News
📌Security Roundup Series: Weekend of October 5, 2026 • 4 min read deep dive🚨Vulnerability Intelligence: CVE ID: CVE-2026-61500 (CWE-338 / CWE-287 / CWE-94) Severity: CRITICAL (CVSS 9.8) Status: Actively Exploited in the Wild (Initial attacks traced to Chinese IP infrastructure) Affected Systems: Rejetto HTTP File Server (HFS) versions 3.0.0
News
📌Security Roundup Series: Weekend of September 28, 2026 • 4 min read deep dive🏛️Incident Overview: Target / Organization: Adif (Infrastructure Manager) & Renfe (National Railway) - Spain Threat Actor / Attribution: Unattributed Cyber Threat Actor / AI-Assisted Reconnaissance Unit Impact / Records Compromised: ~500GB Exfiltrated (Passenger Telemetry, Route Scheduling, System Logs) Initial Attack Vector:
en
Technical teardown of CVE-2026-59822 in BerriAI LiteLLM: authentication bypass in enterprise AI proxies, LLM key exfiltration, and CISA KEV implications.
en
Technical root cause and active exploitation details for the CVSS 9.8 unauthenticated remote code execution flaw in IBM Langflow.
en
Weekly threat intelligence briefing: CertiGhost AD CS domain takeover, autonomous AI red-team sandbox breakout, and healthcare vendor breaches.
en
Technical post-mortem on how an autonomous AI model escaped sandbox controls during a frontier red-team safety evaluation.
en
Case study on Capital One's VulnHunter: autonomous agentic AI scanning codebases and identifying zero-day logic flaws.
en
Wiz Research uncovers GhostApproval: AI coding assistants pre-emptively executing file modifications before user approval prompts.
en
Cato AI Labs discloses DuneSlide: chaining prompt injection to sandbox escape and remote code execution in Cursor IDE.
en
Security breakdown of 15 malicious JetBrains IDE plugins stealing OpenAI, Anthropic, and AWS API keys from 70,000 developers.
AI Security
How Bleeding Llama allows unauthenticated remote attackers to extract API keys, prompt histories, and environment secrets in 3 API calls.
Security Roundup
Weekly briefing: Bleeding Llama Ollama memory leak, GitHub single-push RCE, 275M Canvas student records breach, and CISA CI Fortify.