Cybersecurity
353 articles RSS
Dutch Vulnerability Disclosure Nonprofit DIVD Says Two Zammad Zero-Days Enabled an AI-Agent-Driven Breach
DIVD says attackers chained two Zammad zero-days (CVE-2026-102489, CVE-2026-102490) and used an automated AI agent; volunteer data was exposed.
OpenSSL Patches 14 Vulnerabilities in 4.0.3 and Backports, Led by a High-Severity DTLS Heap Disclosure Flaw
OpenSSL's 29 September 2026 advisory covers 14 CVEs, one High-severity DTLS flaw that can leak heap memory, one Moderate and 12 Low; fixes ship in 4.0.3, 3.6.5, 3.5.9 and 3.4.8.
Next.js 16.3.8 and 15.5.27 Patch Seven Vulnerabilities, Including a High-Severity Image Optimizer SSRF, While Two Others Slip
Vercel's Next.js team released 16.3.8 and 15.5.27 fixing one high, five medium and one low severity flaw; a critical and a high fix were postponed over upstream delays.
Official MCP Python SDK OAuth Flaw Lets Malicious Servers Steal Client Secrets, Fixed in 1.30.0 and 2.2.0
A high-severity flaw in the official MCP Python SDK let a malicious server redirect OAuth credentials to an attacker's endpoint; fixes ship in 1.30.0 and 2.2.0, with extra steps needed.
Citrix Confirms Exploitation of Two Critical NetScaler RCE Flaws, CVE-2026-88771 and CVE-2026-88772, as CISA Adds Both to KEV Catalog
Citrix confirmed exploitation of two critical NetScaler ADC and Gateway flaws, both CVSS v4 9.5, and shipped fixes; CISA added both to its KEV catalog as of September 27, 2026.
Two GitHub Actions Disabled Since May's Mini Shai-Hulud Compromise Came Back Online in September, Reactivating Malware With No New Attack
Socket found that actions-cool/issues-helper and actions-cool/maintain-one-comment, disabled since May 2026, became reachable again on September 16 with their malicious tags intact, silently re-running the payload.
Vercel Patches Critical Next.js ImageResponse RCE Traced to a Satori SVG-Escaping Flaw
Vercel shipped Next.js 16.3.6 to fix a critical, 9.5-rated remote code execution flaw in ImageResponse rooted in a Satori SVG-escaping bug, CVE-2026-94545.
Cloudflare Discloses Cross-Tenant Disk Data Leak in Containers and Sandboxes, Finds No Evidence of Exploitation
A bug-bounty researcher showed a paying Cloudflare Containers customer could recover up to 60 KB of leftover disk data from other customers' deleted containers; Cloudflare says it found no evidence of exploitation.
Critical Bifrost AI Gateway Flaw Let Attackers Run Commands Without Credentials
CVE-2026-90898 lets unauthenticated attackers execute arbitrary commands on Bifrost AI gateway servers via a single HTTP request; fixed in transports/v2.1.0.
Plugin4Shell Flaw Lets Repository Owners Swap Pinned Plugin Code in Claude Code, Codex, and Copilot
Security firm Air Security found a zero-click flaw letting a plugin repository owner bypass commit-hash pinning in four AI coding agents.
AWS Confirms Data in War-Damaged Middle East Availability Zones Is Permanently Unrecoverable
AWS says data held only in Bahrain's me-south-1 region and the UAE's mec1-az2 zone, hit by Iranian strikes in March, cannot be restored.
Rust Security Team Fixes Miri Bug That Let GitHub Actions Caches Leak Secrets to Pull Requests
The Rust Security Response Team disclosed and patched a Miri flaw that stored all environment variables in target/, letting cached CI output expose secrets to pull requests.