TL;DR for CISOs: Researchers showed that a single planted AGENTS.md or CLAUDE.md file can steer an AI coding agent into running malware or leaking a login token, and the exposure comes from where agents are launched, not from a patchable bug. PHP2Shell attempts continue without confirmed mass compromise, Tailscale SSH has 11 unpatched lab findings, and CISA added two exploited flaws to its KEV catalog.
- Coding agents act on instructions found in the folder they open. Treat the launch directory as a trust boundary, and keep agents out of Downloads and home directories.
- Public disclosure is a late marker. Amazon reports PHP2Shell attempts four days before patches, so review logs from before October 21, not only after.
- An unpatched finding with no vendor bulletin, like Tailscale SSH, still calls for configuration changes today: narrow access rules and switch off features you do not use.
Today's slate at a glance
| Story | Severity | Who is exposed | First action |
|---|---|---|---|
| AI coding agents hijacked through a planted instruction file | High | Teams whose developers run Codex, Claude Code or similar agents from broad folders | Inventory agent launch directories and scan for unexpected AGENTS.md and CLAUDE.md files |
| PHP2Shell: exploitation attempts continue | Critical | Any internet-facing host running unpatched PHP | Confirm PHP is at a fixed release and review logs back to October 17 |
| Tailscale SSH: 11 unpatched findings (Tailworm) | High | Tailnets using Tailscale SSH with port forwarding, and headscale users | Tighten SSH rules and disable port forwarding where possible |
| CISA KEV: Collabora Online and Arista VeloCloud | High | Nextcloud servers with Collabora CODE; on-prem VeloCloud Orchestrator | Check versions against the fixed releases |
Lead story: a planted instruction file can steer an AI coding agent
HIGH · AI AGENT SECURITY / PROMPT INJECTIONKey facts
| Item | Detail | Status |
|---|---|---|
| Discovery | Forever Security found an AGENTS.md file in a customer's Downloads folder that told a coding agent to install an npm package named function-color. The firm stopped the agent before any code ran | Reported by researchers |
| Package link | THN says the package is tied to the MALFEX malware campaign previously documented by CloudSEK and Checkmarx | Reported by THN |
| Reproduction: OpenAI Codex | In an isolated VM the file led Codex to register a malicious server in its config and run the malware in more than 90% of attempts | Researcher test |
| Reproduction: Claude Code | A planted CLAUDE.md tried to redirect API traffic to an attacker-controlled endpoint, which would leak the session token. It worked about half the time | Researcher test |
| Delivery path | The researchers could not tell how the file reached the customer. They built a proof of concept showing a web page can drop a file into Downloads. No real-world use of that path is confirmed | Unconfirmed in the wild |
| Vendor position | Forever says the agents behaved as designed and there is nothing to patch. Neither source reports a vendor fix | No patch reported |
What happened
Forever Security, an application security firm, found a file called AGENTS.md sitting in a customer's Downloads folder. Coding agents load instruction files from the directory they start in, so an agent launched from that folder read the file and tried to install a malicious package. The firm intervened before anything executed and then rebuilt the scenario in a lab against two products.
The result matters less as a product bug than as an operating pattern. Browsers write files to Downloads by default, and developers often start agents in whichever terminal folder is open. Forever's own telemetry shows agents are launched from Downloads in practice.
Evidence
- BleepingComputer: AI coding agents hijacked using AGENTS.md file in Downloads folder (October 25, 2026)
- The Hacker News: Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware (October 26, 2026)
What this means for your team
Your developers have probably granted agents permission to read files, edit code and run commands. An instruction file is effectively a policy document the agent obeys, and any process that can write to the launch folder can author it. That makes the agent's working directory a privilege boundary, even though most teams have never set it up as one. The same logic covers cloned repositories, since they can ship their own instruction files.
Action checklist
- Ask engineering where coding agents are launched. Block or discourage Downloads, home directories and broad parent folders as working directories.
- Search developer workstations and repos for AGENTS.md, CLAUDE.md and similar files that nobody on the team wrote, and review agent config files for unfamiliar server entries or changed API base URLs.
- Keep approval prompts and sandboxing switched on, and write that into your AI usage standard.
- If a planted file is found, rotate the agent session tokens and any credentials in that user's environment.
PHP2Shell: exploitation attempts continue, mass compromise not confirmed
CRITICAL · WEB SERVER / REMOTE CODE EXECUTIONKey facts
| Item | Detail | Status |
|---|---|---|
| Flaws | CVE-2026-109618 and CVE-2026-109619, both scored 9.2 (CVSS 4.0) by Unit 42, allow remote code execution in PHP | Confirmed |
| Fixed releases | Cybersecurity Dive lists PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, followed by a service restart | Reported |
| Earliest attempts | Amazon says attempts against its honeypot began October 17, four days before the October 21 patches. It has not determined whether they would have worked on real systems | Reported by Amazon |
| Scale of success | Mandiant's Charles Carmakal sees no evidence of widescale successful exploitation. VulnCheck says most public proofs of concept fail to complete the chain | Researcher assessments |
| Reported intrusion | Unit 42 describes a European government entity where an attacker reached password hashes and MFA secrets within two hours and tried to escalate to Domain Admin. The brief does not name PHP2Shell as the entry point | Link implied, not stated |
| Attribution | CYFIRMA assesses with moderate confidence that a suspected North Korea-linked campaign is scanning for PHP2Shell targets. This is an assessment, not confirmed attribution | Claim |
What happened
Details of the flaws leaked on October 20, and PHP shipped patches on October 21. Since then, researchers have logged heavy scanning and exploit attempts, including a botnet variant, but their views on success rates differ. Unit 42 has since updated its brief with a post-exploitation case in which the attacker moved quickly against a government network. The sources agree that patching is the lasting fix.
Evidence
- The Hacker News: PHP2Shell exploitation attempts continue (October 25, 2026)
- BleepingComputer: Amazon says PHP2Shell exploitation began 4 days before patches (October 22, 2026)
- Cybersecurity Dive: PHP exploitation slower than expected (October 23, 2026)
- Palo Alto Networks Unit 42 threat brief (updated October 23, 2026)
What this means for your team
The debate over how much exploitation has succeeded should not slow your patching. The useful signal for a CISO is the timeline: probing started before any patch existed, so a clean post-patch log tells you little about the earlier window. Exposure also hides in places that are easy to overlook, such as marketing sites, legacy portals and appliances that bundle PHP.
Action checklist
- Build a list of every internet-facing system that runs PHP, including vendor-managed ones, and confirm each is at a fixed release.
- Review web and error logs from October 17 onward for POST requests returning 500 errors and for memory exhaustion or crashed web workers.
- Rotate keys and passwords stored on exposed hosts that were unpatched during the window.
- For any suspected hit, hunt for web shells and for lateral movement toward Active Directory.
Tailscale SSH: 11 unpatched findings published by a researcher
HIGH · REMOTE ACCESS / LATERAL MOVEMENTKey facts
| Item | Detail | Status |
|---|---|---|
| Report | Erica Windisch of Cyberdione Labs published "Tailworm" on October 25, 2026, covering 11 findings in Tailscale and headscale | Published by researcher |
| Versions tested | Tailscale 1.104.2 and headscale 0.29.5, in a lab | Lab results |
| Main issue | With Tailscale SSH port forwarding enabled, a device already allowed to reach a target could obtain root on it, then capture an enrollment key | Not confirmed by Tailscale |
| Preconditions | Attacker needs one approved device and an existing SSH access rule. This is lateral movement, not internet-facing code execution | Per report |
| Vendor response | Tailscale says it is examining the same areas with outside specialists and does not recommend everyone disable Tailscale SSH. No bulletin, CVE or fixed version exists yet | No patch |
| Disclosure | The researcher says the issues were reported but not coordinated. Some commenters dispute the "wormable" label | Contested |
What happened
The report describes tests run October 22 to 24 on unmodified releases. Besides the SSH forwarding problem, it lists issues in experimental app connectors, a serve feature, the DERP relay and headscale. Tailscale has acknowledged the report and says it is working on fixes but has not confirmed the specific claims, and we found no independent reproduction.
Evidence
- The Hacker News: Unpatched Tailscale SSH flaws could let a hacked device reach root on other servers (October 25, 2026)
- SC Media: Security researcher identifies potential privilege escalation in Tailscale SSH (October 25, 2026)
- pwn.watch: Tailworm summary (October 25, 2026)
What this means for your team
Overlay networks are often treated as a trusted flat layer once a device is enrolled. This report, if it holds up, is a reminder that SSH access rules decide how far one compromised laptop can travel. You do not need to wait for a bulletin to shrink that radius, and doing so costs little.
Action checklist
- Find out whether your organization runs Tailscale or headscale, including shadow use by engineering teams.
- Rewrite SSH rules as narrow source-to-destination pairs and remove broad identity or tag grants.
- Disable SSH port forwarding where the platform allows it, and remove app connector permissions from devices that do not need them.
- Turn on node-key expiry and Tailnet Lock where available, and delete a compromised device at the control plane instead of only reimaging it.
CISA adds Collabora Online and Arista VeloCloud flaws to KEV
HIGH · ACTIVELY EXPLOITEDKey facts
| Item | Detail | Status |
|---|---|---|
| CVE-2026-110447 | Collabora Online built-in CODE server used with Nextcloud, OS command injection, CVSS 9.2. Fixed in version 26.4.303. Attackers planted web shells on Nextcloud servers and searched for credential stores | Exploited per THN; CISA KEV |
| CVE-2026-114625 | Arista VeloCloud Orchestrator on-prem, SQL injection, CVSS 9.9 per THN. Fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12. Arista says it is known to be actively exploited | Exploited per Arista; CISA KEV |
| Deadline | THN reports CISA added both on October 23 with a federal remediation date of October 26 | Reported |
| Attribution | Arista has not attributed the activity or disclosed the number of affected organizations. It listed two IP addresses | Unknown |
What happened
CISA put both flaws in its Known Exploited Vulnerabilities catalog on Friday. The Arista flaw needs a valid authenticated session at a low role, while the Collabora issue can be reached over the web interface. THN reports this is the third VeloCloud Orchestrator flaw exploited since July 2026.
Evidence
- The Hacker News: CISA flags two actively exploited critical flaws (October 24, 2026)
- BleepingComputer: Arista patches new VeloCloud Orchestrator zero-day (October 22, 2026)
- Cyware Daily Threat Intelligence (October 24, 2026, Collabora entry)
What this means for your team
Both products sit behind a login or inside a collaboration stack that teams often deploy and forget. A KEV listing is the point where regulators, insurers and auditors start asking whether you knew. Check that your asset inventory covers these systems.
Action checklist
- Confirm whether Nextcloud with Collabora CODE or on-prem VeloCloud Orchestrator runs anywhere in your estate, including managed service providers.
- Upgrade to the fixed releases, and until then restrict the Orchestrator web interface to administrative networks.
- Review web access logs and recent administrator activity, and block Arista's published indicators.
Also notable
- BlackX UEFI bootkit: a bootkit that bypasses Secure Boot on Windows systems missing certain revocations, reported against diplomatic targets in Central Asia. BleepingComputer
- Microsoft 365 token replay: 97 accounts at 79 organizations compromised through session-token replay, per THN. The Hacker News
- Brotli decoder flaw (CVE-2026-111497): the bug behind a Node.js remote code execution also affects Bun, Python and other software. The Hacker News
- LiteLLM release pipeline: a leaked master key let attackers steal GitHub tokens and publish malicious packages. The Hacker News
- Quest Diagnostics: the company confirmed patient records were exposed through its Quanum lab ordering platform, and scope is still being determined. BleepingComputer
Frequently asked questions
Is the AGENTS.md attack being used in the wild?
Forever Security found one real file in a customer folder, but could not tell how it arrived. The web-page delivery path was shown only in a proof of concept.
Is there a patch for the coding-agent issue?
Neither source reports one. The researchers say the agents behaved as designed. OpenAI and Anthropic guidance, as quoted by BleepingComputer, is to run agents from the specific project directory.
Which PHP versions fix PHP2Shell?
Cybersecurity Dive lists 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Confirm against the official PHP security advisory before rolling out.
Has PHP2Shell caused mass compromise?
Not confirmed. Mandiant reports no evidence of widescale successful exploitation, while Unit 42 documents at least one government intrusion with an implied link to the flaws.
Should we disable Tailscale SSH?
Tailscale says it is not recommending that everyone do so. The report suggests narrowing access rules and disabling port forwarding where possible.
Where can I follow more breach analysis?
The CISO Platform Breach Intelligence hub carries each daily edition, and the weekly newsletter summarizes the week.
Related CISO Platform briefings
- Breach Watch: PHP2Shell critical PHP flaws (October 21)
- Breach Watch: Railway secrets exposure, Capcom, PwC (October 22)
- Breach Watch: ConnectWise backup abused in Microsoft 365 (October 20)
- Breach Intelligence hub: all daily editions
Curated by Pritha Aash, Community Head, CISO Platform
Join the CISO Platform community (free)
Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.
Comments