# vulnerability Published articles for vulnerability. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Раскрыта уязвимость BrokenPipe в клиенте Steam, которая позволяет повысить привилегии в Windows до SYSTEM DevFeed: [Раскрыта уязвимость BrokenPipe в клиенте Steam, которая позволяет повысить привилегии в Windows до SYSTEM]() Original publisher: [Read original article]() Author: denis-19 Published: 2026-09-17T02:25:27Z Content type: news Language: ru Sources: [Tagir Valeev]() Topics: [vulnerability](), [Exploit](), [client](), [Windows](), [Windows 11]() Tags: [2026](), [brokenpipe](), [poc](), [steam](), [vulnerability](), [windows]() ### AI overview A developer disclosed BrokenPipe, a critical zero-day privilege-escalation vulnerability in Steam Client Service on Windows. The published proof of concept reportedly allows a local user with code execution to run a launcher with SYSTEM privileges. The issue was reportedly disclosed to Valve in March 2026 and had not been fixed at the time described. ### Source excerpt Разработчик Джейдип Модхвадия (aka KillaBoi) раскрыл информацию о критической уязвимости нулевого дня (BrokenPipe - Steam Client Service LPE Vulnerability) в клиенте Steam в Windows, использование которой позволяет любому обычному пользователю незаметно повысить права в системе до полных привилегий SYSTEM. Читать далее ## CISA decides weekly vulnerability bulletin isn't necessary anymore DevFeed: [CISA decides weekly vulnerability bulletin isn't necessary anymore]() Original publisher: [Read original article]() Author: Brandon Vigliarolo Published: 2026-09-16T20:33:48Z Content type: article Language: en Sources: [www.theregister.com - Articles]() Topics: [cisa](), [vulnerability](), [Security]() Tags: [cisa](), [common-vulnerability-scoring-system](), [infosec](), [security](), [vulnerability]() ### AI overview CISA is ending its weekly vulnerability bulletin on September 28, shifting from static CVSS scores to risk-based prioritization. ### Source excerpt Agency's shift from static CVSS scores to risk-based prioritization sends the old format packing September 28 ## Google's September 2026 Pixel update addresses a modem vulnerability reportedly under limited, targeted exploitation DevFeed: [Google's September 2026 Pixel update addresses a modem vulnerability reportedly under limited, targeted exploitation]() Original publisher: [Read original article]() Author: Pieter Arntz Published: 2026-09-16T10:39:04Z Content type: news Language: en Sources: [Malwarebytes]() Topics: [Google](), [pixel](), [Vulnerabilities](), [Android Security](), [Security & Privacy](), [Mobile]() Tags: [android-security](), [bugs](), [cve-2026-58704](), [google](), [mobile](), [modem](), [news](), [pixel](), [security](), [update](), [vulnerabilities](), [vulnerability]() ### AI overview Google's September 2026 Pixel security update fixes 110 vulnerabilities, including CVE-2026-58704, a high-severity cellular modem permission-bypass flaw that may be under limited, targeted exploitation. Pixel users should install the update and verify that their device shows the September 5, 2026 security patch level or later. ### Source excerpt Google's September Pixel update fixes 110 vulnerabilities, including a modem flaw being used in limited, targeted attacks. ## Rustls 0.23.45 Released To Fix Two Year Old Security Issue DevFeed: [Rustls 0.23.45 Released To Fix Two Year Old Security Issue]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-09-14T15:35:11Z Content type: news Language: en Sources: [Phoronix]() Topics: [TLS (Transport Layer Security)](), [Security](), [vulnerability](), [Rust](), [Memory Safety](), [Go Language]() Tags: [bugs](), [desktop-linux](), [go](), [library](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-performance](), [linux-server-benchmarks](), [open-source-graphics](), [phoronix](), [phoronix-test-suite](), [rust](), [rustls](), [security](), [tls](), [ubuntu-benchmarks](), [ubuntu-hardware](), [vulnerability]() ### AI overview Rustls 0.23.45 fixes a vulnerability in which TLS 1.3 handshake messages sent at the wrong encryption level could be accepted as plaintext after a key-changing message. The issue was present since Rustls 0.23.13 and could allow an on-path attacker to inject plaintext messages, although the authenticated handshake transcript prevented altering or completing the handshake. ### Source excerpt While the Rustls modern TLS library is written in the Rust programming language with a focus on memory safety, as we've seen out of other Rust project re-implementations in the past, the new implementations can lead to other security bugs of their own. Out today is Rustls 0.23.45 to fix a security issue introduced back in 2024 with Rustls while the likes of OpenSSL, BoringSSL, and others are unaffected... ## Emacs arbitrary code execution flaw DevFeed: [Emacs arbitrary code execution flaw]() Original publisher: [Read original article]() Author: jzb Published: 2026-09-14T15:20:00Z Content type: news Language: en Sources: [LWN.net]() Topics: [Lisp](), [vulnerability](), [Maintainers]() Tags: [cve](), [emacs](), [maintainers](), [release](), [vulnerability]() ### AI overview An incomplete fix for the Emacs arbitrary code execution flaw CVE-2024-53920 has been identified. Viewing or editing untrusted files in modes other than Emacs's Lisp mode can also trigger arbitrary code execution. The issue affects Emacs 24 and newer, with a minimal fix queued for Emacs 31.2; upstream maintainers do not expect to backport it to older releases. ### Source excerpt Sean Whitton has announced that the original fix for an arbitrary code execution flaw in Emacs (CVE-2024-53920) was incomplete. Bas Alberts discovered that viewing or editing untrusted files in modes other than Emacs's Lisp mode can also result in arbitrary code execution. This problem affects all Emacs versions affected by CVE-2024-53920. This means Emacs 24 and newer, and possibly also older versions. A minimal fix, attached, is queued up for release with Emacs 31.2. We (the Emacs upstream maintainers) don't expect to backport the fix to older Emacs releases ourselves. LWN covered the original vulnerability in December 2024. ## Uptime Kuma 2.5.4 Patches Critical JSONata Code Execution Flaw DevFeed: [Uptime Kuma 2.5.4 Patches Critical JSONata Code Execution Flaw]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-09-14T06:55:25Z Content type: article Language: en Sources: [Self Host Lab]() Topics: [Security](), [vulnerability](), [Monitoring](), [configuration]() Tags: [2026](), [cve](), [dependency](), [monitoring](), [monitoring-news](), [news](), [security](), [update](), [uptime-kuma-2-5-4](), [vulnerability]() ### AI overview Uptime Kuma 2.5.4 fixes a critical JSONata vulnerability that could enable arbitrary code execution on the monitor host, along with a second denial-of-service issue. The release updates jsonata to 2.2.2 and also adds an SFTP monitor type and three notification providers. ### Source excerpt Uptime Kuma 2.5.4 patches a critical-rated code execution flaw in the JSONata library (CVE-2026-77415, CVSS 9.3) plus a second denial-of-service fix, and adds an SFTP monitor type and three new notification providers. Here's what the flaw actually requires to exploit, and how to update. ## Forgejo 16.0.4 and 15.0.8 Fix Critical Repository Template RCE DevFeed: [Forgejo 16.0.4 and 15.0.8 Fix Critical Repository Template RCE]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-09-12T06:40:18Z Content type: article Language: en Sources: [Self Host Lab]() Topics: [vulnerability](), [releases](), [Security](), [Template](), [Authorization](), [API](), [Git]() Tags: [api](), [docker-containers](), [docker-containers-news](), [forgejo](), [git](), [news](), [release](), [security](), [self-hosted](), [update](), [vulnerability]() ### AI overview Forgejo 16.0.4 and 15.0.8 fix a critical remote code execution vulnerability in repository-template creation, along with an API authorization bypass. The article explains how malicious template variables could restore a .git directory with executable hooks and urges affected self-hosted instances to update. ### Source excerpt Forgejo 16.0.4 and 15.0.8 patch a critical remote code execution vulnerability in repository templates, tracked as CVE-2026-89094 with a CVSS score of 9.9, plus a narrower API permission bypass. Any instance on 16.0.3 or earlier, or 15.0.7 or earlier on the LTS branch, is vulnerable. Here's what happened, why it matters, and how to update. ## Claims About RubyGems Caching and RubyDoc Code Execution DevFeed: [Claims About RubyGems Caching and RubyDoc Code Execution]() Original publisher: [Read original article]() Published: 2026-09-12T00:02:11Z Content type: opinion Language: en Sources: [Aaron Patterson]() Topics: [rubygems](), [Caching](), [vulnerability](), [Docker](), [Web Scraping]() Tags: [caching](), [docker](), [rubygems](), [scraping](), [vulnerability]() ### AI overview An opinion post discusses alleged RubyGems activity involving a caching vulnerability and web scraping. It also describes how published gems can cause RubyDoc.info to run YARD-loaded code in a networked Docker container. ### Source excerpt Today Reuters and the Wall Street Journal both reported about rogue AI agents at OpenAI attacking RubyGems.org. https://www.rubyhack.ai/ has an amazing writeup, and you should read it. I just wanted to make a quick post about it because it's wild. TL;DR: It seems like OpenAI Bots knew about the RubyGems caching vulnerability, tried to take advantage of it, and at the same time ran some weird web scraping code on RubyDoc.info. Back in May, socket.dev reported about a "GemStuffer Campaign" where someone (I guess OpenAI) was uploading tons of junk gems to RubyGems.org. For some reason, the gems would scrape UK government websites, then repackage the data as gems, and attempt to upload them to RubyGems. I honestly didn't think much about this (or even look into it) until Sydney Von Arx and Spencer Kitts (both co-authors on https://www.rubyhack.ai) contacted me asking about RubyGems. I thought the claims they were making were completely outlandish until I actually read the code in these "GemStuffer" gems. After reading the code in these gems, a couple things stood out to me. YARD Documentation First, the gems leverage YARD documentation to execute arbitrary code on host machines. In most of the examples you'll see a .yardopts file that looks like this: --load ./script.rb README.md lib/**/*.rb Here's a link to an example. If you have YARD installed, and you install this gem, then YARD will load and run whatever is in ./script.rb from inside the gem. I think it's pretty common knowledge that C extensions will execute extconf.rb (so you basically have an RCE vector), but I was surprised to find out that a documentation tool would do that too. Nobody is going to install a gem named slnleaker5 though, so why would this matter? Well, any time a Gem is published RubyDoc.info will download the gem and process the YARD documentation. RubyDoc.info will execute the arbitrary code inside a Docker container. The Docker container still has network access though, so these gems could ha ## More JFrog Artifactory bugs under attack, and all 3 have patches DevFeed: [More JFrog Artifactory bugs under attack, and all 3 have patches]() Original publisher: [Read original article]() Author: Jessica Lyons Published: 2026-09-11T17:43:30Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [Cybersecurity]() Tags: [bugs](), [cyber-crime](), [cybersecurity](), [security](), [vulnerability]() ### AI overview Three JFrog Artifactory bugs are under attack, and patches are available. ### Source excerpt If you're waiting for a sign to upgrade to a fixed version: this is it ## LTM Builds a Lightwell Remediation Services Practice Around IBM and Red Hat's $5B Open-Source Program DevFeed: [LTM Builds a Lightwell Remediation Services Practice Around IBM and Red Hat's $5B Open-Source Program]() Original publisher: [Read original article]() Author: Harold Fritts Published: 2026-09-11T16:35:51Z Content type: news Language: en Sources: [StorageReview.com]() Topics: [ibm](), [open-source-security](), [supply-chain-security](), [Security](), [vulnerability](), [DevSecOps](), [Deployment](), [Open Source](), [Artificial Intelligence]() Tags: [ai](), [deployment](), [devsecops](), [enterprise](), [ibm](), [open-source](), [open-source-software](), [red-hat](), [security](), [software-supply-chain](), [testing](), [vulnerability]() ### AI overview LTM is developing a remediation services practice around IBM and Red Hat's Lightwell program, which provides AI-generated, vendor-validated fixes for open-source software vulnerabilities. The offering is intended to help customers plan, prioritize, test, validate, and deploy patches at scale. ### Source excerpt LTM, the Larsen & Toubro Group services company that was LTIMindtree until its February rebrand, is building a Lightwell remediation services practice around the $5 billion IBM and Red Hat program for securing open-source software with AI-generated, vendor-validated fixes. IBM's clearinghouse produces validated, production-ready patches for open-source dependencies; LTM's job is getting them into customer The post LTM Builds a Lightwell Remediation Services Practice Around IBM and Red Hat's $5B Open-Source Program appeared first on StorageReview.com. ## EU's Cyber Resilience Act starts the 24-hour vulnerability clock DevFeed: [EU's Cyber Resilience Act starts the 24-hour vulnerability clock]() Original publisher: [Read original article]() Author: Connor Jones Published: 2026-09-11T11:34:41Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [vulnerability](), [Cybersecurity]() Tags: [resilience](), [security](), [vulnerability]() ### AI overview The article reports that the EU Cyber Resilience Act requires manufacturers to disclose actively exploited vulnerabilities and severe security incidents through ENISA's reporting platform. ### Source excerpt Manufacturers must now disclose actively exploited flaws and severe security incidents through ENISA's new reporting platform ## Forgejo 16.0.4 and 15.0.8 address critical security vulnerability DevFeed: [Forgejo 16.0.4 and 15.0.8 address critical security vulnerability]() Original publisher: [Read original article]() Author: jzb Published: 2026-09-10T20:05:50Z Content type: release Language: en Sources: [LWN.net]() Topics: [Vulnerabilities]() Tags: [git](), [release](), [security](), [vulnerability]() ### AI overview Forgejo 16.0.4 and 15.0.8 fix two security vulnerabilities, including a critical remote-code-execution flaw involving template repository expansion. The fix removes any .git directory after expansion and before repository initialization. ### Source excerpt The Forgejo software-forge project has announced the release of versions 16.0.4 and 15.0.8, which fixes two security vulnerabilities. One is a critical flaw that would allow remote-code execution (RCE): When generating a new repository from a template repository, Forgejo clones the template repository, removes the .git folder, performs variable template expansion on files listed in .forgejo/template, and initializes a new git repository. During this process, variable template expansion could be misused in order to create a new .git folder, which git would adopt and incorporate during its initialization of a new git repository. A malicious template repository could be used to read arbitrary data from the Forgejo host, and to execute arbitrary processes on the Forgejo host, as a remote code execution attack. To address this issue, after variable expansion is completed, any existing .git folder is removed from the directory before the git repository is initialized. The project recommends upgrading to the latest version as soon as possible. ## AI floods security teams with flaws -- business context sets priorities DevFeed: [AI floods security teams with flaws -- business context sets priorities]() Original publisher: [Read original article]() Author: Megan Carnegie Published: 2026-09-10T12:00:00Z Content type: article Language: en Sources: [The New Stack]() Topics: [vulnerability](), [Cybersecurity](), [Business Security]() Tags: [ai](), [business](), [cloud-services](), [i-o-mergent](), [post](), [security](), [sponsor-i-o-mergent](), [sponsored](), [sponsored-post](), [vulnerability]() ### AI overview The article argues that security teams should prioritize vulnerabilities using business context rather than scanner severity alone, because automated findings can overwhelm limited engineering capacity. ### Source excerpt A security researcher testing a 300-person B2B company with a global footprint discovered an internet-exposed database with weak authentication during The post AI floods security teams with flaws -- business context sets priorities appeared first on The New Stack. ## Update Chrome now to protect against an actively exploited vulnerability DevFeed: [Update Chrome now to protect against an actively exploited vulnerability]() Original publisher: [Read original article]() Author: Pieter Arntz Published: 2026-09-10T10:52:08Z Content type: news Language: en Sources: [Malwarebytes]() Topics: [Vulnerabilities](), [bug]() Tags: [browser](), [bugs](), [chrome](), [javascript](), [memory](), [news](), [sandbox](), [security](), [stable-channel](), [update](), [vulnerability](), [webgl]() ### AI overview Chrome's desktop update fixes 230 security issues, including CVE-2026-87491, an actively exploited V8 out-of-bounds write flaw. The article explains how to update Chrome and describes the vulnerability's potential impact within the browser sandbox. ### Source excerpt Chrome issues another monster update, fixing an actively exploited V8 vulnerability and 229 other flaws. ## Expanding AI access and cyber defense for federal, state, local, and tribal governments DevFeed: [Expanding AI access and cyber defense for federal, state, local, and tribal governments]() Original publisher: [Read original article]() Published: 2026-09-10T07:00:00Z Content type: news Language: en Sources: [OpenAI News]() Topics: [Artificial Intelligence](), [Threat Research](), [vulnerability](), [Malware]() Tags: [ai](), [chatgpt](), [global-affairs](), [government](), [malware](), [openai](), [public-sector](), [security](), [vulnerability]() ### AI overview OpenAI and the GSA announced a multi-year agreement offering eligible U.S. government users waived license fees, discounted usage, and expanded support for cyber defenders. ### Source excerpt OpenAI and GSA will offer eligible federal, state, local, and tribal governments $0 license fees, 50% off usage, and expanded cyber defense support. ## OpenAI gave an AI the power to block its own engineers' code DevFeed: [OpenAI gave an AI the power to block its own engineers' code]() Original publisher: [Read original article]() Author: Amanda Caswell Published: 2026-09-09T19:53:08Z Content type: news Language: en Sources: [The New Stack]() Topics: [Code review](), [Pull Request](), [vulnerability](), [LLM evaluation / benchmarking](), [Deployment]() Tags: [ai](), [ai-engineering](), [benchmark](), [codex](), [model](), [openai](), [pull-request](), [review](), [security](), [software-development](), [vulnerability]() ### AI overview OpenAI uses automated AI security review for every engineer pull request, blocking merges when a vulnerability is found. The article describes specialized code-review models, benchmarking claims, and a shift in human review toward discussing intent earlier in development. ### Source excerpt Every pull request submitted by an OpenAI engineer now goes through an automated security review, and the AI model can The post OpenAI gave an AI the power to block its own engineers' code appeared first on The New Stack. ## The state of AI for security: Measuring what matters most for building trust DevFeed: [The state of AI for security: Measuring what matters most for building trust]() Original publisher: [Read original article]() Author: Anshumali Shrivastava Published: 2026-09-09T19:09:14Z Content type: article Language: en Sources: [AWS Security Blog]() Topics: [Cybersecurity](), [Vulnerabilities](), [dataset]() Tags: [advanced-300](), [ai](), [artificial-intelligence](), [benchmark](), [cybersecurity](), [generative-ai](), [machine-learning](), [open-source](), [security](), [security-blog](), [security-identity-compliance](), [thought-leadership](), [vulnerability](), [vulnerability-management]() ### AI overview The article introduces Deception Benchmark, a benchmark for evaluating whether AI models can distinguish real software vulnerabilities from safe code that appears risky. It argues that reducing false alarms is central to making AI security tools trustworthy and compares this focus with existing security evaluations. ### Source excerpt Security teams are starting to actively use AI for security work, including vulnerability triage, penetration testing, threat modeling, incident response, and code review. The promise is speed, but a security tool that moves fast and raises too many false alarms doesn't save time. Engineers spend time on false alarms, on-call is noisier, and teams distrust [...] ## Serial Microsoft 0-day hunter drops yet another Defender exploit DevFeed: [Serial Microsoft 0-day hunter drops yet another Defender exploit]() Original publisher: [Read original article]() Author: Jessica Lyons Published: 2026-09-09T17:23:00Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [Cybersecurity](), [Microsoft]() Tags: [cybersecurity](), [defender](), [microsoft](), [security](), [vulnerability](), [windows]() ### AI overview The article reports another Microsoft Defender exploit, characterized as a bypass of prior bypasses. ### Source excerpt A bypass of a bypass of a bypass ## EU Cyber Resilience Act: Vulnerability Reporting Obligations DevFeed: [EU Cyber Resilience Act: Vulnerability Reporting Obligations]() Original publisher: [Read original article]() Author: John Lee Published: 2026-09-09T00:00:00Z Content type: article Language: en Sources: [Blog on Developer Portal]() Topics: [cyber resilience act](), [Vulnerabilities](), [Espressif](), [ESP32](), [ESP-IDF](), [Security](), [EN 18031]() Tags: [blog](), [cyber-resilience-act](), [en-18031](), [esp-idf](), [esp32](), [espressif](), [eu](), [iot](), [security](), [vulnerability]() ### AI overview This article explains that the Cyber Resilience Act's vulnerability-reporting obligations begin on 11 September 2026 for connected products sold in the EU, including products already on the market. It outlines Article 14 duties, reporting recipients and the role of Espressif's platform layer for products built on ESP32. ### Source excerpt The CRA's vulnerability reporting obligations start on 11 September 2026 and apply to products already on the market, including ones sold years ago. What Article 14 requires, which duties run to whom, how reporting works through the ENISA Single Reporting Platform, and where the Espressif platform layer fits. ## Claude Mythos 5 is coming to Tenable One, powering the new "Adversary View" DevFeed: [Claude Mythos 5 is coming to Tenable One, powering the new "Adversary View"]() Original publisher: [Read original article]() Author: Eric Doerr Published: 2026-09-08T17:21:00Z Content type: release Language: en Sources: [Tenable Blog]() Topics: [Claude](), [anthropic](), [vulnerability]() Tags: [agentic](), [ai](), [anthropic](), [claude](), [exposure-management](), [reasoning](), [security](), [vulnerability]() ### AI overview Tenable announces plans to integrate Claude Mythos 5 into Tenable One. Its planned Adversary View capability is intended to help security teams identify vulnerability chains, model attacker progression, and prioritize actions across exposure management. ### Source excerpt Tenable is bringing Anthropic's Claude Mythos 5 into our enterprise security offerings. Adding frontier adversarial reasoning to the Tenable One Exposure Management Platform will help customers better anticipate how attackers could breach their environments and stay ahead of AI-fueled risk. Tenable One Adversary View, the first innovation planned from this work, will debut in the coming weeks. Key takeaways Claude Mythos 5 is coming to Tenable One. In addition to using Claude Mythos 5 for research and evaluation, Tenable will now incorporate it within Tenable One, giving defenders access to frontier cyber reasoning to tackle complex exposure management challenges. Tenable One Adversary View is the first innovation we'll deliver to our customers. Adversary View will use Claude Mythos 5 to help security teams uncover hidden vulnerability chains, see their environments from an attacker's perspective, and identify the actions that can disrupt attacker progression. Adversary View is just the beginning. Combining Claude Mythos 5's advanced cyber reasoning with the breadth and depth of Tenable One sets up a new generation of AI-powered capabilities across exposure management. Bringing Claude Mythos 5 into Tenable One Security teams face more findings than they can possibly triage using conventional methods. Add cloud, operational technology (OT), shadow AI, and identity data to the attack surface, and the volume of signals keeps growing while the time to act keeps shrinking. Finding exposures is no longer the hardest part. The challenge is understanding which combinations of exposures create the greatest risk, how an attacker could exploit them, and what to fix first. While leveraging frontier models for improving security defenses is still relatively new, bringing those models into customer-facing products is at the leading edge. Today, we are sharing how Tenable is combining Claude Mythos 5 with the exposure intelligence in Tenable One. Mythos 5 provides frontier-scale a ## StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-day DevFeed: [StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-day]() Original publisher: [Read original article]() Author: Satnam Narang Published: 2026-09-08T14:00:43Z Content type: news Language: en Sources: [Tenable Blog]() Topics: [vulnerability](), [PHP]() Tags: [attacks](), [authentication](), [exploits](), [payload](), [php](), [vulnerability]() ### AI overview The article explains StyleSmuggler (CVE-2026-75650), an actively exploited, unauthenticated remote-code-execution vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. It describes injection of PHP code through style properties and execution during rendering of a transactional email template. ### Source excerpt A critical unauthenticated remote code execution (RCE) zero-day in Adobe Commerce and Magento Open Source, dubbed StyleSmuggler, has been actively exploited since September 4 with attacks observed three days before a vendor patch became available. Key takeaways CVE-2026-75650 is a critical remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source that can be triggered without authentication. Active exploitation of CVE-2026-75650 began on September 4, 2026, three days before Adobe released a hotfix, with multiple victim stores confirmed across different attack campaigns. Adobe released Hotfix VULN-39341 on September 7, 2026, and Tenable detection plugins will be published as they become available. Background Tenable's Research Special Operations Team (RSO) has compiled this blog to answer Frequently Asked Questions (FAQ) regarding CVE-2026-75650, a zero-day remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source that has been actively exploited in the wild. FAQ When was CVE-2026-75650 first disclosed? On September 5, 2026, the Sansec Forensics Team published research detailing an actively exploited zero-day vulnerability in Magento and Adobe Commerce that it named StyleSmuggler. What is CVE-2026-75650? CVE-2026-75650 is a remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source. Successful exploitation grants an unauthenticated attacker the ability to execute arbitrary code on a vulnerable server. CVE-2026-75650 carries a CVSSv3 score of 10.0, the highest possible rating. Additionally, its scope is changed, meaning exploitation can impact resources beyond the vulnerable component itself. CVEDescriptionCVSSv3CVE-2026-75650Adobe Commerce and Magento Open Source Remote Code Execution10.0 The following products and versions are affected: ProductAffected versionsAdobe Commerce2.4.4 through 2.4.9Adobe Commerce B2B1.3.3 through 1.5.3Magento Open Source2 ## Frontier AI just raised the stakes, and the old playbook won't hold up DevFeed: [Frontier AI just raised the stakes, and the old playbook won't hold up]() Original publisher: [Read original article]() Author: Jason Maynard Published: 2026-09-04T15:00:46Z Content type: opinion Language: en Sources: [Security @ Cisco Blogs]() Topics: [Vulnerabilities](), [Code](), [anthropic](), [Claude](), [Firefox]() Tags: [agentic-ai](), [ai](), [ai-cybersecurity](), [claude](), [frontier-ai](), [resilience](), [security](), [security-for-ai](), [vulnerability]() ### AI overview The article argues that frontier AI is making vulnerability discovery dramatically faster, shifting the security bottleneck to remediation. It advocates layered defenses, an assume-breach mindset, and faster detection and response. ### Source excerpt Frontier AI is accelerating vulnerability discovery. Learn why layered defenses, faster remediation, and cyber resilience matter more than ever. ## Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models DevFeed: [Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models]() Original publisher: [Read original article]() Author: Blake Darché Published: 2026-09-03T21:03:02Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Vulnerabilities](), [Language models](), [AI-assisted coding]() Tags: [artificial-intelligence](), [cloudflare](), [code](), [developers](), [edge](), [firewall](), [gpt](), [large-language-models](), [openai](), [product-news](), [production](), [security](), [vulnerability](), [workers]() ### AI overview Cloudflare announces early access to an invitation-only service that prioritizes code vulnerabilities using production traffic, security signals, WAF context, and OpenAI Daybreak models. It proposes and validates patches or mitigations for customer review, while customers decide whether to implement them. ### Source excerpt Use production traffic and security signals to prioritize findings, prepare edge mitigations when safe, and propose code patches. By combining WAF data with OpenAI Daybreak models, Vulnerability Discovery and Remediation helps teams identify and patch the most critical threats first. ## How River takes security work from a fix to merge DevFeed: [How River takes security work from a fix to merge]() Original publisher: [Read original article]() Author: Erin Son Published: 2026-09-02T16:30:45Z Content type: article Language: en Sources: [Shopify Engineering](), [Shopify Engineering - Shopify Engineering]() Topics: [Vulnerabilities](), [AI Bots]() Tags: [agentic](), [ai-agent](), [autonomous](), [ci](), [security](), [shopify](), [slack](), [vulnerability](), [workflow]() ### AI overview Shopify describes River, an AI agent that manages vulnerability remediation from patch review through merge and verification against the repository head and dependency graph. The article reports a 70% reduction in open dependency issues during the workflow's first 11 days. ### Source excerpt River, Shopify's AI agent in Slack, enables autonomous vulnerability remediation, not just detection. [Next page]()