Daily news, analysis and practical guides explaining what happened, who is affected and what to do next. We also turn this knowledge into practical training for organisations.
AI Security Coding-agent harness flaws enabled pre-sandbox command execution and secret exfiltration. We examine the trust boundaries and practical CI hardening.
Penetration Testing and AppSec James Kettle's system analysed thousands of HTTP rules and exposed new parser discrepancies. We explain desync, RQP, human validation and defence.
Threats and Incidents A critical Metabase SQL injection was exploited before a patch was published. We examine the endpoint, attack chain, fixed versions and response plan.
Vulnerabilities and CVEs A use-after-free in SCTP Dynamic Address Reconfiguration enabled local privilege escalation and container escape. We explain the mechanism and defence.
AI Security Five agent-runtime flaws allowed forged tool calls or approvals to bypass LLM inference. We explain why the model cannot serve as an authorisation layer.
Threats and Incidents WordArray.random() produced recoverable seeds in five wallet apps. We examine entropy, on-chain investigation and safe fund migration.
Vulnerabilities and CVEs MIT researchers introduced Time-of-Neutralization to Time-of-Use and Interrupt Injection, retraining a predictor after it has been cleared.
Cloud, Infrastructure and DevSecOps A use-after-free in the KVM/x86 shadow MMU broke isolation under nested virtualisation. We explain recursive page zapping, prerequisites and mitigations.
Vulnerabilities and CVEs A critical Org-mode renderer flaw let unauthenticated attackers read files available to the Gitea process. We examine the mechanism, exposure and response plan.
Identity and Access GitGuardian found thousands of n8n tokens in public commits. A total of 321 active instances accepted keys that exposed workflows and downstream credentials.
Supply Chain Security An evil-twin campaign in Open VSX used lookalike names and extension code to harvest developer workstation data. Here is the mechanism and IDE supply-chain response.
AI Security CVE-2026-41679 and related Paperclip flaws showed that an agent bundle is an executable supply chain. We explain the import path, runtime boundary and controls.
Cloud, Infrastructure and DevSecOps A 22-year-old IPMI 2.0 weakness still exposes the server management plane. We explain RAKP, offline cracking and secure BMC isolation.
AI Security A Pillar Security researcher showed a public triage agent passing instructions to a privileged Gemini workflow. We explain the impact and secure pattern.
Threats and Incidents The hospital disclosed the scope of a May 2025 incident: identity, financial and medical data may have been present in acquired files. We explain response steps.
Once a month, a concise summary of the vulnerabilities and threats that matter. No spam, unsubscribe anytime.
