--- title: "🛡️ Can Markdown in Download Folders Hijack AI Assistants? Six Must-See AI Supply Chain Vulnerabilities This Week: AI Security Daily" description: "For the first time, the US CISA has added AI frameworks like LiteLLM to its Known Exploited Vulnerabilities catalog, showing that attacks against AI infrastructure have entered active exploitation. I'm Mu-yen. In today's \"AI Cybersecurity Daily,\" besides reviewing these targeted high-risk vulnerabilities, we'll also discuss why engineers' download folders have become a breeding ground for hijacking AI assistants, and how a PHP core vulnerability discovered using AI could affect 70% of the world's websites. Stay tuned to find out how to protect yourself." canonical_url: "https://blog.markkulab.net/en/ai-security/ai-security-2026-10-25" author: "Mark Ku" author_url: "https://blog.markkulab.net/en/author/mark-ku" site: "Mark Ku's Tech Notes" date_published: "2026-10-25T02:00:00.000Z" category: "AI Cybersecurity Daily" tags: ["ai-security", "podcast", "AI 資安", "AI資安", "CISA", "KEV", "LiteLLM", "供應鏈攻擊", "PHP2Shell", "PromptInjection"] language: "en" license: "CC BY 4.0" license_url: "https://creativecommons.org/licenses/by/4.0/" attribution: "when reusing or quoting, credit the author and link back to the original" --- # 🛡️ Can Markdown in Download Folders Hijack AI Assistants? Six Must-See AI Supply Chain Vulnerabilities This Week: AI Security Daily ## Introduction For the first time, the US CISA has added AI frameworks like LiteLLM to its Known Exploited Vulnerabilities catalog, signaling that attacks targeting AI infrastructure have entered active exploitation. I'm Mu-Yen. In today's "AI Security Daily", besides reviewing these high-risk targeted vulnerabilities, we will also talk about why engineers' downloads folders are becoming a breeding ground for hijacking AI assistants, and how a PHP core vulnerability discovered with the help of AI could affect 70% of websites worldwide. I'll tell you how to defend against these threats in just a moment. ## Today's AI Security Highlights ### 1. CISA Adds AI Frameworks Like LiteLLM and Langflow to Known Exploited Vulnerabilities Catalog for the First Time - **What Happened**: On October 21, the US CISA updated its Known Exploited Vulnerabilities (KEV) catalog, adding several critical AI stack framework vulnerabilities for the first time. This batch of vulnerabilities includes an authentication bypass in LiteLLM (CVE-2026-59822, CVSS 8.8) and command injection (CVE-2026-42271, CVSS 8.7), an MLflow vulnerability (CVE-2026-64849), and a cross-tenant IDOR vulnerability in Langflow (CVE-2026-55255, CVSS 9.9). This means these vulnerabilities are seeing active exploitation in the wild, and the difficulty of defense cannot be ignored. - **Impact**: Affects all organizations that have deployed the relevant AI gateways (management interfaces used to connect multiple AI models) and orchestration platforms (systems used to chain AI workflows). If left unpatched, attackers could exploit these to bypass authentication or execute arbitrary commands. - **Defense Recommendations**: Security leaders should immediately audit their internal environments for deployments of tools like LiteLLM, MLflow, and Langflow, and complete emergency patching within the deadline according to the KEV list. - **Source**: DeepInspect () ### 2. LiteLLM Hit by Supply Chain Attack, Malicious Version 1.107.0 Spreads Info-Stealer on PyPI and Docker - **What Happened**: The popular AI gateway tool LiteLLM fell victim to a supply chain compromise. Attackers leveraged unrevoked GitHub organization owner permissions to publish a malicious code-infused version, `1.107.0`, to PyPI and Docker Hub on October 21. This malicious version contains a built-in credential stealer and a Remote Access Trojan (RAT) that executes automatically when Python starts. According to SecurityWeek, this malicious version was downloaded over 49,000 times before being taken down. - **Impact**: Affects all developers and enterprise servers that downloaded or updated to `litellm==1.107.0` after October 21, potentially leading to the leakage of cloud and AI service credentials. - **Defense Recommendations**: Affected users are advised to immediately uninstall this version, roll back the package to the secure `1.106.2` version, and thoroughly rotate any cloud and AI service credentials that may have been compromised. - **Source**: SecurityWeek () ### 3. Danger Lurking in the Downloads Folder! Malicious Markdown Files Hijack AI Code Assistants to Install Malware - **What Happened**: Researchers have discovered a new type of indirect prompt injection, an attack technique that uses external inputs to trick an AI into executing unintended instructions. Attackers exploit silent browser download mechanisms to drop a malicious `AGENTS.md` file into a developer's downloads folder. When the developer launches an AI code assistant like OpenAI Codex, Claude Code, or Cursor within that directory, the assistant automatically reads the file and executes the malicious instructions. This leads to the background installation of a malicious package named `function-color` to steal credentials. - **Impact**: Affects developers who are accustomed to running AI code assistants directly in their downloads directory, potentially leading to silent malware installation. - **Defense Recommendations**: It is recommended to restrict AI assistants from running in downloads or temporary directories, disable auto-approval settings for commands, and carefully review project configuration files before execution. - **Source**: BleepingComputer () ### 4. AI-Assisted Discovery of Critical PHP Core Vulnerability "PHP2Shell" Affects Nearly 70% of Websites Worldwide - **What Happened**: Security researchers, aided by AI models, discovered two critical memory safety vulnerabilities in the PHP core runtime, collectively dubbed "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619), with a CVSS 4.0 score as high as 9.2. These vulnerabilities could lead to unauthorized remote code execution (RCE, meaning attackers can gain remote control of the server). - **Impact**: Affects PHP versions 5.4 through 8.5. Due to the widespread adoption of PHP, it is estimated to impact approximately 70% of websites worldwide. - **Defense Recommendations**: System administrators should immediately upgrade PHP in their environments to secure versions such as 8.5.12, 8.4.27, 8.3.36, or 8.2.35. - **Source**: Akamai () ### 5. OpenAI Strengthens Model Training Security, Launches "Patch the Planet" Initiative to Fix Open-Source Vulnerabilities - **What Happened**: OpenAI disclosed security details regarding its frontier model training and evaluation environments, announcing an offline training policy with "no internet connection" and the use of AI agents for large-scale red teaming. During this security hardening process, OpenAI contributed several security patches back to the open-source community through its "Patch the Planet" initiative. These patches cover vulnerabilities in Kata Containers (CVE-2026-24834), gVisor, Moby/Docker, and multiple Linux kernel vulnerabilities (CVE-2026-74753, CVE-2026-80521, CVE-2026-80841). - **Impact**: Enhances the security of the overall open-source ecosystem and containerization technologies, particularly cloud runtime environments utilizing related virtualization and container technologies. - **Defense Recommendations**: Enterprises should regularly review and update Docker, the Linux kernel, and virtualized container packages in their infrastructure to protect against disclosed low-level vulnerabilities. - **Source**: OpenAI () ### 6. Frenos ICS Security Report: Frontier Models Already Possess 90% Capability to Plan Industrial System Attacks - **What Happened**: Industrial control systems (ICS) security firm Frenos released its inaugural "State of AI in ICS Security" annual report, testing multiple AI models across more than 500 simulated Operational Technology (OT) attack scenarios. The results show that the three most powerful frontier models today can plan viable attack paths in approximately 90% of attempts. According to the Frenos report, critical infrastructure operators have about a two-year window to prepare before AI-assisted attacks become a reliable capability for adversaries. - **Impact**: Threatens the security of critical infrastructure and industrial control systems, lowering the barrier to entry for attackers to plan complex industrial cyberattacks. - **Defense Recommendations**: Operators should prioritize strengthening detection and response capabilities in industrial control networks, leverage AI to assess their own environments, and review exposure risks from a holistic system perspective. - **Source**: Hipther () ## Conclusion The most alarming takeaway today is that vulnerabilities in AI infrastructure are now being actively exploited by hackers, and CISA has issued an official warning. Before you log off today, it is highly recommended to check if your team's development environment is using LiteLLM version 1.107.0, and remind your developers not to run AI code assistants directly in their downloads folder. I'm Mu-Yen, see you tomorrow. --- ## About this article and its author Originally published on [Mark Ku's Tech Notes](https://blog.markkulab.net/en/ai-security/ai-security-2026-10-25) License: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — when reusing or quoting, credit the author and link back to the original ### About the author **[Mark Ku](https://blog.markkulab.net/en/author/mark-ku)** — Software engineer - 10+ years as a software engineer - Built North-American e-commerce and AI SaaS subscription billing ### Free tools built by the author All of these are free to use: - [Free PDF Sign Tool](https://blog.markkulab.net/en/tools/pdf-sign): Online PDF sign tool — draw, type, or upload a signature, then drag, resize, and download. Everything runs in your browser; nothing is uploaded. - [VS Code Refactory](https://blog.markkulab.net/en/tools/refactory): Refactory is a VS Code refactoring extension: 34 actions plus a 37-rule code-smell inspection layer with a Code Health dashboard, across 18 languages, backed by 534 tests. It learns your repo's conventions: where interfaces live, where DI is registered, whether 'use client' belongs. It ranks files by git churn × complexity so you know what to fix first, and hands any smell to the Claude Code already on your machine. Free to use, and your source never leaves your computer. - [DB-Kit Database Manager](https://blog.markkulab.net/en/tools/db-kit): DB-Kit is a lightweight, cross-platform database manager built with Tauri + Rust + React. Manage MySQL, MariaDB, PostgreSQL, SQL Server, Oracle, SQLite, MongoDB, Redis, Kafka, Elasticsearch and RabbitMQ from one consistent interface: passwords encrypted in the OS keychain, SSH tunnels, full CRUD, a visual query builder, stacked multi-statement result sets, cross-connection data transfer, schema & data compare with sync SQL and schema snapshots, Excel / CSV import & export, visualized execution plans, ER diagrams, scheduled backups, SQL stress testing with p50–p99 latency percentiles, a 15-rule SQL review engine, Review & Run (AI review plus per-statement backups and an auto-generated rollback script), Kafka message browsing with monitoring & alerts, an SSH terminal with SFTP / FTP, Docker / Kubernetes, remote desktop (RDP / VNC / RustDesk), file / folder compare, stored procedure integration tests, six UI languages, a built-in AI assistant (a local CLI or any Anthropic / OpenAI-compatible API; natural-language SQL, AI review and tuning advice) and the dbk CLI. Free and open source (MIT), with installers for Windows, macOS and Linux. - [VS Code Super Mermaid](https://blog.markkulab.net/en/tools/super-mermaid): Super Mermaid is a VS Code extension for beautiful Mermaid diagrams out of the box: auto-colored live preview, mouse pan & zoom, high-res PNG / SVG export, 21 templates and multiple themes. Free and open source (MIT). - [React Super Mermaid](https://blog.markkulab.net/en/tools/react-super-mermaid): react-super-mermaid is an open-source React component library: render beautiful Mermaid diagrams with a single , with built-in colorful / sketch themes, pan & zoom, in-diagram search, and high-res SVG / PNG export. Lightweight, SSR-safe, fully typed. Free and open source (MIT). - [Jira / Confluence Super Mermaid](https://blog.markkulab.net/en/tools/jira-super-mermaid): An Atlassian Forge app: write Mermaid syntax directly inside a Jira issue or a Confluence page and get flowcharts, sequence diagrams, state machines and Gantt charts. 11 diagram types, SVG / PNG export, light and dark themes, full CJK support. Runs on Atlassian: your diagrams live in your own site and the app calls no third-party service. Free, coming soon to the Atlassian Marketplace. - [Mermaid Live Preview](https://blog.markkulab.net/en/tools/mermaid-preview): Write Mermaid in your browser, see it render instantly, and share the whole diagram as a single link. No sign-up, nothing uploaded to a server, and mermaid.live share links work as-is. - [React Intl Phone Number](https://blog.markkulab.net/en/tools/react-intl-phone-number): react-intl-phone-number is an open-source React component: framework-agnostic and antd-free, with E.164 in/out, a searchable flag / country-code dropdown, configurable validation levels (strict / mobile-strict / loose), themeable CSS, and i18n — phone logic powered by google-libphonenumber. Lightweight and fully typed. Free and open source (MIT). - [Uptime Kuma Cluster](https://blog.markkulab.net/en/tools/uptime-kuma-cluster): Turn single-node Uptime Kuma into a highly available cluster: OpenResty + Lua smart load balancing, shared MariaDB state, health checks and automatic failover, plus cluster-management REST APIs. One Docker Compose command to start. Free and open source (MIT). - [AI Podcast Cut](https://blog.markkulab.net/en/tools/ai-podcast-cut): Drop in a recording and it removes fillers and stutters, levels loudness segment by segment, and sends a second agent to review every cut. Cut points snap to word boundaries and zero crossings, every splice gets a fade, and sentence-end breaths are preserved. Desktop app for Windows, macOS and Linux. MIT licensed; the Windows installer bundles ffmpeg. - [AI Video Cut](https://blog.markkulab.net/en/tools/ai-video-cut): Pick something in your video: type it (face, license plate, phone screen, logo), click points or drag a box, or let Claude Code / Codex pick it. AI Video Cut tracks it frame by frame, then mosaics or blurs it, recolors it, pins stickers and text to it, swaps a screen or poster for your own image or video, or removes it using background that other frames actually captured. Plus sequence editing, local captions and an AI assistant. Free, open-source (MIT) Windows desktop app (macOS / Linux experimental) that runs locally, nothing uploaded. - [open-pos restaurant POS](https://blog.markkulab.net/en/tools/open-pos): One computer and one receipt printer is enough to open the shop. Your data lives on your own disk, no subscription, no lock-in, MIT licensed. Money is integer New Taiwan dollars with tax split by the statutory formula, so sales + tax always equals the total. Printing goes straight over ESC/POS on TCP 9100, with no vendor driver. Tauri + Rust + SQLite desktop app, v1.0 in development. - [.NET e-commerce API template](https://blog.markkulab.net/en/tools/dotnet-ecommerce-api): An e-commerce backend API template built on .NET 10: Controller → Service → Repository layering, Autofac convention-based registration, SqlSugar for MySQL / MariaDB and SQL Server, Redis cache and message queue, Hangfire jobs, JWT auth, and an extensible payment provider module (ECPay, Newebpay). Apache 2.0. - [Open Token Monitor team AI usage](https://blog.markkulab.net/en/tools/open-token-monitor): Collect token usage and equivalent cost from every employee's AI coding tools into a hub you host yourself: PostgreSQL, org roster, dashboards compared by company and department, and a reports API. Electron and Rust/Tauri clients upload every 30 minutes. MIT licensed, one Docker command. - [ai-security-monitor defensive security](https://blog.markkulab.net/en/tools/ai-security-monitor): ai-security-monitor is a single Rust binary for your computers and servers. It finds unusual connections, rates them safe / unknown / suspicious / dangerous against 26 public threat-intel sources, and checks firewalls, open ports, vulnerabilities and 60 hardening rules. Security Hub shows the whole fleet, and Claude Code / Codex explain it in plain words. MIT, free, self-hosted. ### Daily podcasts - [Mark's Tech Insights — Daily AI News](https://blog.markkulab.net/en/category/tech-news): Daily curated AI and tech trends. Catch the latest developments via audio summaries — covering AI applications, software architecture, DevOps, and engineering practice. — RSS: https://blog.markkulab.net/feed.xml - [AI股市蝦聊](https://blog.markkulab.net/en/category/ai-stock-chat): Every trading day, an AI-analyzed take on the Taiwan stock market, delivered as a two-host conversation covering the session and the next-day outlook. — RSS: https://blog.markkulab.net/ai-stock-chat/feed.xml - [開源好物日報](https://blog.markkulab.net/en/category/open-source-weekly): A daily two-host pick of free open-source tools surfaced from real Hacker News, GitHub, and Reddit buzz — what pain they solve and the fastest way to get started. — RSS: https://blog.markkulab.net/open-source-weekly/feed.xml - [AI 運動日報](https://blog.markkulab.net/en/category/sports-weekly): Two hosts talk NBA, MLB and world sport every day — scores, records and the stories behind them, from a Taiwanese fan perspective. — RSS: https://blog.markkulab.net/sports-weekly/feed.xml - [AI 國際新聞快報](https://blog.markkulab.net/en/category/world-news): A daily two-host briefing that makes sense of the past 24 hours in world news — geopolitics, the global economy, conflict and security, disasters and climate — from a Taiwanese perspective, neutral and fully sourced. — RSS: https://blog.markkulab.net/world-news/feed.xml - [地端 AI 實驗室](https://blog.markkulab.net/en/category/local-ai-lab): Every day, a two-host look at open-weight models and LoRAs you can actually run on your own machine: what they are for, whether your GPU can handle them, and how they compare — sourced from official model cards. — RSS: https://blog.markkulab.net/local-ai-lab/feed.xml - [AI 行銷日報](https://blog.markkulab.net/en/category/ai-marketing): Every day, two hosts break down the latest in AI for marketing, advertising, SEO/GEO and content marketing: practical, never sponsored, every story sourced. — RSS: https://blog.markkulab.net/ai-marketing/feed.xml - [AI 資安日報](https://blog.markkulab.net/en/category/ai-security): Every day, two hosts cover the latest where AI meets cybersecurity: LLM and AI agent vulnerabilities, prompt injection, model supply-chain risks and AI-powered attacks, from a defense-first angle with every story sourced. — RSS: https://blog.markkulab.net/ai-security/feed.xml ### Newsletter [Subscribe to the newsletter](https://blog.markkulab.net/en/subscribe) — Be the first to know about new posts. No spam, unsubscribe anytime.