Daily news, analysis and practical guides explaining what happened, who is affected and what to do next. We also turn this knowledge into practical training for organisations.
Cloud, Infrastructure and DevSecOps A legacy gcp auth-provider cmd-path bypassed the existing exec check. A malicious Kubernetes configuration could launch a process on a shared worker.
AI Security Image and Audio parsing performed I/O during coercion. A malicious model could name a local path and send its contents to an LLM endpoint.
Vulnerabilities and CVEs The official MSRC release contains 790 CVE records. An exploited AFD flaw leads the queue, but SharePoint, Office, Azure and active roles also need review.
Supply Chain Security A 32-bit integer wrap corrupts the shared CSPRNG pool offset. Later IDs can become a constant string, so updating alone may not complete the response.
Cloud, Infrastructure and DevSecOps A 35-CVE wave covers command injection, cross-tenant access and authorization flaws. Here is the scope, the 0.29.13 fixes and a safe response plan.
Supply Chain Security A small HDF5 file can declare petabytes of data and stop load_model(). We examine the patch, model supply-chain risk and layered defensive controls.
Vulnerabilities and CVEs Missing authentication and path traversal can enable remote code execution and command submission. We separate the confirmed facts from operational risk.
Vulnerabilities and CVEs InfiniteWP Client before 1.13.6 allowed an attacker-controlled key to be bound and a WordPress Multisite administrator session hijacked. Here is the impact and response.
AI Security Encoded directory sequences bypassed Starlette normalisation before pathlib escaped the UI directory. LoLLMs releases before version 3 require an update.
AI Security New flaws in DataWorks MCP, mcp-google-search, Skill Ninja and spec-workflow show how a tool-call URL or path crosses network and workspace boundaries.
Vulnerabilities and CVEs CVE-2026-71983 through CVE-2026-71993 affect WPS, VPN, filtering and router administration. We explain the shared weakness, exposure and response plan.
AI Security A malicious link and indirect prompt injection used a Rovo user's permissions. We explain retrieval, exfiltration, connectors and egress control.
Vulnerabilities and CVEs CISA added the critical command injection to KEV. We explain the buffer-initialisation flaw, path to root commands, fixed releases and appliance triage.
Penetration Testing and AppSec Container queries, web fonts and ligatures turned decrypted text into network requests without JavaScript. We explain the attack and correct isolation.
Supply Chain Security Compromised TrueConf servers distributed a client containing the PhantomPxPigeon backdoor. We examine supply-chain trust, code signing and response.
Once a month, a concise summary of the vulnerabilities and threats that matter. No spam, unsubscribe anytime.
