AI coding agents hijacked using AGENTS.md file in Downloads folder
2026-10-25T19:23:21Z•9e151faca1401258a6b29ca5613518f7810cf0065631bb455cca7fa6c1c30ebd
AI agent securityArubaOSPHPSecure Boot bypassUEFI bootkitVeloCloud Orchestratoractive exploitationcloud securitycredential theftdata breachend-of-supportmalwarephishingremote code executionsupply-chain compromisezero-day
What happened
A BleepingComputer security news digest covering active exploitation, critical vulnerabilities, supply-chain compromises, data breaches, AI-agent manipulation, and end-of-support risks. Notable items include a UEFI bootkit bypassing Secure Boot, an abandoned application exposed to remote code execution, an unpatched PHP RCE, critical ArubaOS flaws, an actively exploited VeloCloud Orchestrator zero-day, and malicious LiteLLM packages distributing credential-stealing malware.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 9e151faca1401258a6b29ca5613518f7810cf0065631bb455cca7fa6c1c30ebd
- Enrichment time
- 2026-10-25T19:23:21Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.