Vulnerabilities & Exploits Splunk's Patroni REST API Runs Operating-System Commands Without a Login Splunk's September/October 2026 advisory carries 17 CVEs, and the critical one sits in the Patroni REST API that runs beside a search head cluster member, where a request that reaches the in
Vulnerabilities & Exploits MediaTek's October Bulletin Puts 31 Chipset Flaws Behind One Firmware Update MediaTek's October 2026 bulletin lists 31 chipset flaws including two critical modem bugs a rogue base station can trigger, and the fix reaches devices only through each maker's firmware.
Vulnerabilities & Exploits F5's BIG-IP APM Heap Overflow Puts Remote Code Execution Behind an OAuth Profile F5's advisory for CVE-2026-94127 describes a heap overflow that reaches remote code execution with no credentials, on one specific BIG-IP APM configuration that sits at the network edge.
Vulnerabilities & Exploits CISA's Five Legacy Flaws Turn a Patch Order Into an Inventory Job CISA added five flaws to its Known Exploited Vulnerabilities catalog on 8 October 2026 with an 11 October deadline, and every one of them lives in self-hosted server software.
AI Security An Unauthenticated KV Cache Server Puts Code Execution on Your Cluster Network CVE-2026-105192 lets one unauthenticated ZeroMQ message run code as the LMCache cache process, and no fixed release exists. The containment is the bind address.
Vulnerabilities & Exploits Eight Atlassian Data Center Products Share One File-Read Flaw and One Patch Clock CVE-2026-21589 reads files without a login across eight self-hosted Atlassian products, and a public proof of concept turned that read into Jira administrator access within two days.
Cryptography & Post-Quantum Cloudflare Becomes a Certificate Authority for Post-Quantum Certificates Cloudflare has applied to four browser root programs, agreed to buy a publicly trusted root from GlobalSign, and set production Merkle Tree Certificates for the first quarter of 2027. The si
AI Security Open Weights Move the Cyber-Safety Boundary Beyond the Model Anthropic and NIST assessments show what GLM-5.3 did in controlled tests—and why operators must govern the environment around downloadable weights.
Security Operations Google Paused the OSS Bug Bounty: Triage Is the Scarce Skill Google stopped taking product-vulnerability reports to its open-source reward programme on 1 October 2026, and the reason it gave applies to every team that receives security reports from st
Vulnerabilities & Exploits Zammad's Two-Flaw Exploit Chain and the Two Affected-Version Lists A session-hijack flaw and a local privilege escalation in Zammad chain into root access in seconds, and the version lists published by the coordinating institute and the vendor read differen
AI Security Anthropic's Open-Source Disclosure Ledger Shows Where Remediation Slows Down Anthropic's dashboard now reports 6,157 disclosed open-source vulnerabilities against 516 patches released upstream. The funnel behind those two numbers, and the pacing policy the vendor app
AI Security Claude Mythos Found a Critical HFS Bug, and Exploitation Followed Within a Day Anthropic's vulnerability programme has disclosed 6,157 findings across 591 open-source projects. The HFS session-forgery bug shows what the programme's throughput means in practice: a publi
Vulnerabilities & Exploits GitLab's AI Gateway Sandbox Escape Ends in Command Execution on Self-Hosted Instances CVE-2026-90970 lets an authenticated user with Duo Agent Platform access escape the GitLab AI Gateway's prompt template sandbox through a crafted flow configuration, and run arbitrary comman
Vulnerabilities & Exploits The NetScaler Payloads That Create Their Own Superusers and Hide in CSS URLs LevelBlue's Threat Hunt Operations team documented what actually ran on compromised NetScaler appliances after CVE-2026-88771 and CVE-2026-88772 were exploited: a Perl script that creates a
Vulnerabilities & Exploits Disclosure Doubled and Exploitation Followed: What GTIG's AI-Era Data Actually Shows Google Threat Intelligence Group's first full dataset on vulnerabilities in the AI era reports monthly disclosures more than doubling — from 5,045 in January 2026 to 10,740 in August — while
Vulnerabilities & Exploits Cisco SD-WAN Manager Auth Bypass: Actively Exploited, No Workaround (CVE-2026-76504) Cisco disclosed CVE-2026-76504, a CVSS 9.8 auth bypass in Catalyst SD-WAN Manager, on September 30, 2026 — and confirmed active exploitation. A URI-encoded character defeats the login rule,
Vulnerabilities & Exploits The Zimbra Bug That Turned a Monitoring Add-on into a Command Line Microsoft published a September 30, 2026 deep-dive on CVE-2026-73570 — an unauthenticated command injection in Zimbra's optional SNMP notification path — with exploitation observed between t
AI Security Stolen AI API Keys Are Now the Attack Currency Anthropic's September 2026 threat report documents a criminal AI supply chain built on stolen API keys and session tokens. One hacktivist campaign ran for a month entirely on stolen keys; th
AI Security Perplexity Red-Teamed Its Agent Sandbox: The VM Held, the Network Didn't Perplexity's Secure Intelligence Institute published a red-team report on its own SPACE sandbox: zero VM-to-host escapes in 108 runs, but four models bypassed the network egress policy, and
Vulnerabilities & Exploits The Controller That Runs Your AI Data Center Had Hard-Coded Credentials NVIDIA's September 22 bulletin disclosed a CVSS 9.8 hard-coded-credential flaw in NICo, the Kubernetes-based controller that provisions bare-metal AI infrastructure. The tool that manages ev
Vulnerabilities & Exploits A Public Exploit Escapes Ubuntu Containers Before the Patch Ships DepthFirst published a working container-escape exploit for CVE-2026-80521, an AF_UNIX use-after-free, while Ubuntu still lists the fix as work in progress. MicroVMs are the only real mitiga
Security Operations ISOC Is Microsoft's Answer to Agent-Speed Attacks. The Loop Still Needs Human Judgment Microsoft merges SIEM and threat protection into one integrated SOC loop. Storm-3168 shows why the convergence is necessary — and why least privilege inside the loop decides if it works.
Vulnerabilities & Exploits Oracle PeopleSoft Exploitation: How One Encoded Character Bypassed a WAF Rule A URL-encoded P let UNC6240 evade literal-path WAF rules at Oracle PeopleSoft. Netics examines the patch-first response to renewed CVE-2026-35273 exploitation.
AI Security Microsoft's Network DLP Now Watches AI Agent Uploads. Roll It Out in Audit Mode Purview network DLP on Entra Global Secure Access blocks sensitive data at the network layer — including traffic an AI agent sends on a user's behalf. The licensing and limits deserve scruti
Software Supply Chain AI Coding Agents Now Ship Software. Plugin4Shell Shows Nobody Checks the Package A zero-click plugin swap bypasses SHA pinning in four major AI coding agents. The fix has to ship in the agent itself, and updating is only the complete remedy where one exists.
