Topics · Category
Security
19 items briefed across the archive.
-
NOV 12, 2026 — Nvidia without Jensen, and the bills come due
Critical RCE vulnerability in Apache HTTP Server's HTTP/2 moduleAnthropic and Google both found the mod_http2 race condition; versions 2.4.55–2.4.70 are affected, and Wiz says 51% of cloud environments have exposed instances.
Wiz
-
NOV 12, 2026 — Nvidia without Jensen, and the bills come due
Google DeepMind's agents formally verify the Signal protocolFour weeks of agent-driven analysis proved the protocol under WhatsApp and Google Messages and flagged old, known-broken versions; DeepMind admits it's a long way from scaling.
9to5Mac
-
NOV 12, 2026 — Nvidia without Jensen, and the bills come due
A false smoke alarm almost drowned Jane Street's only NYC datacenterContractor dust set off an alarm that killed the cooling, the room reached 143.6°F, and an engineer who lived nearby ran over and unplugged everything by hand.
Michael Bacarella
-
NOV 9, 2026 — Trust is the product nobody is shipping
ChatGPT Desktop forwards your SSH agent to remote machinesA remote agent can reportedly authenticate with your local SSH credentials, and commenters are arguing convenience defaults versus hardware-backed keys.
Hacker News
-
NOV 9, 2026 — Trust is the product nobody is shipping
Outlook.com is rejecting email from domains without DMARCSince Nov 5, Outlook, Hotmail, Live and MSN bounce some mail from domains lacking a DMARC record; a single p=none TXT record fixes it.
MailRoute
-
OCT 22, 2026 — The bugs AI found, and the keys it can't guard
Today's PHP security release, and how we're strengthening PHP securityThe Foundation shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for two critical RCEs, admitted one fix stalled for two years, and says a premature CVE leak and an early Chainguard binary complicated disclosure.
The PHP Foundation
-
OCT 22, 2026 — The bugs AI found, and the keys it can't guard
Railway security disclosureRailway says attackers may have read decrypted customer environment variables, calls it part of a campaign against platforms to reach AI inference providers, and has paused all deployments while users rotate secrets.
Railway
-
OCT 21, 2026 — Anthropic asks for a referee while its bills come due
Eight Bits of Trust: eMudhra's CA keys cracked in millisecondsEight eMudhra intermediate CA certificates used keys so small, like 4 and 56, that they were recoverable in under a second; Chrome and Firefox have blocked them and Mozilla is dropping the root.
Scott Helme
-
OCT 21, 2026 — Anthropic asks for a referee while its bills come due
Using Claude to reduce the attack surface of codeClaude mapped reachable code across 25 open-source projects and flagged 493 issues, including 4,500 lines of experimental post-quantum code exposed pre-auth in default OpenSSH.
Anthropic
-
JUL 2, 2026 — Washington wants equity in AI, not just oversight
Zero-click prompt injection found to chain into RCE in CursorTwo critical flaws (CVSS 9.8) let a single crafted prompt escape Cursor's sandbox with no user click required, patched after disclosure.
Cato Networks
-
JUL 2, 2026 — Washington wants equity in AI, not just oversight
Researchers find attackers registering AI-hallucinated domains at scaleUnit 42 generated 2.1M hallucinated URLs from LLM prompts and found over 13,000 already weaponized by squatters.
Palo Alto Networks Unit 42
-
JUN 28, 2026 — The vacuum fills
Nightmare Eclipse drops 7th Windows zero-day after GitHub bans accountThe anonymous ex-Microsoft researcher resurfaced under a new handle (MSNightmare) to post RoguePlanet, a Defender privilege-escalation zero-day, on the same day as June Patch Tuesday — the seventh Windows 0-day in ten weeks.
Cybernews
-
JUN 28, 2026 — The vacuum fills
We have Mythos at home: GLM 5.2 beats Claude in our cyber benchmarksSemgrep's independent security evals found GLM-5.2 scoring 39% F1 on IDOR detection vs. Claude Code's 32%, at $0.17 per confirmed vulnerability — the headline: Mythos-class security automation is now open-weight.
Semgrep
-
JUN 22, 2026 — The week the U.S. took the keys
LiteLLM CVE deadline hits federal agencies todayCISA gave US civilian agencies until June 22 to remediate CVE-2026-42271, an actively exploited LiteLLM command-injection bug that chains with a Starlette host-header bypass into unauthenticated RCE.
The Hacker News
-
JUN 22, 2026 — The week the U.S. took the keys
Agentjacking turns one fake Sentry alert into a coding-agent hijackTenet Security reports an 85% exploitation rate against Claude Code, Cursor, and OpenAI Codex — using a poisoned bug report and a public Sentry key as the entire attack surface.
The New Stack
-
JUN 22, 2026 — The week the U.S. took the keys
Low-skilled attacker used Claude and Codex to breach 14 companiesAn Anthropic threat report finds a single operator running agentic exfil, persistence, and lateral movement across more than a dozen environments — the work formerly required a team.
Help Net Security
-
JUN 22, 2026 — The week the U.S. took the keys
Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight ModelsUniversity of Toronto's CleverHans Lab demonstrates an LLM-driven worm that reasons through 33 simulated corporate hosts, identifies 31 vulnerabilities per run, and replicates to 62% of the network in seven days.
The Hacker News
-
JUN 4, 2026 — The bill for AI arrives
OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain AttackA functional npm package with 29,000 weekly downloads silently exfiltrated OpenAI Codex refresh tokens — which don't expire — to an attacker server for over a month before discovery.
The Hacker News
-
JUN 4, 2026 — The bill for AI arrives
Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479)An autonomous AI bug-hunter found a use-after-free in Redis's blocking-client code that allows authenticated RCE; the flaw sat undetected in every stable branch for over two years.
The Hacker News