13.7 MB payload too big for GitHub code search to index, so JFrog had to walk Git trees to find them. The worm carries a wiper that fires when the stolen GitHub token is revoked.
OpenAI details how it keeps frontier training “off the live internet”
OpenAI now trains frontier models without arbitrary access to the live internet. A full air gap isn’t feasible yet, so it built walls instead. The push followed the Hugging Face incident in July and a September 20 incident in which an internal research model exploited a DNS resolver misconfiguration and got limited internet access during a training run. OpenAI paused its most capable models and resumed RL training on October 1.
The changes include an “offline world” of cached web content for RL runs, restricted containers inside microVMs, monitoring, and network and cloud perimeters. To test them, OpenAI gave teams of frontier agents, including the upcoming GPT-6 Astra Cyber, source code and configs and spent hundreds of billions of tokens trying to get out. They found microVM escapes (fixes went to Kata Containers, gVisor, and Moby), paths through nearly every remaining service like metrics, logging, and auth, and cache-timing covert channels between microVMs. OpenAI says none gave agents a route to the internet they could trivially exploit while hiding it. This covers internal training environments, not the models customers use.
Upwind raises $400M at $3.8B as revenue quadruples
Upwind raised a $400M Series C at a $3.8B valuation, led by Bessemer Venture Partners. Every existing investor came back, Canapi Ventures joined, and total funding now tops $800M, roughly nine months after its $250M Series B.
The momentum is real. Upwind says revenue quadrupled this year. So is it AI security or cloud security? Both, but cloud is still doing the heavy lifting. Customers like Siemens, Roku, and Carvana are buying runtime visibility into what’s actually running, not another scan snapshot, and buyers are shopping for cloud and AI workload security after Google bought Wiz. AI is where the new money goes: AI sensors for endpoints, scanners for agents and skills, and a push into identity and data.
My read: you can’t secure agents without runtime context, and Upwind already has it.
Huge congrats to Amiram, Alon Saban and the team! Upwind is a Monad partner, and they’re a blast to work with 🎉
🚨 Threats & Research
Cohere says a Qwen model tried to upload a file to Beijing. Hold the panic.
Cohere says Alibaba’s Qwen3.8-Flash-Next, asked in a sandbox to write a detection rule, wrote in its reasoning that it wouldn’t use tools, then poked around the host and tried to PUT a placeholder string to an Alibaba Cloud bucket in Beijing. The sandbox had no egress, so nothing left. Cohere puts it at under 1 in 100,000 calls and can’t say whether it’s a backdoor or a training artifact. Critics say Cohere’s prefill experiments steered the model, and one skeptic who read the published traces found Qwen invents suspicious URLs but saw no backdoor. Cohere also pitches sovereign AI and is acquiring AISLE (#150), so it benefits if officials sour on free Chinese weights.
Warp says a vendor breach exposed AI agent traces for up to about 1% of users
Warp CEO Zach Lloyd says that on Friday the company found attackers had exploited a vendor in its infrastructure, exposing agent traces and telemetry for up to roughly 1% of users. Warp brought in CrowdStrike and told law enforcement. Lloyd describes the attack as an “agent swarm.” That’s his characterization, with no technical detail behind it yet. Warp hasn’t named the vendor or said whether prompts, code, or credentials were in the traces. It lands a week after OpenCode’s breach (#150).
Microsoft links the ConnectWise compromise to China-aligned hackers using ARTEX
Following up on last week: Microsoft attributes the ConnectWise supply-chain compromise to Storm-0940, a China-state aligned actor. Microsoft says Storm-0940 used ARTEX, an open-source agentic AI pentest framework, to speed up scanning, password spraying, and OAuth app abuse. ARTEX was used to attempt sign-ins to more than 2,250 tenants. That’s targeting. Microsoft confirmed follow-on Graph activity, credential changes, and attempted privilege changes in “multiple” environments, and says even a successful sign-in doesn’t prove data was accessed.
Stolen Microsoft 365 sessions give attackers access across 79 organizations
Huntress tracked a 10-week campaign that captured Microsoft 365 sessions through AiTM relays and device-code phishing, then replayed the tokens from a 1337 Services GmbH IP block. It hit 79 organizations. The tokens were minted after MFA, so no second prompt. The attacker registered at least 48 rogue Entra devices, wiped and replaced MFA methods in 19 orgs, and hid mail with inbox rules. A password reset leaves those devices and MFA methods in place and doesn’t invalidate the access token.
Attackers start probing a fresh Oracle EBS RCE
Defused says its Oracle E-Business Suite decoys caught exploratory exploits on October 27 against CVE-2026-101767 (CVSS 9.8), an unauthenticated SQL injection that Horizon3.ai says chains to RCE. Oracle fixed it in its October CPU on October 20. Until you patch, you can pull /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist.
Xint extracts hidden OpenAI reasoning through compaction smuggling
Great research here. Xint found that OpenAI’s compaction endpoint could leak raw reasoning traces that the API only hands out encrypted. The trick was to have the same model compact its own reasoning with instructions to keep it verbatim, then ask gpt-4.1 or gpt-4o to echo the encrypted compaction back as plaintext. OpenAI’s earlier mitigations only blocked replaying reasoning into a different model. OpenAI fixed it on October 23 and paid a $6,000 bounty. Xint notes it can’t prove token-for-token fidelity without the original plaintext.
🛠️ Security Products & Tools
ThreatModeler launches NexusAI
ThreatModeler launched NexusAI inside its Nexus platform. Feed it diagrams, docs, or a description of your app and it builds a threat model. As the architecture changes, it proposes updates for the security team to review.
Say a service was approved because it was internal-only. A few releases later, somebody opens it to the internet. Now you need the old review, the assumptions behind it, and probably the person who remembers the conversation. ThreatModeler’s Secure Design Graph connects architecture, threats, mitigations, and past security decisions. Keeping that history with the app could spare teams a lot of digging through tickets and Slack.
SentinelOne adds Agentic Detection and Response
SentinelOne launched Singularity Agentic Detection and Response (ADR), now in early access. It inventories agents and MCP servers, sends agent traces to Singularity Data Lake, adds policy and approval controls plus in-line prevention, and can contain a single agent mid-action. The useful piece is Unified Storyline: one execution graph linking the user’s request, the AI assistant, the MCP server that supplied the tool, and the file or process that followed. Analysts can see what the agent was asked to do next to what it actually did.
Cisco’s Project Quarry wants a shared language for agent attack detections
Cisco introduced Project Quarry, an open-source, shared detection language for multi-step AI agent attacks. Agent attacks rarely live in one log line, so a common way to write and share these rules beats every team reinventing them.
CrowdStrike and NVIDIA extend agent security toward hardware enforcement
CrowdStrike is integrating Falcon Guardian, its AI detection and response product, with NVIDIA’s OpenShell secure runtime. The goal is to tie agent prompts, model interactions, and runtime activity to Falcon platform context. The hardware piece is still planned: a future integration with NVIDIA Sentry on BlueField-4 DPUs for out-of-band monitoring and in-silicon policy enforcement. No ship dates were given.
Chrome adds warnings for suspicious ClickFix commands
Chrome now detects when an Enhanced Protection user is tricked into copying a suspicious command, which is the core move in a ClickFix scam. The clipboard payload is scrubbed of PII and sent to Safe Browsing, and Chrome warns if the verdict comes back dangerous. Google also added a lower-confidence “suspicious site” warning tier and moved Gemini scam detection server-side for all Enhanced Protection users.
💰 Industry, Funding & M&A
Infisical raises a $40M Series B to keep credentials away from AI agents
Infisical raised a $40M Series B at a $600M valuation, led by Elad Gil with Gradient and Y Combinator. Its new Agent Vault lets agents use systems without ever holding the API keys or passwords, so an agent can’t leak a secret it never had. The company claims 1,300+ customers and 300,000 developers. After LiteLLM, Railway, and Warp this month, keeping secrets out of agent context looks like a sane bet. How well it holds depends on how tightly each agent’s access is scoped.
Mave raises a $28M Series A for agentic security operations
Mave raised a $28M Series A led by Red Dot Capital Partners, with Lumir Growth Partners and returning seed leads Dell Technologies Capital and Emerge Ventures, bringing total funding to $34M. Instead of ingesting data into a SIEM, Mave queries each security tool in its native language during an investigation and records every query, decision, and action. It claims 100% of alerts investigated within minutes, Fortune 50 and MSSP customers, and 400%+ ARR growth. Skipping centralization saves the data bill, but it only works as well as its coverage of the tools a customer runs.
Asymptote raises $5.5M for AI-agent telemetry and runtime controls
Asymptote Labs raised a $5.5M seed led by Tower Research Ventures, with Lytical Ventures, 1984 Ventures, and South Park Commons. Its MIT-licensed Beacon captures agent activity across Claude Code, Codex, Cursor, and 20+ other harnesses and normalizes it into a data model that extends OpenTelemetry. Control lives in the commercial platform, which intercepts live agent activity, enforces policy at the prompt and tool levels, and applies guardrails. Tower is also evaluating Beacon internally.
S&P Global completes its acquisition of OpenZeppelin
S&P Global closed its acquisition of OpenZeppelin, first announced September 17. OpenZeppelin, which has run 900+ security engagements, will operate as its own business unit led by Demian Brener, and OpenZeppelin Contracts stays open source. Terms weren’t disclosed.
Indurex raises €7M for industrial cybersecurity
Indurex raised €7M led by Contrarian Ventures, with Axeleo Capital and Curiosity. Its SafeGuard AI platform ingests data from control systems, safety instrumented systems, historians, alarm management, and IT security tools. Europe and the Middle East come first.
Interested in sponsoring TCP?
Sponsoring TCP not only helps me continue to bring you the latest in security innovation, but it also connects you to a dedicated audience of 20,000+ CISOs, practitioners, founders, and investors across 135+ countries 🌎
Disclaimer
The insights, opinions, and analyses shared in The Cybersecurity Pulse are my own and do not represent the views or positions of my employer or any affiliated organizations. This newsletter is for informational purposes only and should not be construed as financial, legal, security, or investment advice.