Daily news, analysis and practical guides explaining what happened, who is affected and what to do next. We also turn this knowledge into practical training for organisations.
AI Security New flaws in DataWorks MCP, mcp-google-search, Skill Ninja and spec-workflow show how a tool-call URL or path crosses network and workspace boundaries.
Vulnerabilities and CVEs CVE-2026-71983 through CVE-2026-71993 affect WPS, VPN, filtering and router administration. We explain the shared weakness, exposure and response plan.
AI Security A malicious link and indirect prompt injection used a Rovo user's permissions. We explain retrieval, exfiltration, connectors and egress control.
Vulnerabilities and CVEs CISA added the critical command injection to KEV. We explain the buffer-initialisation flaw, path to root commands, fixed releases and appliance triage.
Penetration Testing and AppSec Container queries, web fonts and ligatures turned decrypted text into network requests without JavaScript. We explain the attack and correct isolation.
Supply Chain Security Compromised TrueConf servers distributed a client containing the PhantomPxPigeon backdoor. We examine supply-chain trust, code signing and response.
AI Security Coding-agent harness flaws enabled pre-sandbox command execution and secret exfiltration. We examine the trust boundaries and practical CI hardening.
Penetration Testing and AppSec James Kettle's system analysed thousands of HTTP rules and exposed new parser discrepancies. We explain desync, RQP, human validation and defence.
Threats and Incidents A critical Metabase SQL injection was exploited before a patch was published. We examine the endpoint, attack chain, fixed versions and response plan.
Vulnerabilities and CVEs A use-after-free in SCTP Dynamic Address Reconfiguration enabled local privilege escalation and container escape. We explain the mechanism and defence.
AI Security Five agent-runtime flaws allowed forged tool calls or approvals to bypass LLM inference. We explain why the model cannot serve as an authorisation layer.
Threats and Incidents WordArray.random() produced recoverable seeds in five wallet apps. We examine entropy, on-chain investigation and safe fund migration.
Vulnerabilities and CVEs MIT researchers introduced Time-of-Neutralization to Time-of-Use and Interrupt Injection, retraining a predictor after it has been cleared.
Cloud, Infrastructure and DevSecOps A use-after-free in the KVM/x86 shadow MMU broke isolation under nested virtualisation. We explain recursive page zapping, prerequisites and mitigations.
Vulnerabilities and CVEs A critical Org-mode renderer flaw let unauthenticated attackers read files available to the Gitea process. We examine the mechanism, exposure and response plan.
Once a month, a concise summary of the vulnerabilities and threats that matter. No spam, unsubscribe anytime.
