[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqNvrqPKze5UqEqSwnAXJAT6uATeZa04BLCVtoA2ymS0":3},{"article":4,"iocs":58,"watch_terms":65,"solutions":66,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"46cb7e74-9c1a-4f87-9c6c-ce7c65e69dfd","ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories","threatsday-ai-powered-zero-day-chain-543k-live-secrets-model-inspection-rce-and--ab51ae","This week, the useful words are boring ones: inspect, cache, compile, store, trust. Each sounds harmless. Each can become an attack path when a system does a little more than people expect. A model check can run code. A cache can mix up requests. A public secret can stay useful for years. That is the lesson running through the list. Attackers do not always need a brilliant new trick. They can","This week's security digest covers multiple converging threats: AI-powered zero-day exploitation chains, discovery of 543K live secrets in public systems, remote code execution via model inspection tools, and broader trends in malware concealment using blockchain dead drops. Key stories include U.S. Treasury sanctions against Tren de Aragua's ATM jackpotting operation ($40.73M stolen), surge in EtherHiding techniques exploiting public blockchains, AI safety bypass vulnerabilities in Moonshot's models, and defensive prompt injection techniques. The underlying theme: attackers exploit mundane system assumptions (caching, compilation, storage, trust) rather than requiring novel exploits.","ThreatsDay roundup: AI zero-day chains, 543K exposed secrets, blockchain malware, ATM jackpotting sanctions.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fthreatsday-ai-powered-zero-day-chain.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhOZPv0LS8-qPBgL_d1m8BLNikw8psPt9qtB_HiFNoYnVwBacYvwz4DdEixukdlHcy7IXmUB9dI9E_Hcx48HJIL7sQzmDeextP-Y_tHO9SX51i_SditMkVsRgWxyMekufW3yZFn2jI9nf29y3JEM2a_yFv8iTLDb6d3r1roNsea_Yk5TWCiMcvkmE5ZbP6B\u002Fs1600\u002Foct-threatsday.jpg","2026-10-01T16:45:38+00:00","2026-10-01T18:00:03.053284+00:00",8,[17,20,22,24,27,30],{"name":18,"type":19},"Tren de Aragua","threat_actor",{"name":21,"type":19},"North Korean state operators",{"name":23,"type":19},"Iranian state operators",{"name":25,"type":26},"Moonshot AI","vendor",{"name":28,"type":29},"Kimi K2.6","product",{"name":31,"type":29},"Kimi K3 Swarm","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":54},{"id":55,"icon":34,"name":56,"slug":57},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[59,62],{"type":57,"value":60,"context":61},"Ploutus","ATM jackpotting malware used by Tren de Aragua in $40.73M theft scheme",{"type":57,"value":63,"context":64},"EtherHiding","Blockchain-based malware concealment technique; surge in use by state operators",[25,28,31],{"controls":67,"vendors":147},[68,97,122],{"slug":69,"name":70,"problem":71,"products":72},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":36,"name":98,"problem":99,"products":100},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":118,"product_name":119,"url":120,"description":121},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"slug":52,"name":123,"problem":124,"products":125},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":143,"product_name":144,"url":145,"description":146},"prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",[],{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":166},"ai-powered-zero-days-543k-exposed-secrets-and-blockchain-malware-highlight-systemic-security-gaps","AI-Powered Zero-Days, 543K Exposed Secrets, and Blockchain Malware Highlight Systemic Security Gaps","This week's threat landscape reveals a dangerous pattern: attackers are not relying on exotic techniques but instead exploiting foundational assumptions baked into everyday systems — caching mechanisms, compilation pipelines, public storage, and implicit trust relationships. The discovery of 543,000 live secrets in public systems underscores chronic failures in secrets management and developer security hygiene. AI-powered zero-day chaining and model inspection RCE demonstrate that emerging technologies introduce attack surfaces faster than defenders can assess them. EtherHiding's abuse of public blockchains for malware command-and-control is particularly alarming because traditional blocklists and takedown mechanisms are ineffective against decentralized infrastructure. Together, these stories confirm that organizations are losing ground on basic hygiene while simultaneously onboarding high-risk technologies without adequate security controls.",[153,154,155,156,157,158,159,160,161,162,163,164,165],"CIS Control 3: Data Protection","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST CSF DE.CM-4: Malicious Code Detection","NIST CSF ID.AM-2: Software and Systems Inventory","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SA-15: Development Process and Standards","NIST SP 800-53 IA-5: Authenticator Management (Credential Rotation)","OWASP Top 10 2021 A05: Security Misconfiguration","OWASP Top 10 2021 A08: Software and Data Integrity Failures","GDPR Article 32: Security of Processing (exposure of secrets may constitute a personal data breach)","ITIL: Change Management — risk assessment for AI\u002FML toolchain changes",{}]