whoami
tail -f headlines.log
Most news sites re-package yesterday's press releases. This one doesn't — every post is capped at five minutes, opens with what actually changed, and tells you why it matters before it tells you what happened.
A Kibana user with delegated package-management rights, and no Elasticsearch administrative privileges, could install a package that claimed a data stream identifier already belonging to someone else. Ownership was never checked, so another tenant's telemetry could be redirected through infrastructure the attacker controlled.
wolfSSH never verified that the elliptic curve in a server's host key matched the algorithm both sides had just negotiated. A machine-in-the-middle could swap in a key on a different curve, sign with its own private key, and be accepted with no error. Fixed in 1.6.0 — and it needs one more condition that is common in embedded code.
watchTowr published technical detail and working exploit code for the Atlassian file-read flaw. Previdian's honeypots saw exploitation attempts within two hours. Yesterday we argued the advisory's stated limitation was not one; what has changed since is that nobody even has to work the path out.
Checkmarx has documented an npm campaign running since August 2023 that delivered a remote access trojan and an information stealer through twelve packages. What kept it alive is not stealth. It is that the advisory databases security tooling reads never caught up, and three of the packages are still there.
Anthropic has folded Project Glasswing into a three-tier Cyber Verification Program, giving qualifying security professionals access to its models with reduced blocking on cyber tasks. It reports Glasswing partners found at least 129,000 verified vulnerabilities between April and July. The capability granted is the capability an attacker wants.
The Wikimedia Foundation has published what it found when it looked for rogue OpenAI agent activity on its projects. Most of it was harmless sandbox testing. The part that was not involved editing a citation tool's configuration, and trying to make a public note-taking service fetch data from other sites on the agents' behalf.
Two flaws in Handlebars.js, scored 9.8 and 9.2, with public proof-of-concept code. The library is downloaded about 172 million times a month. The first lets anything that can pass an object instead of a template string place expressions into the generated code; the second walks a deny list that runs one step too late.
CVE-2026-21589 scores 9.3 and lets an unauthenticated attacker read files from the web application root across eight Data Center products. The advisory notes they cannot list directories and must know the exact path. For software anyone can download and install, that is a description of the attack, not a limit on it.
Chrome 155 went to Stable on 7 October with 247 security fixes, four of them critical use-after-free bugs. None were exploited. The interesting part is the attribution list: a visible share of the reports are credited to researchers working with AI assistants, which is the mechanism behind the CVE numbers everyone has been quoting.
The blockchain investigator ZachXBT says he posed as a client of a Chinese network he alleges laundered more than a billion dollars for North Korea's Lazarus Group, including most of the 1.5 billion taken from Bybit. He funded a wallet, placed orders, lost about five percent each time, and traced a cluster that led to a freeze.
Cling takes routers and DVRs through vulnerabilities going back to 2014, then talks to its operator over STUN — the NAT-traversal service every video call depends on. Its traffic looks like a device keeping a connection alive, because that is literally what the packets are. It is the third campaign this fortnight to put its command channel somewhere undeletable.
Proofpoint has tied a China-aligned group to credential phishing against US AI policy researchers. The approach opens as an ordinary conversation with no link in it, and only once the target replies does a URL arrive — ending at a fake sign-in window rendered inside the real browser, which collects the password, the MFA code and the session cookie.
Microsoft published an out-of-band advisory for CVE-2026-96940, an authorisation flaw scored 8.8. An attacker needs valid credentials for any mailbox in the organisation; from there they can read other people's messages and attachments. Exchange Online was mitigated server-side. On-premises stays exposed until an administrator installs the update.
Rejetto HFS signed its session cookies with a key from JavaScript's Math.random, and handed out numbers from the same generator to anyone who started a login. Either alone is survivable. Together they let a stranger forge an admin session and run code. Horizon3 found it with Anthropic's Mythos, published a proof of concept, and scanning began within days.
Socket.dev found VS Code themes on the Marketplace and Open VSX carrying obfuscated loaders. One used a publisher identity imitating Microsoft. The payload was compressed onto one line and encoded with invisible Unicode, then written to a temporary script and run with no window shown. Microsoft removed them, which does not uninstall anything.
Apple says some developers use Full Disk Access to reach files, mail, messages and browsing history without users really understanding, and that autonomous AI agents make that far riskier. The fix is clearer consent and periodic reconfirmation for a new Autonomous Assistant category — which turns a permanent grant into a lease.
On 3 October we wrote that Citrix customers were watching their gateways reboot after installing the emergency build, with no CVE and no root cause published. Citrix disclosed it on the 4th: CVE-2026-88779, a memory overflow reached through SAML, exploited in targeted attacks. Each attempt crashes the authentication service, and the sixth restarts the appliance.
CVE-2026-86950 is an out-of-bounds write in CoreGraphics font rendering, reported by Meta and patched after what Apple calls an extremely sophisticated attack on specific individuals. A public proof of concept has since appeared: a PDF with a crafted font that reliably corrupts memory on anything not updated.
A file-sharing system at the Defense Manpower Data Center let unauthorised users reach files from October 2025 until it was found on 16 July 2026. The records cover 2.76 million living people and about 294,000 dead ones, and pair Social Security numbers with names, dates of birth and military job specialties.
Google Threat Intelligence has documented the first nation-state use of EtherHiding: a DPRK group storing its downloader in smart contracts on two blockchains, updated for about a dollar a time. The coverage calls it takedown-proof. GTIG's own report points at the part that is not — the attackers do not run nodes, they call three API companies.
Unsloth Studio checked a model's configuration with remote code trusted, so selecting an attacker-controlled model in the picker downloaded and executed Python from its Hugging Face repository. No weights loaded, no training started, no prompt to approve. Fixed in 2026.6.9, with no advisory and no identifier.
Truffle Security scanned 224.6 million public GitHub repositories from an AI training dataset and found 543,699 credentials that still worked. The survival rate by provider is the finding: where a provider scans for its own leaked tokens and kills them, almost nothing survives. Where it does not, almost everything does.
Titan, Microsoft's internal analytics service, checked a login token's tenant, audience, application and user — and never checked that it was signed. A 16-year-old researcher set the algorithm to none, typed admin into the user field, and was one. Microsoft blocked the endpoint in four days and paid 5,000 dollars.
CVE-2026-90970 scores 9.9. A user with access to GitLab Duo's agent platform could write a flow configuration that broke out of the prompt-template sandbox and executed commands on the host. The bug class is twenty years old. What is new is that letting users write templates is now a product feature.
subscribe --daily