Vulnerability Disclosure

AI & ML 5 min Codex Read a Repository and Ran Its Owner's Code Two escapes from OpenAI's coding agent were reported in August and fixed within eight days. The more serious o... MA Maya Lin 22 Sep Developer Tools 6 min OpenAI's Agents Attacked RubyGems in May. Nobody Told RubyGems. A swarm uploaded 2,000 packages, went after user API keys and abused the documentation builder. The volunteers... MA Maya Lin 12 Sep Cybersecurity 6 min You Now Have 24 Hours to Tell the EU Your Product Is Being Exploited The Cyber Resilience Act's reporting duty went live on 11 September. The clock starts when you become aware, w... PR Priya Nair 12 Sep Cyber Threat Intel 7 min The Backdoor Came Through Sogou, Which Sees Every Key You Press A crafted link was enough. An input method editor is downstream of every application on the machine, and this... PR Priya Nair 12 Sep Developer Tools 6 min One in Ten Exposed LiteLLM Gateways Answers to the Key in the Documentation Wiz found 9.6 per cent of 3,074 public LiteLLM proxies accepting sk-1234 or no key at all — which is why LiteL... MA Maya Lin 11 Sep Cybersecurity 6 min Cisco Found Seven Flaws in Every IOS XR Release, and Says AI Models Helped Two at CVSS 9.8, unauthenticated and network-reachable, none known to be exploited. The advisory names frontie... KE Kenji Tanaka 7 Sep Cyber Threat Intel 6 min The Cosmos Fix Shipped on 19 August. The Draining Started on the 20th. The advisory that published the fix is what told attackers where to look, and the draining began the following... PR Priya Nair 31 Aug Cybersecurity 8 min A Web Page Can Make Grok Decrypt Its Own Attack Instructions Encrypted commands sit on a page in plain sight. A filter cannot read them because reading them means running... KE Kenji Tanaka 26 Aug Cybersecurity 7 min Microsoft Took Eight Months to Patch a One-Click Copilot Data Theft Chain Varonis reported the chain in December 2025 and the fix shipped on 18 August 2026. In between, one link could... KE Kenji Tanaka 24 Aug