# vulnerability A weakness in an information system, its security procedures, controls, or implementation that a threat source could exploit or trigger. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Раскрыта уязвимость BrokenPipe в клиенте Steam, которая позволяет повысить привилегии в Windows до SYSTEM DevFeed: [Раскрыта уязвимость BrokenPipe в клиенте Steam, которая позволяет повысить привилегии в Windows до SYSTEM]() Original publisher: [Read original article]() Author: denis-19 Published: 2026-09-17T02:25:27Z Content type: news Language: ru Sources: [Tagir Valeev]() Topics: [vulnerability](), [Exploit](), [client](), [Windows](), [Windows 11]() Tags: [2026](), [brokenpipe](), [poc](), [steam](), [vulnerability](), [windows]() ### AI overview A developer disclosed BrokenPipe, a critical zero-day privilege-escalation vulnerability in Steam Client Service on Windows. The published proof of concept reportedly allows a local user with code execution to run a launcher with SYSTEM privileges. The issue was reportedly disclosed to Valve in March 2026 and had not been fixed at the time described. ### Source excerpt Разработчик Джейдип Модхвадия (aka KillaBoi) раскрыл информацию о критической уязвимости нулевого дня (BrokenPipe - Steam Client Service LPE Vulnerability) в клиенте Steam в Windows, использование которой позволяет любому обычному пользователю незаметно повысить права в системе до полных привилегий SYSTEM. Читать далее ## CISA decides weekly vulnerability bulletin isn't necessary anymore DevFeed: [CISA decides weekly vulnerability bulletin isn't necessary anymore]() Original publisher: [Read original article]() Author: Brandon Vigliarolo Published: 2026-09-16T20:33:48Z Content type: article Language: en Sources: [www.theregister.com - Articles]() Topics: [cisa](), [vulnerability](), [Security]() Tags: [cisa](), [common-vulnerability-scoring-system](), [infosec](), [security](), [vulnerability]() ### AI overview CISA is ending its weekly vulnerability bulletin on September 28, shifting from static CVSS scores to risk-based prioritization. ### Source excerpt Agency's shift from static CVSS scores to risk-based prioritization sends the old format packing September 28 ## Cisco and the DISA STIG: Turning Zero Trust Policy into Repeatable Practice - Part 2: Cisco SNA DevFeed: [Cisco and the DISA STIG: Turning Zero Trust Policy into Repeatable Practice - Part 2: Cisco SNA]() Original publisher: [Read original article]() Author: Norman St. Laurent Published: 2026-09-15T13:13:53Z Content type: article Language: en Sources: [Cisco Blogs]() Topics: [Cybersecurity](), [Cisco](), [telemetry](), [Zero Trust](), [vulnerability](), [Network]() Tags: [benchmark](), [cisco](), [cisco-secure-network-analytics-sna](), [cybersecurity](), [department-of-defense-dod](), [government](), [hardening](), [industries](), [nist](), [public-sector](), [stig](), [visibility]() ### AI overview The article explains how the DISA Security Technical Implementation Guide for Cisco Secure Network Analytics turns Zero Trust policy into testable configuration requirements. The STIG provides a shared hardening baseline for the platform and its management functions, with 31 requirements derived from NIST SP 800-53 and related requirements. ### Source excerpt Discover how the new DISA STIG for Cisco Secure Network Analytics helps defense organizations securely configure and harden their analytics platform, ensuring trusted network visibility for Zero Trust operations. ## Rustls 0.23.45 Released To Fix Two Year Old Security Issue DevFeed: [Rustls 0.23.45 Released To Fix Two Year Old Security Issue]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-09-14T15:35:11Z Content type: news Language: en Sources: [Phoronix]() Topics: [TLS (Transport Layer Security)](), [Security](), [vulnerability](), [Rust](), [Memory Safety](), [Go Language]() Tags: [bugs](), [desktop-linux](), [go](), [library](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-performance](), [linux-server-benchmarks](), [open-source-graphics](), [phoronix](), [phoronix-test-suite](), [rust](), [rustls](), [security](), [tls](), [ubuntu-benchmarks](), [ubuntu-hardware](), [vulnerability]() ### AI overview Rustls 0.23.45 fixes a vulnerability in which TLS 1.3 handshake messages sent at the wrong encryption level could be accepted as plaintext after a key-changing message. The issue was present since Rustls 0.23.13 and could allow an on-path attacker to inject plaintext messages, although the authenticated handshake transcript prevented altering or completing the handshake. ### Source excerpt While the Rustls modern TLS library is written in the Rust programming language with a focus on memory safety, as we've seen out of other Rust project re-implementations in the past, the new implementations can lead to other security bugs of their own. Out today is Rustls 0.23.45 to fix a security issue introduced back in 2024 with Rustls while the likes of OpenSSL, BoringSSL, and others are unaffected... ## Emacs arbitrary code execution flaw DevFeed: [Emacs arbitrary code execution flaw]() Original publisher: [Read original article]() Author: jzb Published: 2026-09-14T15:20:00Z Content type: news Language: en Sources: [LWN.net]() Topics: [Lisp](), [vulnerability](), [Maintainers]() Tags: [cve](), [emacs](), [maintainers](), [release](), [vulnerability]() ### AI overview An incomplete fix for the Emacs arbitrary code execution flaw CVE-2024-53920 has been identified. Viewing or editing untrusted files in modes other than Emacs's Lisp mode can also trigger arbitrary code execution. The issue affects Emacs 24 and newer, with a minimal fix queued for Emacs 31.2; upstream maintainers do not expect to backport it to older releases. ### Source excerpt Sean Whitton has announced that the original fix for an arbitrary code execution flaw in Emacs (CVE-2024-53920) was incomplete. Bas Alberts discovered that viewing or editing untrusted files in modes other than Emacs's Lisp mode can also result in arbitrary code execution. This problem affects all Emacs versions affected by CVE-2024-53920. This means Emacs 24 and newer, and possibly also older versions. A minimal fix, attached, is queued up for release with Emacs 31.2. We (the Emacs upstream maintainers) don't expect to backport the fix to older Emacs releases ourselves. LWN covered the original vulnerability in December 2024. ## Uptime Kuma 2.5.4 Patches Critical JSONata Code Execution Flaw DevFeed: [Uptime Kuma 2.5.4 Patches Critical JSONata Code Execution Flaw]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-09-14T06:55:25Z Content type: article Language: en Sources: [Self Host Lab]() Topics: [Security](), [vulnerability](), [Monitoring](), [configuration]() Tags: [2026](), [cve](), [dependency](), [monitoring](), [monitoring-news](), [news](), [security](), [update](), [uptime-kuma-2-5-4](), [vulnerability]() ### AI overview Uptime Kuma 2.5.4 fixes a critical JSONata vulnerability that could enable arbitrary code execution on the monitor host, along with a second denial-of-service issue. The release updates jsonata to 2.2.2 and also adds an SFTP monitor type and three notification providers. ### Source excerpt Uptime Kuma 2.5.4 patches a critical-rated code execution flaw in the JSONata library (CVE-2026-77415, CVSS 9.3) plus a second denial-of-service fix, and adds an SFTP monitor type and three new notification providers. Here's what the flaw actually requires to exploit, and how to update. ## Forgejo 16.0.4 and 15.0.8 Fix Critical Repository Template RCE DevFeed: [Forgejo 16.0.4 and 15.0.8 Fix Critical Repository Template RCE]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-09-12T06:40:18Z Content type: article Language: en Sources: [Self Host Lab]() Topics: [vulnerability](), [releases](), [Security](), [Template](), [Authorization](), [API](), [Git]() Tags: [api](), [docker-containers](), [docker-containers-news](), [forgejo](), [git](), [news](), [release](), [security](), [self-hosted](), [update](), [vulnerability]() ### AI overview Forgejo 16.0.4 and 15.0.8 fix a critical remote code execution vulnerability in repository-template creation, along with an API authorization bypass. The article explains how malicious template variables could restore a .git directory with executable hooks and urges affected self-hosted instances to update. ### Source excerpt Forgejo 16.0.4 and 15.0.8 patch a critical remote code execution vulnerability in repository templates, tracked as CVE-2026-89094 with a CVSS score of 9.9, plus a narrower API permission bypass. Any instance on 16.0.3 or earlier, or 15.0.7 or earlier on the LTS branch, is vulnerable. Here's what happened, why it matters, and how to update. ## Claims About RubyGems Caching and RubyDoc Code Execution DevFeed: [Claims About RubyGems Caching and RubyDoc Code Execution]() Original publisher: [Read original article]() Published: 2026-09-12T00:02:11Z Content type: opinion Language: en Sources: [Aaron Patterson]() Topics: [rubygems](), [Caching](), [vulnerability](), [Docker](), [Web Scraping]() Tags: [caching](), [docker](), [rubygems](), [scraping](), [vulnerability]() ### AI overview An opinion post discusses alleged RubyGems activity involving a caching vulnerability and web scraping. It also describes how published gems can cause RubyDoc.info to run YARD-loaded code in a networked Docker container. ### Source excerpt Today Reuters and the Wall Street Journal both reported about rogue AI agents at OpenAI attacking RubyGems.org. https://www.rubyhack.ai/ has an amazing writeup, and you should read it. I just wanted to make a quick post about it because it's wild. TL;DR: It seems like OpenAI Bots knew about the RubyGems caching vulnerability, tried to take advantage of it, and at the same time ran some weird web scraping code on RubyDoc.info. Back in May, socket.dev reported about a "GemStuffer Campaign" where someone (I guess OpenAI) was uploading tons of junk gems to RubyGems.org. For some reason, the gems would scrape UK government websites, then repackage the data as gems, and attempt to upload them to RubyGems. I honestly didn't think much about this (or even look into it) until Sydney Von Arx and Spencer Kitts (both co-authors on https://www.rubyhack.ai) contacted me asking about RubyGems. I thought the claims they were making were completely outlandish until I actually read the code in these "GemStuffer" gems. After reading the code in these gems, a couple things stood out to me. YARD Documentation First, the gems leverage YARD documentation to execute arbitrary code on host machines. In most of the examples you'll see a .yardopts file that looks like this: --load ./script.rb README.md lib/**/*.rb Here's a link to an example. If you have YARD installed, and you install this gem, then YARD will load and run whatever is in ./script.rb from inside the gem. I think it's pretty common knowledge that C extensions will execute extconf.rb (so you basically have an RCE vector), but I was surprised to find out that a documentation tool would do that too. Nobody is going to install a gem named slnleaker5 though, so why would this matter? Well, any time a Gem is published RubyDoc.info will download the gem and process the YARD documentation. RubyDoc.info will execute the arbitrary code inside a Docker container. The Docker container still has network access though, so these gems could ha ## LTM Builds a Lightwell Remediation Services Practice Around IBM and Red Hat's $5B Open-Source Program DevFeed: [LTM Builds a Lightwell Remediation Services Practice Around IBM and Red Hat's $5B Open-Source Program]() Original publisher: [Read original article]() Author: Harold Fritts Published: 2026-09-11T16:35:51Z Content type: news Language: en Sources: [StorageReview.com]() Topics: [ibm](), [open-source-security](), [supply-chain-security](), [Security](), [vulnerability](), [DevSecOps](), [Deployment](), [Open Source](), [Artificial Intelligence]() Tags: [ai](), [deployment](), [devsecops](), [enterprise](), [ibm](), [open-source](), [open-source-software](), [red-hat](), [security](), [software-supply-chain](), [testing](), [vulnerability]() ### AI overview LTM is developing a remediation services practice around IBM and Red Hat's Lightwell program, which provides AI-generated, vendor-validated fixes for open-source software vulnerabilities. The offering is intended to help customers plan, prioritize, test, validate, and deploy patches at scale. ### Source excerpt LTM, the Larsen & Toubro Group services company that was LTIMindtree until its February rebrand, is building a Lightwell remediation services practice around the $5 billion IBM and Red Hat program for securing open-source software with AI-generated, vendor-validated fixes. IBM's clearinghouse produces validated, production-ready patches for open-source dependencies; LTM's job is getting them into customer The post LTM Builds a Lightwell Remediation Services Practice Around IBM and Red Hat's $5B Open-Source Program appeared first on StorageReview.com. ## Crypto customers targeted by scammers after email marketing provider breach DevFeed: [Crypto customers targeted by scammers after email marketing provider breach]() Original publisher: [Read original article]() Author: Pieter Arntz Published: 2026-09-11T15:01:53Z Content type: news Language: en Sources: [Malwarebytes]() Topics: [vulnerability](), [incident](), [API keys]() Tags: [attacks](), [breach](), [cryptocurrency](), [news](), [phishing](), [scams](), [security](), [supply-chain]() ### AI overview A Brevo breach enabled phishing emails targeting cryptocurrency-company newsletter subscribers. The attacker exploited a SAML SSO handling flaw, accessed 138 accounts, and used some accounts to send phishing messages or export contacts. ### Source excerpt A breach at email marketing company Brevo exposed Trezor, CoinTracking, and BitBox customers to phishing emails, but others may also be at risk. ## EU's Cyber Resilience Act starts the 24-hour vulnerability clock DevFeed: [EU's Cyber Resilience Act starts the 24-hour vulnerability clock]() Original publisher: [Read original article]() Author: Connor Jones Published: 2026-09-11T11:34:41Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [vulnerability](), [Cybersecurity]() Tags: [resilience](), [security](), [vulnerability]() ### AI overview The article reports that the EU Cyber Resilience Act requires manufacturers to disclose actively exploited vulnerabilities and severe security incidents through ENISA's reporting platform. ### Source excerpt Manufacturers must now disclose actively exploited flaws and severe security incidents through ENISA's new reporting platform ## AI floods security teams with flaws -- business context sets priorities DevFeed: [AI floods security teams with flaws -- business context sets priorities]() Original publisher: [Read original article]() Author: Megan Carnegie Published: 2026-09-10T12:00:00Z Content type: article Language: en Sources: [The New Stack]() Topics: [vulnerability](), [Cybersecurity](), [Business Security]() Tags: [ai](), [business](), [cloud-services](), [i-o-mergent](), [post](), [security](), [sponsor-i-o-mergent](), [sponsored](), [sponsored-post](), [vulnerability]() ### AI overview The article argues that security teams should prioritize vulnerabilities using business context rather than scanner severity alone, because automated findings can overwhelm limited engineering capacity. ### Source excerpt A security researcher testing a 300-person B2B company with a global footprint discovered an internet-exposed database with weak authentication during The post AI floods security teams with flaws -- business context sets priorities appeared first on The New Stack. ## Expanding AI access and cyber defense for federal, state, local, and tribal governments DevFeed: [Expanding AI access and cyber defense for federal, state, local, and tribal governments]() Original publisher: [Read original article]() Published: 2026-09-10T07:00:00Z Content type: news Language: en Sources: [OpenAI News]() Topics: [Artificial Intelligence](), [Threat Research](), [vulnerability](), [Malware]() Tags: [ai](), [chatgpt](), [global-affairs](), [government](), [malware](), [openai](), [public-sector](), [security](), [vulnerability]() ### AI overview OpenAI and the GSA announced a multi-year agreement offering eligible U.S. government users waived license fees, discounted usage, and expanded support for cyber defenders. ### Source excerpt OpenAI and GSA will offer eligible federal, state, local, and tribal governments $0 license fees, 50% off usage, and expanded cyber defense support. ## OpenAI gave an AI the power to block its own engineers' code DevFeed: [OpenAI gave an AI the power to block its own engineers' code]() Original publisher: [Read original article]() Author: Amanda Caswell Published: 2026-09-09T19:53:08Z Content type: news Language: en Sources: [The New Stack]() Topics: [Code review](), [Pull Request](), [vulnerability](), [LLM evaluation / benchmarking](), [Deployment]() Tags: [ai](), [ai-engineering](), [benchmark](), [codex](), [model](), [openai](), [pull-request](), [review](), [security](), [software-development](), [vulnerability]() ### AI overview OpenAI uses automated AI security review for every engineer pull request, blocking merges when a vulnerability is found. The article describes specialized code-review models, benchmarking claims, and a shift in human review toward discussing intent earlier in development. ### Source excerpt Every pull request submitted by an OpenAI engineer now goes through an automated security review, and the AI model can The post OpenAI gave an AI the power to block its own engineers' code appeared first on The New Stack. ## Claude Mythos 5 is coming to Tenable One, powering the new "Adversary View" DevFeed: [Claude Mythos 5 is coming to Tenable One, powering the new "Adversary View"]() Original publisher: [Read original article]() Author: Eric Doerr Published: 2026-09-08T17:21:00Z Content type: release Language: en Sources: [Tenable Blog]() Topics: [Claude](), [anthropic](), [vulnerability]() Tags: [agentic](), [ai](), [anthropic](), [claude](), [exposure-management](), [reasoning](), [security](), [vulnerability]() ### AI overview Tenable announces plans to integrate Claude Mythos 5 into Tenable One. Its planned Adversary View capability is intended to help security teams identify vulnerability chains, model attacker progression, and prioritize actions across exposure management. ### Source excerpt Tenable is bringing Anthropic's Claude Mythos 5 into our enterprise security offerings. Adding frontier adversarial reasoning to the Tenable One Exposure Management Platform will help customers better anticipate how attackers could breach their environments and stay ahead of AI-fueled risk. Tenable One Adversary View, the first innovation planned from this work, will debut in the coming weeks. Key takeaways Claude Mythos 5 is coming to Tenable One. In addition to using Claude Mythos 5 for research and evaluation, Tenable will now incorporate it within Tenable One, giving defenders access to frontier cyber reasoning to tackle complex exposure management challenges. Tenable One Adversary View is the first innovation we'll deliver to our customers. Adversary View will use Claude Mythos 5 to help security teams uncover hidden vulnerability chains, see their environments from an attacker's perspective, and identify the actions that can disrupt attacker progression. Adversary View is just the beginning. Combining Claude Mythos 5's advanced cyber reasoning with the breadth and depth of Tenable One sets up a new generation of AI-powered capabilities across exposure management. Bringing Claude Mythos 5 into Tenable One Security teams face more findings than they can possibly triage using conventional methods. Add cloud, operational technology (OT), shadow AI, and identity data to the attack surface, and the volume of signals keeps growing while the time to act keeps shrinking. Finding exposures is no longer the hardest part. The challenge is understanding which combinations of exposures create the greatest risk, how an attacker could exploit them, and what to fix first. While leveraging frontier models for improving security defenses is still relatively new, bringing those models into customer-facing products is at the leading edge. Today, we are sharing how Tenable is combining Claude Mythos 5 with the exposure intelligence in Tenable One. Mythos 5 provides frontier-scale a ## StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-day DevFeed: [StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-day]() Original publisher: [Read original article]() Author: Satnam Narang Published: 2026-09-08T14:00:43Z Content type: news Language: en Sources: [Tenable Blog]() Topics: [vulnerability](), [PHP]() Tags: [attacks](), [authentication](), [exploits](), [payload](), [php](), [vulnerability]() ### AI overview The article explains StyleSmuggler (CVE-2026-75650), an actively exploited, unauthenticated remote-code-execution vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. It describes injection of PHP code through style properties and execution during rendering of a transactional email template. ### Source excerpt A critical unauthenticated remote code execution (RCE) zero-day in Adobe Commerce and Magento Open Source, dubbed StyleSmuggler, has been actively exploited since September 4 with attacks observed three days before a vendor patch became available. Key takeaways CVE-2026-75650 is a critical remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source that can be triggered without authentication. Active exploitation of CVE-2026-75650 began on September 4, 2026, three days before Adobe released a hotfix, with multiple victim stores confirmed across different attack campaigns. Adobe released Hotfix VULN-39341 on September 7, 2026, and Tenable detection plugins will be published as they become available. Background Tenable's Research Special Operations Team (RSO) has compiled this blog to answer Frequently Asked Questions (FAQ) regarding CVE-2026-75650, a zero-day remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source that has been actively exploited in the wild. FAQ When was CVE-2026-75650 first disclosed? On September 5, 2026, the Sansec Forensics Team published research detailing an actively exploited zero-day vulnerability in Magento and Adobe Commerce that it named StyleSmuggler. What is CVE-2026-75650? CVE-2026-75650 is a remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source. Successful exploitation grants an unauthenticated attacker the ability to execute arbitrary code on a vulnerable server. CVE-2026-75650 carries a CVSSv3 score of 10.0, the highest possible rating. Additionally, its scope is changed, meaning exploitation can impact resources beyond the vulnerable component itself. CVEDescriptionCVSSv3CVE-2026-75650Adobe Commerce and Magento Open Source Remote Code Execution10.0 The following products and versions are affected: ProductAffected versionsAdobe Commerce2.4.4 through 2.4.9Adobe Commerce B2B1.3.3 through 1.5.3Magento Open Source2 ## Critical remote code execution in vm2, a widely used Node.js sandbox library DevFeed: [Critical remote code execution in vm2, a widely used Node.js sandbox library]() Original publisher: [Read original article]() Author: Daniel Abeles Published: 2026-09-02T00:00:00Z Content type: news Language: en Sources: [GitLab]() Topics: [vulnerability](), [Node.js](), [configuration](), [Threat Research]() Tags: [ai](), [containers](), [node-js](), [processes](), [sandbox](), [security](), [security-labs](), [threat-research](), [update](), [vulnerability]() ### AI overview GitLab reports a critical vm2 sandbox escape that can enable remote code execution. Version 3.11.7 blocks the reported attack, but the article advises hardening require.root and context settings and avoiding vm2 for truly untrusted code. ### Source excerpt GitLab's Threat Research Group found a critical sandbox escape vulnerability in vm2, one of the most widely adopted Node.js sandboxing libraries. The vulnerability uses a configuration copied straight from vm2's own README. We found the flaw, rated CVSS 3.1: 10.0, critical, using our own AI automated tools. Anyone running vm2 Version 3.11.6 or earlier with require.external turned on should treat this as directly exploitable. Once we found the vulnerability, we verified GitLab does not use vm2. We also reported it privately to vm2 and the maintainer fixed it fast, in vm2 Version 3.11.7. When we tested that fix again, it blocked the exact attack we reported. For anyone relying on vm2, it's worth flagging that there's a broader configuration risk here that goes beyond this one patch, based on the maintainer's own description of the fix. TL;DR Critical vulnerability: GitLab's Threat Research Group discovered a critical sandbox escape (CVSS 3.1: 10.0) in vm2, a widely used Node.js sandboxing library, which allows for remote code execution. The root cause: The vulnerability stems from default configurations found in the library's own "Quick Examples" README, where the sandbox fails to properly isolate itself from the host system, allowing malicious code to gain unrestricted access. Fix limitations: While updating to Version 3.11.7 blocks the specific attack reported, it does not fully resolve the underlying configuration risk; developers remain vulnerable if they continue to use require.external with overly broad require.root settings. Immediate recommendations: Users should update to Version 3.11.7, but must also manually harden their configurations by restricting require.root to only necessary files and setting context: 'sandbox' instead of relying on the default 'host' setting. Long-term advice: Due to vm2's history of recurring sandbox escape bugs, it is recommended to avoid using it for isolating truly untrusted code and instead opt for more robust methods like conta ## Abliterated Models Show Verdict Bias in FreeBSD Kernel Bug Hunting DevFeed: [Abliterated Models Show Verdict Bias in FreeBSD Kernel Bug Hunting]() Original publisher: [Read original article]() Author: clearbluejar Published: 2026-09-01T06:00:00Z Content type: article Language: en Sources: [clearbluejar]() Topics: [freebsd](), [vulnerability](), [bug](), [Kernel](), [gemma4](), [Testing](), [gemma]() Tags: [bug](), [bug-hunting](), [cve](), [false-positives](), [freebsd](), [gemma](), [gemma-4](), [kernel](), [llms](), [testing](), [vulnerability](), [vulnerability-research]() ### AI overview The article examines local abliterated open-weight models during vulnerability scanning of FreeBSD kernel source. Compared with base models of the same family and size, the modified models produced substantially more candidate and VALID findings, including false positives, while the most aggressive build did not surface the real CVE in a 28-file scan. The article describes this tendency as verdict bias: a greater willingness to return positive findings under uncertainty. ### Source excerpt Abliterated models never refuse, which makes them tempting for bug hunting. But on the same kernel source, they graduate three to four times as many findings to VALID, including false positives the base correctly rejects, and across a 28-file scan of FreeBSD's sys/rpc the most aggressive build never surfaced the real CVE at all. ## Security Advisory: CVE-2026-81934 DevFeed: [Security Advisory: CVE-2026-81934]() Original publisher: [Read original article]() Author: Riaz Lakhani Published: 2026-08-28T00:00:00Z Content type: news Language: en Sources: [Redis Blog]() Topics: [vulnerability](), [releases]() Tags: [authentication](), [cloud](), [redis](), [releases](), [security](), [tech](), [tls](), [vulnerability]() ### AI overview Redis remediated CVE-2026-81934, a high-severity use-after-free flaw in TLS pending-data processing that could allow authenticated attackers to execute remote code under specific conditions. The advisory lists fixed Redis releases and recommends upgrading, restricting network access, and enforcing least-privilege authentication controls. ### Source excerpt Update 9/1/2026: Following further review, the public CVE record for CVE-2026-81934 was updated to reflect a revised CVSS score of 7.5 (High). What happened? Redis identified and remediated a use-after-free vulnerability in TLS pending-data processi... ## Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter DevFeed: [Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter]() Original publisher: [Read original article]() Author: Research Special Operations Published: 2026-08-26T13:00:00Z Content type: article Language: en Sources: [Tenable Blog]() Topics: [vulnerability](), [telemetry]() Tags: [analysis](), [attacks](), [china](), [complexity](), [containers](), [datasets](), [edge](), [infrastructure](), [iran](), [ransomware](), [telemetry](), [vulnerability]() ### AI overview A joint Tenable-SentinelOne analysis finds state-sponsored and criminal actors converging on the same edge vulnerabilities. It compares exposure and remediation patterns across vendors and recommends faster patching, attack-surface reduction, and endpoint protection. ### Source excerpt A joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs reveals that both state-sponsored actors and cybercriminals independently converge on the same edge infrastructure. Special thanks to SentinelOne® Incident Readiness & Response for their contributions to this publication. It is the shared attack surface where state-sponsored threat actors and financially motivated criminal groups independently converge -- not the province of a single adversary category, and not exclusively a nation-state problem, despite two years of headlines about China-nexus actors targeting Ivanti, Fortinet, and Palo Alto Networks. The data here tells a different and much broader story. One focused on vendors vs CVEs. Key Takeaways Two independent observation systems, Tenable exposure telemetry across thousands of customer containers and SentinelOne DFIR casework across 66 CVEs, converge 79% on the same vendor attack surfaces despite minimal CVE-level overlap. Twelve CVEs in the combined dataset have confirmed multi-nexus attribution: state-sponsored and criminal actors independently exploiting the same vulnerability, across five nexus categories (China, Russia, DPRK, Iran, ransomware). The exposure picture is flatter than the headlines suggest: Fortinet, the vendor most associated with edge-device attacks in the press, sits mid-pack on container-grain exposure (25%) -- well behind F5 (54%) and in a tight 10-point band with Check Point, Ivanti, and Citrix. 54% of customer environments running F5 products have at least one exposed, actively-exploited CVE; Citrix customers show the slowest remediation patterns at 461 days median time to patch. Remediation complexity, particularly of high priority CVEs, leads to a statistically significant 24-day remediation gap, leaving large windows of opportunity for attackers. The same product lines get hit again and again: Ivanti EPMM and Ivanti Connect Secure each show a newly exploited CVE roughly every 8.5 to 13 months. Leverage multiple d ## Why Your AI Application Is Exposed DevFeed: [Why Your AI Application Is Exposed]() Original publisher: [Read original article]() Author: Damian Tommasino Published: 2026-08-26T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [AI Development](), [Large Language Model](), [vulnerability](), [Model Context Protocol](), [Retrieval Augmented Generation (RAG)](), [Machine Learning, Security Attacks](), [data]() Tags: [ai](), [ai-red-team](), [application-security](), [awareness](), [blog](), [devops](), [executive](), [interest](), [llm](), [mcp](), [rag](), [security](), [testing](), [vulnerability]() ### AI overview The article explains why AI applications can pass conventional security scans and model evaluations while remaining exploitable through chained interactions among prompts, language models, retrieval, tools, and backend workflows. It presents DAST, AI penetration testing, and AI red teaming as complementary lenses for identifying exposed surfaces, exploitable paths, and real-world adversary outcomes. ### Source excerpt AI applications can pass security scans yet remain exploitable through chained attacks across models, tools, data, and business workflows. Learn how DAST, AI pentesting, and red teaming work together to expose end-to-end risk. ## August 2026 Security Release DevFeed: [August 2026 Security Release]() Original publisher: [Read original article]() Author: Sebastian Silbermann Published: 2026-08-25T18:00:00Z Content type: release Language: en Sources: [Next.js Blog]() Topics: [Next.js](), [Security](), [vulnerability](), [vulnerability management](), [Open Source](), [Vercel]() Tags: [bug-bounty](), [next-js](), [open-source](), [release](), [security](), [vercel](), [vulnerability](), [vulnerability-management]() ### AI overview Next.js released versions 16.3.3 and 15.5.24 to address critical vulnerabilities, including unauthenticated remote code execution through AVIF image optimization and on Windows-hosted servers. The patched releases disable AVIF optimization until an upstream fix is propagated. ### Source excerpt The August 2026 security release for Next.js is now available ## Patching at Fleet Scale, Twice: How DigitalOcean Closed Januscape and the AMD Safe RET Issue Without Customer Impact DevFeed: [Patching at Fleet Scale, Twice: How DigitalOcean Closed Januscape and the AMD Safe RET Issue Without Customer Impact]() Original publisher: [Read original article]() Author: Tim Lisko Published: 2026-08-24T21:25:19Z Content type: article Language: en Sources: [DigitalOcean]() Topics: [Digital Ocean](), [virtualization](), [vulnerability](), [Cloud](), [cloud security](), [Security](), [Exploit](), [Kernel](), [Linux]() Tags: [cloud](), [cloud-computing](), [cve](), [digitalocean](), [engineering](), [exploit](), [infrastructure](), [kernel](), [linux](), [security](), [trust-security](), [update](), [virtualization](), [vulnerability]() ### AI overview DigitalOcean describes how it responded to two serious vulnerabilities affecting its hypervisor fleet: Januscape, a KVM nested-virtualization flaw, was addressed with fleet-wide livepatching, while a separate AMD hypervisor vulnerability required kernel updates and reboots across roughly 1,600 hypervisors. The article reports zero confirmed customer-facing impact. ### Source excerpt Setting the stakes In early July, security researcher Hyunwoo Kim discovered Januscape (CVE-2026-53359), a flaw in KVM's handling of nested virtualization that could allow a malicious guest to escape into the host hypervisor. It was disclosed publicly on July 6 via the Linux oss-security mailing list. For a cloud provider, a guest-to-host escape is the most serious class of vulnerability there is: the hypervisor is the boundary that keeps each customer's workloads isolated from each other, and from our infrastructure itself. We responded, patched the entire fleet in eight days with zero confirmed customer-facing impact, and drafted a post about how we did it. Then, before we could hit publish, it happened again. In late July we learned of a second and unrelated vulnerability affecting our entire AMD hypervisor fleet, that could not be livepatched. Roughly 1,600 hypervisors needed a kernel update and a reboot. So now this story is about two responses, three weeks apart. The first built the muscle. The second proved it was repeatable, at a larger scale, and on a harder constraint. Here's how both played out, and why two of the most serious vulnerability classes in cloud computing ended up feeling like just another couple of weeks for us. Act one: Januscape The fast path: fleet-wide livepatching Our response kicked off the same night the vulnerability was disclosed. When public exploit code surfaced late in the evening of July 6, the Kernel Engineering team was paged and dug in immediately. Engineers reproduced the exploit in an isolated environment, confirmed which kernel lines were affected, and built the first working livepatch before 1 AM, roughly 45 minutes after answering the page. Livepatching lets us fix a running kernel in place, with no reboot, no migration, and no observed disruption to the customer. A few hours later, patches for the kernel versions (6.1 and 6.12) that run the majority of our hypervisor fleet were ready to ship. For the remainder, we had to ## Tata's B2B platform returned OTPs in API responses DevFeed: [Tata's B2B platform returned OTPs in API responses]() Original publisher: [Read original article]() Author: Eaton Published: 2026-08-24T14:25:14Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [vulnerability](), [account takeover](), [API](), [Encryption](), [Binance]() Tags: [account-takeover](), [api](), [b2b](), [encryption](), [platform](), [vulnerability]() ### AI overview A security write-up describes a vulnerability in Tata nexarc that returned OTPs in API responses. Because the responses could be decrypted client-side, an attacker with a target's phone number could obtain the OTP and take over the account, including accounts with administrative privileges. ### Source excerpt Tata's nexarc platform had a vulnerability where OTPs could be decrypted from API responses, making it easy to take over any account. [Next page]()