CISA added two Zammad zero-days to its Known Exploited Vulnerabilities catalog on October 2 with an October 5 remediation deadline after an AI agent used them to breach the Dutch Institute for Vulnera…
A research report published Thursday details four weeks of active exploitation of JFrog Artifactory, in which attackers chain two patched CVEs to escalate a single unauthenticated request into an admi…
GitLab released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to fix a critical prompt-template sandbox escape tracked as CVE-2026-90970 with a CVSS score of 9.9 out of 10, disclosed on October 2. A …
CISA added CVE-2026-49869, an unauthenticated OS command injection in the Kestra workflow orchestration platform, to its Known Exploited Vulnerabilities catalog after evidence of real attacks. The fla…
CISA added CVE-2026-59822, an authentication bypass in LiteLLM's MCP Streamable HTTP endpoint rated CVSS 8.8, to its Known Exploited Vulnerabilities catalog on September 2 — the first MCP-specific fla…
Team Cymru researchers identified 10,867 proxy servers running the open-source relay platforms Claude Relay Service (CRS) and sub2api that hide the origin of traffic to frontier AI models, and now est…
Anthropic's September 2026 threat intelligence report documented seven Chinese labs conducting systematic distillation campaigns against Claude's Opus-class models between December 2025 and August 202…
Group-IB reported that RemControl, a previously undocumented Android banking trojan first observed in July 2026, is targeting retail banking customers in Italy, France, Spain, Poland, Portugal, the Mi…
CISA's new "Quality Era Framework" warns that AI-powered bug discovery could expose gaps in the CVE programme's processes, tooling, coordination and accountability, with CVE publications set to reach …
Internet measurement has identified 39,155 assets presenting the LiteLLM AI gateway fingerprint, with deployments concentrated in the United States (9,792), China (2,629), Japan (2,030), India (1,855)…
A threat actor tracked by Huntress as UNC-PRNT used OpenAI Codex and DeepSeek models to build an AI-assisted offensive pipeline that compromised more than 440 PaperCut NG/MF instances across 395 organ…
A developer demonstrated that three queries run minutes apart against ZoomEye's internet-wide dataset returned 161,907 hosts answering on TCP port 102, 95,749 devices classified as PLCs, and just 173 …
Team Cymru reported that more than 80,000 relay servers are helping users in China bypass geographic restrictions on leading U.S. AI models, with Senior Principal Engineer Scott Fisher saying the oper…
Anthropic's threat intelligence team published Case GTG-16008 in September 2026, documenting that Xiaomi funneled more than 400,000 requests to Claude through 1,500 distinct accounts over a 20-day win…
LiteLLM patched CVE-2026-59822, an authentication bypass in its MCP endpoint rated 8.8 High on CVSS 4.0 that affected every version below 1.84.0 and was added by CISA to the Known Exploited Vulnerabil…
Chinese authorities are investigating DeepSeek and Moonshot AI over allegations that sensitive Chinese user data was routed to US servers through Anthropic's Claude models, following claims by Anthrop…
A developer outlined a five-tier patch prioritization rule for handling Microsoft's September 2026 security update, which contained roughly 970 to 997 CVEs, more than 110 of them critical. The approac…
The White House announced GOLD EAGLE on July 14, 2026, a cybersecurity vulnerability clearinghouse created under Executive Order 14409 to coordinate and deconflict vulnerability scanning, validate fin…
CISA added seven CVEs to its Known Exploited Vulnerabilities catalog in September 2026, three of which affect infrastructure common in self-hosted AI stacks: the LiteLLM AI gateway proxy, the Kestra w…
CISA added CVE-2026-49869, a CVSS 10.0 authentication bypass in Kestra OSS, to its Known Exploited Vulnerabilities catalog on September 2, 2026, after real-world attacks deploying crypto miners and ha…