GoKawiil
Tech News
OpenAI has disclosed a new cybersecurity-focused AI model, reportedly called Aardvark, that identified potential exploitation methods for close to 1,000 known flaws in Linux systems. The model is designed to analyze code and systems to surface vulnerabilities that could be exploited by attackers.
OpenAI announced GPT-6 Cyber, an AI model built for vulnerability research, which uncovered 81 unknown high-severity Firefox flaws and helped patch many of them. In Linux kernel testing, the model flagged 2,308 potential issues, reproduced 1,724 of them, and built privilege-escalation exploits for 948 distinct bugs. OpenAI rated the model's cybersecurity capability as 'Critical,' up from 'High' for its predecessor, and restricted access to select customers in its Daybreak Red program.
Apple has released the first release candidates for macOS Sequoia 15.8.3 (build 24H314) and macOS Tahoe 26.7.3 (build 25G416), alongside the first developer beta of macOS 27.3. The RC release notes cite only security fixes without specifying vulnerabilities, continuing a pattern seen last week when 15.8.2 and 26.7.2 patched over 150 security issues.
Microsoft's newly released Digital Defense Report warns that government agencies are prime targets for AI-driven cyberattacks. The report does not mention that many of these attacks have exploited vulnerabilities in Microsoft's own software.
CISA added CVE-2026-97229, a maximum-severity GitLab vulnerability, to its Known Exploited Vulnerabilities catalog after confirming attackers are exploiting it in the wild. The flaw, an integer overflow in GitLab's regular expression compiler, lets unauthenticated attackers run arbitrary code via crafted CI/CD configurations; GitLab patched it in versions 19.4.2, 19.3.5 and 19.2.8 earlier this month.
Mozilla released Firefox 159 for Windows, MacOS, Linux and Android, fixing 167 security bugs, 108 of them rated high severity, many involving use-after-free memory flaws and sandbox escapes. Google separately issued a Chrome update patching 52 vulnerabilities, including four critical ones. Firefox 159 also adds new features such as a MacOS share picker and sidebar access to saved passwords.
CISA added CVE-2026-46300, a Linux kernel privilege-escalation bug dubbed Fragnesia, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by Saturday. The flaw, found in the XFRM ESP-in-TCP subsystem, grants root access and can reportedly be chained with two critical PHP vulnerabilities known as PHP2Shell to install webshells on unpatched systems.
Researchers at Calif and Wiz, aided by OpenAI and Google models, discovered two remote code execution vulnerabilities in PHP dating back to 2012, now dubbed PHP2Shell. Amazon detected exploitation attempts days before PHP's October 21 patch, and attack traffic kept climbing afterward, prompting CISA to add both flaws to its known exploited vulnerabilities list on October 26. Industry data cited shows median fix times for known exploited bugs run 21 to 43 days, far slower than the pace at which attackers are now acting.
Tailscale says its security and engineering teams, aided by outside specialists, have found multiple vulnerabilities in Tailscale SSH, most involving privilege escalation that could let an already-authorized user act beyond their configured permissions. The company has fixed most issues and is targeting a patched client release by the end of Tuesday, October 27, while continuing to assess remaining findings.
Following last week's discovery of two major PHP vulnerabilities by a team using an OpenAI model, engineers worldwide rushed to patch websites, with some European government sites temporarily going offline during updates. Reuters reports that the PHP Foundation, the nonprofit responsible for coordinating security fixes for the software powering roughly 70% of websites, has only one full-time staff member, Executive Director Elizabeth Barron, supported by about 14 part-time contractors.
Security researchers disclosed three separate TLS flaws in GoAhead, an embedded web server used for device management in hundreds of millions of IoT, OT, firewall and military devices from vendors including Palo Alto Networks, D-Link, Siemens and Lockheed Martin. The bugs affect GoAhead's OpenSSL-compatible, LibreSSL and Mbed TLS backends, allowing revoked client certificates to be accepted, encrypted sessions to potentially be decrypted, or certificate chain-depth limits to be bypassed depending on configuration. GoAhead version 6.1.1 fixes all three issues, with additional mitigations available for affected deployments.
Wiz Research is monitoring activity related to two PHP vulnerabilities disclosed on October 21, 2026, dubbed PHP2Shell. The firm says it has seen only limited exploitation attempts in its telemetry and no public proof-of-concept for complete end-to-end attacks, though some partners have privately shared working exploits. Wiz reports internet-exposed vulnerable machines dropped about 67% in days following disclosure, and affected organizations fell roughly 47.9%.