OpenAI shipped its cybersecurity model and the workload that proves it in the same week: GPT-6 Cyber powered the pipeline that validated and patched 948 Linux privilege-escalation flaws for about $1.2 million in API credits. On the other side of the ledger, Chainalysis disclosed that password hashes and live session tokens for all of its users were exposed to an attacker whose only public description is a phrase the company never defined. Anthropic explained why it will not fix the cross-machine Claude Dispatch hole it has known about since May, Sekoia mapped an SVR watering-hole campaign that hunts phones through already-patched devices, and the European cold-chain attacks reached France’s blood service. Zyxel’s June firmware fixed the sibling of the bug its attackers actually used, Japan announced a funded national cyber package, and Anthropic’s amended IPO filing turned “recursive self-improvement” into official risk language while Tencent’s launch post sold the same idea as a roadmap. On the cloud side, Google donated its agent runtime stack to the CNCF ahead of KubeCon, and AWS turned Hive-to-Iceberg migration into a managed job. Security leads, then everything else.

OpenSSH shipped an emergency release one day after learning of the bug, with Damien Miller telling musl-libc operators to disable password auth IMMEDIATELY. CVE-2026-123158 at CVSS 8.1 lets an attacker log into any passwordless account with a single sent password, first connection, every time. glibc distributions and PAM-using systems are not affected, which is why your Ubuntu fleet is safe. Your Alpine containers with an sshd inside are another matter.

One bug in a shared library owned the week. A buffer overflow in Google’s Brotli decoder was fixed in the library’s source in February, never released as an update, and spent the rest of the year bundled inside every runtime that links it. This October the catch-up finally ran: coordinated patches across Node.js, Python, Go and the proxy tier, and Microsoft shipped out-of-band .NET fixes on October 25. A 16-year-old UEFI vulnerability surfaced the other way, through a broken embargo. A campaign running on stolen GitHub tokens planted more than 13,500 secret-dumping workflows. Binance lost $6.3 billion to a compromised laptop in 20 minutes. Both sides of the exploit pipeline ran on models this week: Anthropic published a kernel root exploit written by Claude, Epoch AI pushed a Z.ai open-weight model through published-but-unshipped Firefox fixes at about $1,000 a target, AWS made machine-speed vulnerability remediation generally available, and Google gated its new cybersecurity model to defenders first. Security leads, then the rest.

Two Mondays ago this bug led our patch notes. This week CISA put it in the KEV catalog, Alpine disclosed how close the attackers got, and the fix turned out to be a Ruby build change a GitLab version string cannot prove.

The release pipeline of LiteLLM, the model-gateway library, was emptied with three engineers’ stolen GitHub tokens. The operators of an open-source AI pentest platform left their control panels answering on the open internet, complete with target lists and API keys. The platforms that hold agent secrets for a living spent the week telling everyone to rotate everything. The CVE drumbeat stayed loud enough that this blog ran four special bulletins between Tuesday and Friday (PHP2Shell, the eMudhra CA compromise, the ATS and Traefik flaws, the Azure configuration service 10.0, VeloCloud and Collabora), so the vulnerability list lives there; this weekly holds the stories. Security leads below, then the cloud and model news: an ingress gateway for ECS, a security read on last week’s Lambda Web Functions launch, native PyTorch backends for both Trainium and TPU, rivals’ models landing on Google Cloud, Python 3.15, TypeScript in Rust, and three new model entries closing the week.

Between digests: two KEV additions sit on management planes under active attack, a WordPress plugin whose fix beat its advisory, and a 9.4 on CPython’s ssl.

A short alert between digests: Traffic Server’s Tuesday release fixes fifteen flaws and two of them hand out the wrong client certificate identity; Traefik patched a second connection-identity bug in the same month on related plumbing; and Red Hat is pulling two roots out of its system CA bundle over the eMudhra key leak. mTLS origins, meet your change window.

Not the Monday digest: PHP shipped an emergency release this morning for two leaked-then-patched core RCEs, eight eMudhra intermediate CA keys are compromised, and Cisco and Oracle both emptied their patch trucks.

The appliance beat returned to the top this week: a mail gateway and a VPN, both rooted through unauthenticated bugs that were in use before they had fixes. Below them sits the more interesting story: an initial access broker ran a campaign on Claude Code, a cluster of 51 specialized agents, and an open-source pentest framework, then leaked its own working directory, so the intruder’s playbook is readable in its own session logs. Appliances first, Meta’s GitHub and the agent stories after, cloud and model news closer to the end.

Security owned the week again, and not subtly. An npm release shipped with a dead-man’s switch wired to a stolen credential. Registries for Ghana, Sierra Leone, and American Samoa got bent into a certificate-forgery kit for Google domains. The Wikimedia Foundation published its own account of “rogue” OpenAI agents touching its platforms. Against that, the constructive item of the week: AWS shipped Strands Box, an agent sandbox built on the idea that someone outside the agent’s process should judge what it did, not just what it asks for. Security first, then that, then the rest of the week.