Daily news, analysis and practical guides explaining what happened, who is affected and what to do next. We also turn this knowledge into practical training for organisations.
AI Security Docling's SSRF issue affects untrusted documents with remote resource fetching enabled. Check version 2.132.0, parser configuration and network egress controls.
Vulnerabilities and CVEs A critical Langflow issue crosses the boundary between integration configuration and code execution. Check fixed packages, auto-login and process permissions.
Cloud, Infrastructure and DevSecOps The issue affects the RabbitMQ Java client's default JSON-RPC mapper. Check the parsing path, release 5.37.0 and permission to publish RPC messages.
AI Security The updated Cyber Verification Program separates defence, authorised testing and specialised access. Prepare data boundaries, permissions and oversight before rollout.
Human Security Mozilla has fixed a mitigation bypass in file handling. Check the Firefox update channel, the version actually running and devices awaiting a restart.
Vulnerabilities and CVEs CERT Polska has disclosed CVE-2026-75818, 75819 and 75820. Check Aspell usage, dictionary provenance and evidence of fixes in the packages actually deployed.
Penetration Testing and AppSec Ghost fixes stored XSS in SVG images imported with content. Check the 6.67.0 fix, archive acceptance procedures and the response to a suspicious import.
AI Security The Playwright conversion prompt in k6 MCP crossed the working-directory boundary. Check the code fix, process permissions and AI integration access to secrets.
Human Security MediaTek's bulletin covers 31 CVEs, including two critical modem flaws. Identify affected device variants and verify vendor updates across the organisation.
Cloud, Infrastructure and DevSecOps A new CVE covers unsafe kubeconfig handling in maclof/kubernetes-client. Check the 0.32.0 fix, WebSocket transport and protection of cluster credentials.
Human Security CERT Orange warns about texts claiming that an OLX account needs verification. Use an independent check and a practical employee training scenario.
Vulnerabilities and CVEs New CVE records describe authentication bypasses and an exposed debugger in Perforce P4 Search. Assess network exposure and verify the patched deployment.
AI Security An updated A2UI advisory describes XSS in openUrl. Review affected versions, the available fix and trust boundaries for interfaces generated by AI agents.
Cloud, Infrastructure and DevSecOps Gitea's advisory describes container restrictions bypassed through workflow options. Review exposure, differing version metadata and isolation between CI jobs.
Identity and Access Trigger.dev's advisory describes environment secrets exposed by CLI logs. Review the fix, historical logs and response steps for disclosed credentials.
Once a month, a concise summary of the vulnerabilities and threats that matter. No spam, unsubscribe anytime.
