OpenSight News: Security

OpenAI releases GPT-6 Cyber and rates its hacking skill as critical

Ari — Sat, 07 Nov 2026 00:00:00 GMT

OpenAI has released GPT-6 Cyber, a model built to find software flaws and write working exploits. It is the first model OpenAI rates as critical for cybersecurity under its own safety framework. Because of that rating, only vetted organisations in its Daybreak Red programme can use it. They must verify identity and meet strict account security rules.

On the ExploitGym benchmark, which tests turning known bugs into working attacks, the model succeeded in about 48 percent of tasks. Its predecessor managed about 32 percent. OpenAI also rates it high for biological and chemical risk. Safeguards include sandboxed use, monitoring for misuse, and blocking help against industrial control systems and essential services. The benchmark figures come from OpenAI itself and have not been checked independently.

Sources

GPT-6 Cyber System Card — OpenAI, 5 Nov 2026 (primary source)

OpenAI says its AI agents built working root exploits for 948 Linux kernel bugs

Ari — Fri, 06 Nov 2026 00:00:00 GMT

OpenAI says an unreleased AI model for cyber security built working root exploits for 948 different Linux kernel bugs. It did so in a single automated run in October that cost a little over one million dollars in compute. That is roughly 1,300 dollars per exploit. The company says the agents also found at least ten new attack techniques.

The pipeline first flagged about 2,300 possible bugs and confirmed about 1,700 of them. Security staff review every exploit and proposed patch before it goes to the kernel maintainers. OpenAI says hundreds of reports and fixes have gone out so far, starting with the most serious, and partners in its Patch the Planet programme are sending the rest. Its warning for operators is blunt. On an unpatched Linux system, any low-privilege access should be treated as close to full control for a capable attacker. The work shows how cheap exploit finding has become, for defenders and attackers alike.

Sources

A thousand fewer paths to root — OpenAI, 5 Nov 2026 (primary source)
OpenAI's upcoming AI model built 948 working Linux root exploits in a single run — Help Net Security, 5 Nov 2026
AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research — SecurityWeek, 5 Nov 2026

Ivanti patches two more Connect Secure zero days used in a root takeover chain

Ari — Tue, 03 Nov 2026 00:00:00 GMT

Ivanti has fixed two more flaws in Connect Secure, its VPN gateway. Attackers had already chained them with an earlier login bypass. Together the three bugs gave an attacker full root control, even on gateways that had all earlier patches. The attackers stole credentials, copied data, explored internal networks and wiped logs.

The fixed versions are 25.1.1.3 and 22.8R2.6. The US Cybersecurity and Infrastructure Security Agency, CISA, added both flaws to its list of exploited vulnerabilities on 1 November and gave federal agencies days to patch. Anyone running an older build should update now and check the gateway for signs of compromise, because a patch does not remove an attacker who is already inside.

Sources

Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain — SecurityWeek, 2 Nov 2026 (primary source)
Security Advisory Ivanti Connect Secure CVE-2026-104935 — Ivanti, 1 Nov 2026

US cyber agency confirms attacks on PHP2Shell flaws and sets a patch deadline

Ari — Mon, 02 Nov 2026 00:00:00 GMT

The two critical PHP flaws fixed on 21 October are now used in real attacks. The US Cybersecurity and Infrastructure Security Agency, CISA, added both to its catalogue of known exploited vulnerabilities on 26 October. Federal agencies had until 30 October to patch. The flaws let an attacker run code on a web server without logging in.

Researchers say attempts started about four days before the patches were out. Working remote shells were later seen on test servers set up to catch attackers. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Any server still on an older build of those lines should be treated as exposed. PHP 8.1 and older get no official fix.

Sources

CISA confirms PHP2Shell vulnerabilities now exploited in attacks — BleepingComputer, 27 Oct 2026 (primary source)
CISA confirms attackers are exploiting both PHP2Shell flaws — The Next Web, 27 Oct 2026

Google launches Gemini 4 Carbon for security work but only cyber defenders get it

Ari — Mon, 02 Nov 2026 00:00:00 GMT

Google has released Gemini 4 Carbon, a model built for software security. It can look for vulnerabilities, test whether they can be exploited and write a fix. Google calls it its strongest model so far. For now only selected cyber defenders can use it. Governments, critical infrastructure operators and large platforms come first, through a programme called Fairwind.

The limit has a reason. A model that finds and exploits flaws for a defender can do the same for an attacker. Google reports 88 percent on a benchmark for finding vulnerabilities and 71 percent on one for patching them. These scores are Google's own. The introductory price is two dollars per million input tokens and ten dollars per million output tokens, doubling later. No date for general access has been given.

Sources

Introducing Gemini 4 Carbon — Google, 28 Oct 2026 (primary source)
Gemini 4 Carbon cyber defenders — BetaNews, 28 Oct 2026

Hacktivists leak details of more than 41000 US Homeland Security staff

Ari — Mon, 02 Nov 2026 00:00:00 GMT

Records on more than 41000 current and former staff and contractors of the US Department of Homeland Security have been published online. The data includes names, work emails, phone numbers, job titles and group memberships. Some entries point to sensitive roles in surveillance, forensics and undercover work. A hacktivist group took responsibility and gave the files to a transparency nonprofit.

The group says it got in through a cloud single sign-on service used by the department. The identity vendor named in reports says it has no evidence its own systems were compromised. The department said it is aware of a potential breach and is working to address it. For any organisation, the case is a reminder that a single sign-on account opens every door behind it, so its access rights and logs deserve the closest watch.

Sources

DHS personnel leak exposes contact details and sensitive job information — Government Executive, 29 Oct 2026 (primary source)
Hackers leak personnel data of 41,000+ Homeland Security staff — Bitdefender, 30 Oct 2026

Binance loses about six billion dollars in the largest theft on record

Ari — Sun, 01 Nov 2026 00:00:00 GMT

Attackers stole about six point four billion dollars from Binance, the largest crypto exchange, on 29 October. It is the largest theft on record. The money left ten blockchains in about twenty minutes. On 31 October the US Federal Bureau of Investigation, the FBI, said a North Korean group known as TraderTraitor was behind it.

Binance said the attack started on an engineer's laptop, which gave access to a service container that could submit withdrawals. Blockchain analysts say about half of the assets have been frozen. The FBI has asked exchanges and other services to block hundreds of addresses tied to the stolen funds. For any team running infrastructure, the lesson is old but sharp: one developer machine with production reach is enough.

Sources

Binance Hack: Tracing the $6.4 Billion Theft to North Korea — Chainalysis, 30 Oct 2026 (primary source)
FBI confirms North Korea's role in $6 billion Binance hack — CoinDesk, 31 Oct 2026

A critical GitLab flaw patched in October is now being exploited in the wild

Ari — Sat, 31 Oct 2026 04:00:00 GMT

Attackers are exploiting a critical flaw in GitLab, the code hosting and CI platform. The US Cybersecurity and Infrastructure Security Agency, CISA, added it to its list of actively exploited vulnerabilities on 29 October. The flaw has the highest severity score of ten. An attacker without an account can run code on the server with a crafted regular expression in a pipeline configuration.

It affects GitLab Community and Enterprise Edition from version 19.2 up to the fixed releases 19.2.8, 19.3.4 and 19.4.2, which GitLab published on 12 October. US federal agencies must patch by 1 November and check for signs of compromise. Anyone running a self-managed GitLab server on those versions should update now and review pipeline configurations and logs for anything unexpected. GitLab.com is run by GitLab itself.

Sources

CISA Adds Two Known Exploited Vulnerabilities to Catalog — CISA, 29 Oct 2026 (primary source)
GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8 — GitLab, 12 Oct 2026

PHP patches two critical remote code execution flaws in all supported lines

Ari — Thu, 29 Oct 2026 12:15:00 GMT

The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, rated 9.2 under CVSS 4.0 in the advance notice. CVE-2026-109618 lets an out-of-memory condition leave request data half initialised, which cleanup code may then trust. CVE-2026-109619 lets internal state from one request outlive its memory and be reused by a later request on the same worker. Both can lead to remote code execution without authentication, and every setup that serves web requests is affected, with mod_php named as the highest risk.

The project says updating is the only complete fix; configuration changes such as disabling session upload progress only narrow the exposure. PHP 8.1 and older get no official release, although source backports exist. PHP 8.2 reaches end of life on 31 December 2026.

Sources

RCE via OOM corruption (CVE-2026-109618) — PHP project, 21 Oct 2026 (primary source)
RCE via stale global state (CVE-2026-109619) — PHP project, 21 Oct 2026
PHP news archive 2026, security advisory of 21 October — PHP project, 21 Oct 2026