# exploits Published articles for exploits. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Security through obscurity is dead, and AI delivered the fatal blow DevFeed: [Security through obscurity is dead, and AI delivered the fatal blow]() Original publisher: [Read original article]() Author: Jessica Lyons Published: 2026-09-13T11:21:00Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [Vulnerabilities](), [Maintainers](), [Chromium]() Tags: [ai](), [ai-agents](), [ai-and-ml](), [black-hat](), [chromium](), [exploits](), [maintainers](), [microsoft](), [open-source](), [security](), [vulnerabilities]() ### AI overview AI-driven bug discovery is exposing long-hidden vulnerabilities in commercial and open-source software, undermining security through obscurity. The article also notes that attackers can use AI to reverse-engineer patches and rapidly develop exploits. ### Source excerpt RIP, you won't be mourned ## Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits DevFeed: [Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits]() Original publisher: [Read original article]() Author: Jessica Lyons Published: 2026-09-09T22:28:53Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [BlueMoon](), [Chromium](), [cve-2026-85880](), [Microsoft]() Tags: [ai](), [ai-agents](), [bluemoon](), [chrome](), [chromium](), [cve-2026-85880](), [exploits](), [google](), [microsoft](), [proofpoint](), [research](), [reverse-engineering](), [security](), [windows]() ### AI overview Proofpoint reports that multiple espionage clusters used the BlueMoon exploit kit to chain Chromium-based browser flaws with a Windows bug. The article says AI agents may lower the barrier to exploit development, particularly during the window between upstream Chromium patches and downstream stable releases. ### Source excerpt Mind the patch gap, please and thank you ## A "proof" of Fermat's Last Theorem that fits the margin DevFeed: [A "proof" of Fermat's Last Theorem that fits the margin]() Original publisher: [Read original article]() Author: "Marc Ilunga" Published: 2026-09-09T11:00:00Z Content type: article Language: en Sources: [The Trail of Bits Blog](), [The Trail of Bits Blog]() Topics: [Lean](), [bug](), [Memory safety verification]() Tags: [bug](), [exploits](), [memory-safety](), [open-source](), [vulnerability-disclosure]() ### AI overview A Lean string-slicing bug caused its logical evaluator and compiled native code to disagree, allowing a contradiction that could make an invalid proof appear checked. The issue was fixed after disclosure. ### Source excerpt Fermat famously claimed to have a "truly marvelous proof" of his Last Theorem, but he never wrote it down, insisting the margin of his page was too narrow to contain it. A few centuries later, Anthropic announced a complete formalization of Fermat's Last Theorem using 13 million lines of Lean code (clearly not what Fermat intended). Luckily, we found a wonderfully cursed Lean bug, shown below, that suggests the proof may have fit the margin after all. The issue affects all stable versions of Lean up to 4.33.1, and the patch is incorporated in v4.34.0-rc1. A "checked" proof of Fermat's Last Theorem using Lean 4.33.1 The blue checkmarks in the screenshot above would suggest that Lean considers this proof correct. This seems odd given the amount of work Sir Andrew Wiles put into this problem and the vast size of Claude's proof. So what is going on? The "proof" clearly doesn't make any sense and exploits an issue in Lean. We found the issue while using GPT-5.6 to experiment with a new skill for code review. We want to clarify up front that the issue is not a kernel soundness issue, but it happens to nicely fit any discussion of strings, lengths, and substrings. The issue affects String.Pos.Raw.extract, Lean's low-level string-slicing function. When asked to extract a one-byte slice at an astronomically large position, Lean's logical definition returns the empty string. But the compiled native code returns the entire original string. That disagreement is enough to manufacture a contradiction. Lean's ordinary evaluator "proves" that the tiny slice was empty, while native evaluation "proves" that the very same slice contained "a truly marvelous proof." Put those together, and Lean concludes that the empty string equals a non-empty string. And once you have a contradiction, you can prove anything, including Fermat's Last Theorem. On the bright side, the Lean team was considerably faster than mathematical history. About 90 minutes after we reported the issue, hargoniX opened ## StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-day DevFeed: [StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-day]() Original publisher: [Read original article]() Author: Satnam Narang Published: 2026-09-08T14:00:43Z Content type: news Language: en Sources: [Tenable Blog]() Topics: [vulnerability](), [PHP]() Tags: [attacks](), [authentication](), [exploits](), [payload](), [php](), [vulnerability]() ### AI overview The article explains StyleSmuggler (CVE-2026-75650), an actively exploited, unauthenticated remote-code-execution vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. It describes injection of PHP code through style properties and execution during rendering of a transactional email template. ### Source excerpt A critical unauthenticated remote code execution (RCE) zero-day in Adobe Commerce and Magento Open Source, dubbed StyleSmuggler, has been actively exploited since September 4 with attacks observed three days before a vendor patch became available. Key takeaways CVE-2026-75650 is a critical remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source that can be triggered without authentication. Active exploitation of CVE-2026-75650 began on September 4, 2026, three days before Adobe released a hotfix, with multiple victim stores confirmed across different attack campaigns. Adobe released Hotfix VULN-39341 on September 7, 2026, and Tenable detection plugins will be published as they become available. Background Tenable's Research Special Operations Team (RSO) has compiled this blog to answer Frequently Asked Questions (FAQ) regarding CVE-2026-75650, a zero-day remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source that has been actively exploited in the wild. FAQ When was CVE-2026-75650 first disclosed? On September 5, 2026, the Sansec Forensics Team published research detailing an actively exploited zero-day vulnerability in Magento and Adobe Commerce that it named StyleSmuggler. What is CVE-2026-75650? CVE-2026-75650 is a remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source. Successful exploitation grants an unauthenticated attacker the ability to execute arbitrary code on a vulnerable server. CVE-2026-75650 carries a CVSSv3 score of 10.0, the highest possible rating. Additionally, its scope is changed, meaning exploitation can impact resources beyond the vulnerable component itself. CVEDescriptionCVSSv3CVE-2026-75650Adobe Commerce and Magento Open Source Remote Code Execution10.0 The following products and versions are affected: ProductAffected versionsAdobe Commerce2.4.4 through 2.4.9Adobe Commerce B2B1.3.3 through 1.5.3Magento Open Source2 ## Path to Astra: critical capabilities and frontier safeguards DevFeed: [Path to Astra: critical capabilities and frontier safeguards]() Original publisher: [Read original article]() Published: 2026-09-01T13:00:00Z Content type: news Language: en Sources: [OpenAI News]() Topics: [Cybersecurity](), [Vulnerabilities](), [hugging face](), [incident]() Tags: [cybersecurity](), [exploits](), [framework](), [hugging-face](), [incident](), [model](), [monitoring](), [openai](), [release](), [safety](), [testing](), [training]() ### AI overview OpenAI says Astra has reached its Critical cybersecurity capability threshold and describes safeguards, testing, and limited initial access planned ahead of release. ### Source excerpt Astra is the first OpenAI model to meet the Critical cybersecurity capability threshold under the Preparedness Framework, with stronger safeguards for release. ## Putting frontier cyber models in more trusted hands DevFeed: [Putting frontier cyber models in more trusted hands]() Original publisher: [Read original article]() Published: 2026-08-10T10:00:00Z Content type: news Language: en Sources: [OpenAI News]() Topics: [Vulnerabilities]() Tags: [ai](), [cybersecurity](), [exploits](), [models](), [openai](), [partners](), [security](), [validation](), [vulnerabilities]() ### AI overview OpenAI's Daybreak Cyber Partner program gives approved security partners access to frontier cyber models for authorized, governed services. The models are intended to help defenders discover and validate vulnerabilities, prioritize exploitable weaknesses, and accelerate fixes. ### Source excerpt Approved Daybreak partners can use OpenAI's frontier cyber models to deliver authorized, governed cybersecurity services to customers. ## Remove standing access before AI agents exploit it DevFeed: [Remove standing access before AI agents exploit it]() Original publisher: [Read original article]() Author: info@1password.com (Sanjay Ramnath) Published: 2026-08-06T00:00:00Z Content type: opinion Language: en Sources: [Blog on 1Password Blog]() Topics: [Artificial Intelligence](), [API keys](), [OAuth](), [Authorization](), [Cloud](), [incident](), [coding]() Tags: [ai](), [ai-agents](), [api-keys](), [attacks](), [cloud](), [exploits](), [infrastructure](), [oauth](), [passwords](), [secrets](), [security](), [unified-access]() ### AI overview The article argues that AI-driven autonomous systems can rapidly discover and exploit standing credentials after gaining access to enterprise environments. It recommends removing unnecessary access, vaulting plaintext secrets, and reducing the blast radius of credential-based attacks. ### Source excerpt AI has changed the calculus of a credential attack. Before, finding and exploiting credentials in an enterprise environment required time, patience, and human judgment. An attacker had to decide which accounts were worth testing and which systems were worth reaching. Many credentials never made the list. By contrast, an autonomous system that gains a foothold in a victim's systems has no need to be picky. It can sweep an environment in moments, scooping up API keys, service account tokens, OAuth tokens, cloud credentials, and plaintext secrets on developer devices. It authenticates with whatever it finds and moves laterally as far as standing access allows, one credential opening the next, at machine speed. An attacker with AI doesn't need to choose targets. Everything accessible is worth exploiting. Recent high-profile incidents with experimental AI models have shown that pattern in action. Entry points differed: software exploits in two cases, weak passwords in a third. But what followed was the same in each incident: automated systems swept for whatever credentials the environment offered and moved as far as standing access would carry them. In one documented case, that meant more than 17,000 recorded attacker events over a single weekend. These stories are just early indicators of what defenders will soon be facing as these experimental models become commonly available services. As autonomous systems become more capable and more widely deployed, credential sweeps after breaches will become faster, more thorough, and harder to detect. Any enterprise running AI workloads, AI coding tools, or developer workflows on shared infrastructure has accumulated the same kind of exposure that made these headline-grabbing attacks successful: service accounts whose permissions grew beyond their original purpose, API keys that were never rotated, and secrets left in plaintext on developer devices because they were easier to use that way. In the face of what is coming, strengthe ## Can AI do novel security research? Meet the HTTP Terminator DevFeed: [Can AI do novel security research? Meet the HTTP Terminator]() Original publisher: [Read original article]() Author: James Kettle Published: 2026-08-05T19:30:00Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [AI research agents](), [web applications]() Tags: [ai](), [automation](), [autonomous](), [exploits](), [generative-ai](), [http](), [research](), [security]() ### AI overview The article examines whether autonomous AI systems can discover novel web-security attack techniques. It presents the HTTP Terminator, describes HTTP desynchronization research and exploits, and explores the limits of fully autonomous versus human/AI research loops. ### Source excerpt Abstract We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Buildi ## Stronger with every update: How we're making Chrome and the web safer in the AI Era DevFeed: [Stronger with every update: How we're making Chrome and the web safer in the AI Era]() Original publisher: [Read original article]() Author: Chrome Security Team Published: 2026-07-30T17:00:00Z Content type: article Language: en Sources: [Security]() Topics: [Chrome](), [Security](), [Vulnerabilities](), [Artificial Intelligence](), [Large Language Model](), [Fuzzing/Fuzz testing](), [Agent Harness](), [V8](), [JavaScript](), [interoperability](), [Resilience](), [Software]() Tags: [agent](), [ai](), [ai-models](), [bug](), [bugs](), [chrome](), [chrome-security](), [exploits](), [fuzzing](), [interoperability](), [javascript](), [none](), [resilience](), [security](), [vulnerabilities]() ### AI overview This article describes how Chrome's security teams use large language models, fuzzing, specialized research tools, and AI vulnerability-discovery agents to find and remediate security bugs more quickly. It highlights Big Sleep, an agent harness using Gemini, model interoperability, and a Chrome knowledge base built from CVEs and Git history. ### Source excerpt Video of Chrome logo turning into a shield ## Building secure Uniswap v4 hooks DevFeed: [Building secure Uniswap v4 hooks]() Original publisher: [Read original article]() Author: "Nicolas Donboly" Published: 2026-07-30T11:00:00Z Content type: article Language: en Sources: [The Trail of Bits Blog](), [The Trail of Bits Blog]() Topics: [Security](), [Code](), [Authorization](), [Architecture & Design](), [incident]() Tags: [audits](), [blockchain](), [code](), [developers](), [development](), [exploits](), [incident](), [review](), [security](), [vulnerabilities]() ### AI overview Uniswap v4 hooks add customizable pool behavior but shift important security responsibilities into application and hook code. Drawing on audit findings and public reports, the article identifies recurring failure patterns--including missing caller checks and accounting bugs--and presents them as a checklist for builders and auditors. ### Source excerpt Uniswap v4 hooks let developers add custom behavior to pools, including dynamic fees, custom accounting, and external integrations. This flexibility moves some security responsibilities into application and hook code. The Cork and Bunni exploits are two app-level incidents that show what can go wrong in that code. Together, they account for more than $20M in losses. Neither incident stemmed from a flaw in the Uniswap v4 core protocol or the PoolManager; both arose from application-specific authorization and accounting logic built around hooks. After analyzing dozens of findings from Trail of Bits audits (including our Uniswap v4-core security review), public reports from other firms, and the Solodit database, I've identified seven recurring failure patterns in application and hook code, including missing caller checks and accounting bugs that still satisfy the PoolManager's settlement invariant. Builders can use these patterns as a secure-development checklist; auditors can use them to focus their review. What the PoolManager guarantees If you're familiar with Uniswap v3, where each pool was a separate contract, v4 inverts the model. All pool state now lives in a singleton PoolManager contract, with each pool represented in its storage. Uniswap v4 adds hooks: independent contracts that execute custom logic at specific points in the swap and liquidity lifecycle. Figure 1: Pools live inside the singleton PoolManager, and multiple pools can use the same hook contract. Here's what a pool looks like in v4: struct PoolKey { Currency currency0; Currency currency1; uint24 fee; int24 tickSpacing; IHooks hooks; } Figure 2: A pool's PoolKey includes both currencies, the fee, tick spacing, and the hook address (v4-core/src/types/PoolKey.sol). Notice that the hook address (IHooks hooks;) is part of the pool's identity. If you change any of these fields, you're talking to a different pool. This matters because trusting the wrong PoolKey means trusting the wrong pool. v4 also intr ## Factoring "short-sleeve" RSA keys with polynomials DevFeed: [Factoring "short-sleeve" RSA keys with polynomials]() Original publisher: [Read original article]() Author: "Keegan Ryan" Published: 2026-06-12T11:00:00Z Content type: article Language: en Sources: [The Trail of Bits Blog](), [The Trail of Bits Blog]() Topics: [Vulnerabilities](), [Certificate Transparency](), [TLS (Transport Layer Security)](), [ssh](), [Open Source](), [Code]() Tags: [attacks](), [bug](), [certificate-transparency](), [code](), [cryptography](), [exploits](), [internet](), [open-source](), [software](), [ssh](), [tls](), [vulnerabilities]() ### AI overview Researchers found hundreds of weak RSA and DSA keys whose structured zero-bit patterns made them quickly factorable with a polynomial-based cryptanalytic technique. They linked many of the keys to a type mismatch in older CompleteFTP big-integer code and recovered 603 RSA private keys and 74 DSA keys from internet scans. ### Source excerpt What happens when the bits of an RSA private key are heavily biased toward 0 instead of being randomly generated? The public key's bits could be biased enough for us to detect these incorrectly generated keys in the wild. Together with Hanno Bรถck of the badkeys project, we found hundreds of unique keys that not only have this property, but can be quickly factored. We also found the bug that led to many of these keys and analyzed historical data to track the issue over time. Surprisingly, the pattern of 0 bits is often highly structured, allowing us to develop a powerful polynomial-based cryptanalytic technique that exploits the pattern. Figure 1: Two patterns of RSA moduli with repeated blocks of 0 bits seen in real-world examples. These "short-sleeve" keys, named for how the 0 bits don't fully cover the limbs of the big integers, largely fell into two patterns. Pattern 1 remains unexplained, but we traced pattern 2 to a type mismatch in big-integer code from old versions of the CompleteFTP file transfer software. The CompleteFTP bug also generated vulnerable short-sleeve DSA keys, and we recovered 603 unique RSA private keys and 74 DSA keys from internet scans. If you used CompleteFTP to generate host keys between December 2016 and December 2023, CompleteFTP has released a tool to check whether your keys need to be regenerated. How we found the weak keys The badkeys project is an open-source service that checks public keys for known vulnerabilities. While developing this tool, Hanno collected a massive number of real-world keys from public sources, including Certificate Transparency logs, internet-wide TLS and SSH scans, PGP keys, and many others. By searching this dataset for unexpectedly sparse RSA moduli, we uncovered a large number of keys in the wild with the patterns in Figure 1. Both patterns include several regularly spaced blocks of all zeros interleaved with seemingly random data. Pattern 1 appears in CT logs for certificates issued to several large organ ## The 2026 DBIR says the quiet part loud: fundamentals still win DevFeed: [The 2026 DBIR says the quiet part loud: fundamentals still win]() Original publisher: [Read original article]() Author: info@1password.com (Dave Lewis) Published: 2026-06-11T00:00:00Z Content type: article Language: en Sources: [Blog on 1Password Blog]() Topics: [Security](), [Vulnerabilities](), [ransomware](), [Cybercrime](), [Artificial Intelligence]() Tags: [ai](), [breach](), [exploits](), [ransomware](), [security](), [statistics](), [tips-advice](), [vulnerabilities]() ### AI overview The article reviews the 2026 Verizon Data Breach Investigations Report, arguing that basic security practices remain essential. It highlights rising vulnerability exploitation, slower remediation, ransomware prevalence, and the potential impact of AI on future vulnerabilities. ### Source excerpt Every year, the Verizon Data Breach Investigations Report (DBIR) is one of the most hotly-anticipated and widely-read documents in security. And every year includes some surprising stats and reshuffles the top few threat vectors. But longtime readers will notice that the 2026 DBIR features some advice that ought to be familiar to everyone by now: get the basics right. The report's authors even say that the overarching theme this year is "keeping a strong foundation in the face of change." So what does a strong foundation look like? It looks like patching faster, reducing credential reuse, tightening third-party access, and making it harder for attackers to turn one weak login into a company-wide mess. Glamorous? No. Effective? Yes. Exploits, credentials, and AI: The stories that stood out in the 2026 DBIR This year's DBIR analyzes more than 31,000 incidents, including more than 22,000 confirmed breaches across 145 countries. It's not light reading, unless your idea of a beach read includes ransomware economics, exploit chains, and the occasional donut chart. But diving deep into these topics is worthwhile, because the numbers show both change and stubborn repetition. Vulnerability exploitation is surging In terms of eye-popping statistics, the big story this year is the explosion of vulnerability exploitation, which is now the leading initial access vector for breaches-far exceeding phishing and credential abuse. Only 26% of critical vulnerabilities in the CISA Known Exploited Vulnerabilities catalog were fully remediated in 2025, down from 38% the prior year. Median time to full remediation rose to 43 days, a huge jump from last year's 32 days. Maybe the scariest part of this whole scenario is that these are pre-Mythos numbers, and security experts are still bracing for an AI-powered hurricane of vulnerabilities. The report's authors attribute this escalation to the sheer volume of vulnerabilities organizations had to face, finding that there were roughly 50% more ## 5 security myths that Mythos ended (as told by a CISO) DevFeed: [5 security myths that Mythos ended (as told by a CISO)]() Original publisher: [Read original article]() Published: 2026-05-27T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Security](), [Artificial Intelligence](), [Exploit](), [Vulnerabilities](), [anthropic](), [dataset]() Tags: [ai](), [ai-security](), [anthropic](), [anthropic-mythos-preview](), [chainguard-ai](), [chainguard-containers](), [cve](), [dataset](), [exploits](), [git](), [mythos](), [project-glasswing](), [security](), [vulnerabilities]() ### AI overview The article argues that Anthropic's Mythos and broader AI-driven vulnerability discovery are invalidating long-standing security assumptions. It focuses on shrinking exploitation timelines, the growing importance of proactive vulnerability elimination, and the need for security teams to retire reactive mental models. ### Source excerpt Mythos and AI-driven exploits are breaking old security assumptions. Learn the five myths security teams must retire to survive the new era. ## Preparing for Mythos: Practical advice for engineering teams DevFeed: [Preparing for Mythos: Practical advice for engineering teams]() Original publisher: [Read original article]() Published: 2026-05-26T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [ai security](), [Security](), [anthropic](), [exploit chaining](), [Vulnerabilities](), [open-source-security](), [cURL]() Tags: [advice](), [ai](), [ai-security](), [ai-vulnerability-remediation](), [anthropic](), [article](), [chainguard-containers](), [chainguard-for-ai](), [chainguard-libraries](), [engineering](), [exploit-chaining](), [exploits](), [mythos](), [secure-by-default](), [security](), [vulnerabilities](), [work]() ### AI overview This opinion assesses the security implications of Anthropic's Mythos model and argues that defenders should use AI-assisted methods to identify and remediate vulnerabilities. It says Mythos appears especially capable at exploiting vulnerabilities and chaining exploits, while a test on curl found one new non-critical vulnerability. ### Source excerpt Anthropic's Mythos raises the stakes for software security. Learn how to survive faster exploits with secure-by-default supply chains and AI-assisted defense. ## May 2026 Updates #3 for XCP-ng 8.3 LTS DevFeed: [May 2026 Updates #3 for XCP-ng 8.3 LTS]() Original publisher: [Read original article]() Author: Samuel Verschelde Published: 2026-05-21T15:29:19Z Content type: news Language: en Sources: [XCP-ng Blog]() Topics: [Security](), [Vulnerabilities](), [Linux](), [Kernel](), [cpu]() Tags: [2026](), [bugfixes](), [cpu](), [cve](), [exploits](), [firmware](), [hardware](), [improvements](), [intel](), [linux-kernel](), [lts](), [security](), [update](), [updates](), [vulnerabilities]() ### AI overview XCP-ng 8.3 LTS receives security and maintenance updates addressing vulnerabilities in Xen and the Linux kernel, including CPU opcode caching and local privilege-escalation issues. The update also includes Intel microcode, firmware guidance, storage and Xen bug fixes, NUMA fixes, and dependency upgrades. ### Source excerpt New security and maintenance updates are available for XCP-ng 8.3 LTS. Xen, Linux kernel, Intel Microcode... ## Kubernetes v1.36: Deprecation and removal of Service ExternalIPs DevFeed: [Kubernetes v1.36: Deprecation and removal of Service ExternalIPs]() Original publisher: [Read original article]() Author: Adrian Moisey; Dan Winship Published: 2026-05-14T18:35:00Z Content type: article Language: en Sources: [Kubernetes Blog]() Topics: [Kubernetes](), [Security](), [Network](), [API](), [Cloud]() Tags: [api](), [exploits](), [ip](), [kubernetes](), [network](), [release](), [security](), [update]() ### AI overview Kubernetes 1.36 formally deprecates the Service API's .spec.externalIPs field because its trust assumptions can enable security exploits, including CVE-2020-8554. The article explains the scope of the deprecation, recommends the DenyServiceExternalIPs admission controller, and discusses alternatives for non-cloud clusters needing load-balancer-like functionality. ### Source excerpt The .spec.externalIPs field for Service was an early attempt to provide cloud-load-balancer-like functionality for non-cloud clusters. Unfortunately, the API assumes that every user in the cluster is fully trusted, and in any situation where that is not the case, it enables various security exploits, as described in CVE-2020-8554. Since Kubernetes 1.21, the Kubernetes project has recommended that all users disable .spec.externalIPs. To make that easier, Kubernetes also added an admission controller (DenyServiceExternalIPs) that can be enabled to do this. At the time, SIG Network felt that blocking the functionality by default was too large a breaking change to consider. However, the security problems are still there, and as a project we're increasingly unhappy with the "insecure by default" state of the feature. Additionally, there are now several better alternatives for non-cloud clusters wanting load-balancer-like functionality. As a result, the .spec.externalIPs field for Service is now formally deprecated in Kubernetes 1.36. We expect that a future minor release of Kubernetes will drop implementation of the behavior from kube-proxy, and will update the Kubernetes conformance criteria to require that conforming implementations do not provide support. A note on terminology, and what hasn't been deprecated The phrase external IP is somewhat overloaded in Kubernetes: The Service API has a field .spec.externalIPs that can be used to add additional IP addresses that a Service will respond on. The Node API's .status.addresses field can list addresses of several different types, one of which is called ExternalIP. The kubectl tool, when displaying information about a Service of type LoadBalancer in the default output format, will show the load balancer IP address under the column heading EXTERNAL-IP. This deprecation is about the first of those. If you are not setting the field externalIPs in any of your Services, then it does not apply to you. That said, as a precaution ## AI and the Future of Cybersecurity: Why Openness Matters DevFeed: [AI and the Future of Cybersecurity: Why Openness Matters]() Original publisher: [Read original article]() Author: Margaret Mitchell; Yacine Jernite; Clem ๐Ÿค— Published: 2026-04-21T00:00:00Z Content type: article Language: en Sources: [Hugging Face - Blog]() Topics: [Artificial Intelligence](), [Cybersecurity](), [Large Language Model](), [Vulnerabilities](), [AI Development](), [Open Source](), [Code]() Tags: [agentic-ai](), [agents](), [ai](), [ai-cybersecurity](), [code](), [community](), [cybersecurity](), [development](), [ethics](), [exploits](), [large-language-model](), [llm](), [open-source](), [vulnerabilities]() ### AI overview The article examines Mythos, a frontier AI system built around a large language model, compute, software-relevant data, vulnerability-focused scaffolding, speed, and partial autonomy. It argues that the surrounding system--not the model alone--enables rapid vulnerability discovery, exploit identification, and patch development. The article also considers how open code and tooling could distribute cybersecurity capabilities across communities as autonomous vulnerability systems proliferate. ### Source excerpt We're on a journey to advance and democratize artificial intelligence through open source and open science. ## Supply chain dependencies: Have you checked your blind spot? DevFeed: [Supply chain dependencies: Have you checked your blind spot?]() Original publisher: [Read original article]() Author: Tony Anscombe Published: 2026-04-16T12:00:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Resilience](), [Business Security](), [Cybersecurity](), [Vulnerabilities](), [data]() Tags: [business](), [business-security](), [compliance](), [customer](), [cybersecurity](), [data](), [exploits](), [operations](), [outage](), [resilience](), [software](), [supply-chain](), [vulnerabilities]() ### AI overview The article examines supply chain dependencies as hidden sources of cyber and business risk for small and medium-sized businesses. It explains how third-party vulnerabilities, malicious attacks, and operational outages can disrupt operations and cause financial, reputational, legal, compliance, and data-related harm. It recommends mapping dependencies and strengthening resilience and business continuity. ### Source excerpt Your biggest risk may be a vendor you trust. How can SMBs map their third-party blind spots and build operational resilience? ## ETH Rangers Program Recap DevFeed: [ETH Rangers Program Recap]() Original publisher: [Read original article]() Author: Protocol Security Team; Grants Management Team Published: 2026-04-16T00:00:00Z Content type: article Language: en Sources: [Ethereum Foundation Blog]() Topics: [Ethereum](), [Security](), [Vulnerabilities](), [Incident response](), [Threat Research](), [Open Source](), [DeFi]() Tags: [community](), [defi](), [ethereum](), [exploits](), [incident-response](), [open-source](), [root-cause-analysis](), [security](), [smart-contract](), [state](), [talks](), [threat-intelligence](), [vulnerabilities](), [web3](), [workshops]() ### AI overview The Ethereum Foundation and partner organizations recap the six-month ETH Rangers Program, which funded 17 stipend recipients conducting public-goods security work across the Ethereum ecosystem. Reported outcomes include recovered or frozen funds, vulnerability and bug reports, threat-awareness work, security challenges, educational events, incident responses, and open-source tooling. ### Source excerpt In late 2024, the Ethereum Foundation, together with Secureum, The Red Guild, and Security Alliance (SEAL), launched the ETH Rangers Program, an initiative to provide stipends for individuals doing public goods security work in the Ethereum ecosystem. The goal of the program was straightforward: to fund independent efforts that... ## As breakout time accelerates, prevention-first cybersecurity takes center stage DevFeed: [As breakout time accelerates, prevention-first cybersecurity takes center stage]() Original publisher: [Read original article]() Author: Phil Muncaster Published: 2026-04-07T09:00:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Cybersecurity](), [Threat Research](), [Artificial Intelligence](), [Automation](), [MFA](), [passwords](), [Reconnaissance](), [Social engineering](), [spoofing](), [ransomware]() Tags: [ai](), [ai-automation](), [attacks](), [authentication](), [automation](), [business-security](), [cybersecurity](), [exploits](), [malware](), [mfa](), [passwords](), [phishing](), [ransomware](), [social-engineering](), [tools]() ### AI overview Threat actors are using AI, automation, credential theft, phishing, zero-day exploits, reconnaissance, and AI-powered scripts to accelerate attacks. The article argues that shrinking breakout times require defenders to adopt a prevention-first cybersecurity strategy. ### Source excerpt Threat actors are using AI to supercharge tried-and-tested TTPs. When attacks move this fast, cyber-defenders need to rethink their own strategy. ## Your personal information is on the dark web. What happens next? DevFeed: [Your personal information is on the dark web. What happens next?]() Original publisher: [Read original article]() Author: Phil Muncaster Published: 2026-01-13T10:00:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [online privacy](), [pii](), [Cybercrime](), [Malware](), [ransomware](), [Authentication](), [MFA](), [Artificial Intelligence]() Tags: [attacks](), [authentication](), [breach](), [data](), [exploits](), [fraud](), [genai](), [generative](), [malware](), [mfa](), [phishing](), [pii](), [privacy](), [ransomware](), [us]() ### AI overview This article explains what may happen when personal information appears on the dark web, including fraud and account hijacking. It describes data breaches, infostealer malware, ransomware-related extortion, phishing, and generative AI-assisted attacks as routes by which personal and financial data can be exposed and sold. ### Source excerpt If your data is on the dark web, it's probably only a matter of time before it's abused for fraud or account hijacking. Here's what to do. ## exploits.club Weekly(ish) Newsletter 93 - Old QEMU Bugs, Android Auto Bluetooth PoCs, BeeStation P20, and More DevFeed: [exploits.club Weekly(ish) Newsletter 93 - Old QEMU Bugs, Android Auto Bluetooth PoCs, BeeStation P20, and More]() Original publisher: [Read original article]() Author: exploits.club Published: 2025-12-11T16:24:59Z Content type: article Language: en Sources: [exploits.club]() Topics: [qemu](), [Exploit](), [vulnerability](), [Synology](), [Hardware](), [HTTP](), [container]() Tags: [bugs](), [exploit](), [exploits](), [firmware](), [hardware](), [newsletter](), [qemu](), [synology](), [vault](), [vulnerability](), [weekly]() ### AI overview This issue of the exploits.club Weekly(ish) Newsletter rounds up security write-ups and resources, including a QEMU privilege-level bug that can enable arbitrary writes, a Synology BeeStation exploit involving a stack-based buffer overflow, and research into the Cypherock X1 Vault hardware wallet. The supplied text ends before the final item is complete. ### Source excerpt Welcome back to your favorite "mostly weekly but sometimes whenever we feel like it" newsletter. Annnnnnyways ๐Ÿ‘‡ In Case You Missed It... HEXACON Videos Are OUT Advent Of Pwn - PwnCollege's Advent Of Pwn ends today. If you haven't already given it a go, make ## exploits.club Weekly(ish) Newsletter 92 - S23 N-Day PoCs, Printer Overflows, DNG OOB Writes, And More DevFeed: [exploits.club Weekly(ish) Newsletter 92 - S23 N-Day PoCs, Printer Overflows, DNG OOB Writes, And More]() Original publisher: [Read original article]() Author: exploits.club Published: 2025-11-21T16:10:47Z Content type: article Language: en Sources: [exploits.club]() Topics: [Hacking](), [Exploit](), [Security](), [Vulnerabilities](), [Linux](), [Kernel](), [GPU](), [Qualcomm](), [samsung](), [Android](), [ctf](), [Advent of Code]() Tags: [android](), [code](), [ctf](), [exploits](), [gpu](), [hacking](), [kernel](), [linux](), [newsletter](), [printer](), [qualcomm](), [samsung]() ### AI overview The 92nd exploits.club Weekly(ish) Newsletter rounds up recent developer and security content, including Advent-themed CTFs, Advent of Code 2025, Binary Ninja 5.2, conference slides, an exploit for Qualcomm GPU microcode vulnerability CVE-2025-21479 on a Samsung S23, Linux KASLR research, and printer security flaws. ### Source excerpt We are so back. Annnnnyways ๐Ÿ‘‡ In Case You Missed It... HEX ADVENT 2025: Crack the Advent, Conquer the Threat - STAR Labs has put together a Holiday Themed CTF open to women residing in Singapore or Malaysia. Advent of Code 2025 - It's almost the most wonderful time of ## Burp AI takes on a vulnerable web app: watch Tib3rius put Burp's new agentic capabilities to the test DevFeed: [Burp AI takes on a vulnerable web app: watch Tib3rius put Burp's new agentic capabilities to the test]() Original publisher: [Read original article]() Author: Amelia Coen Published: 2025-10-22T12:59:05Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Artificial Intelligence](), [Web app](), [Testing](), [Vulnerabilities]() Tags: [agentic](), [ai](), [blog](), [blog-post](), [exploits](), [false-positives](), [real-time](), [testing](), [video](), [vulnerabilities](), [web-app](), [workflow]() ### AI overview A video demonstrates Burp AI testing a deliberately vulnerable web app. It shows Burp AI autonomously exploiting discovered vulnerabilities, identifying false positives, and using agentic capabilities in Repeater to adapt payloads and approaches through natural-language prompts. ### Source excerpt What happens when you set Burp AI loose on a deliberately vulnerable web app? In his latest video, Tib3rius takes Burp's new agentic Burp AI capabilities for a spin - and the results are seriously coo [Next page]()