Saturday, 15 August 2026

CVE-2026-15413 (CVSS 10.0): The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp- (opens in a new tab)

NVD ·fetched 15 Aug 2026, 19:37 UTC CVE-2026-15413 CVSS 10.0 EPSS 0.3% agreed3/3

Why readA WordPress plugin marketed as a homepage sentence publisher is a deliberate backdoor, and it ships a hunting artefact you can grep for today.

Link Factory exposes an operator-controlled REST API at /wp-json/link-factory/v1/, gated by a detached Ed25519 signature checked against a hardcoded operator public key, with the health check left open. The signature scheme means the channel is usable only by whoever holds the private key, so this is a maintained access channel rather than sloppy code, and every version is affected. Check managed WordPress estates for that route and for the plugin slug; a CVE number does not make this a patching problem, it makes it an eviction problem.

nvd.nist.gov → (opens in a new tab)

Ukraine's HUR claims cyberattack on Wildberries, Russian sellers complain of more disruption (opens in a new tab)

Google News: incidents · The Kyiv Independent ·fetched 15 Aug 2026, 15:40 UTC agreed3/3

Why readUkraine's military intelligence is publicly claiming an operation against one of Russia's largest e-commerce platforms, which puts a state service's name on disruption of a civilian marketplace.

HUR, Ukraine's defence intelligence directorate, has claimed responsibility for a cyberattack on Wildberries, with sellers on the platform reporting continuing problems beyond the initial outage. The claim is attributed rather than independently verified, and no technical detail on access or impact scope has been published. It belongs in the threat picture as another instance of an official military intelligence body openly owning disruptive operations against commercial infrastructure, which shapes how similar outages should be attributed.

Also covered byIntelliNews (opens in a new tab).

news.google.com → (opens in a new tab)

DEF CON crowd suspected in fake-hotspot attack on Delta flight (opens in a new tab)

Ars Technica Security ·Cyrus Farivar ·fetched 15 Aug 2026, 07:39 UTC agreed2/3

Why readAn evil-twin access point on a commercial flight pulled in federal law enforcement, a live reminder that rogue-AP mischief in a regulated airspace is a criminal matter, not a demo.

Passengers on Delta flight 591 from Las Vegas to Atlanta allegedly jammed the onboard Wi-Fi and broadcast their own signal the day after DEF CON wrapped, prompting a federal response on landing. The account originates from pilot ACARS messages surfaced by a social media account that monitors air-to-ground traffic, so the attribution to conference attendees is unconfirmed and no charges are described. The technical content is thin, but the precedent value for anyone briefing staff on what counts as unauthorized wireless activity is real.

arstechnica.com → (opens in a new tab)

CVE-2026-49819 (CVSS 9.8): UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerIn (opens in a new tab)

NVD ·fetched 15 Aug 2026, 19:37 UTC Must read CVE-2026-49819 CVSS 9.8 EPSS 0.6% agreed3/3

Why readUnauthenticated POST to /api/upsnap/init-superuser on UpSnap 4.4.1 through 5.3.5 hands over a superuser JWT and chains to root command execution.

pb.HandlerInitSuperuser in backend/pb/handlers.go:249 is gated only by a totalSuperusers > 0 count, with no authentication, setup token, IP allow-list or rate limit, so on any fresh install an unauthenticated attacker registers the first superuser and receives a long-lived JWT. From there backend/networking/wake.go:43 runs wake_cmd through exec.CommandContext(ctx, "/bin/sh", "-c", ...), giving root RCE on the host. Upgrade to 5.4.0; UpSnap boxes typically sit on management VLANs with broad wake-on-LAN reach.

nvd.nist.gov → (opens in a new tab)

CVE-2026-73501 (CVSS 9.1): kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently re (opens in a new tab)

NVD ·fetched 15 Aug 2026, 19:37 UTC Must read CVE-2026-73501 CVSS 9.1 EPSS 0.3% agreed3/3

Why readA popular Go OpenAPI library fails open on authentication by design, and the failure is silent.

In kin-openapi before 0.144.0, ValidationHandler.Load() replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without inspecting credentials. Any application that relies on ValidationHandler as its enforcement middleware therefore satisfies every OpenAPI security requirement for unauthenticated requests, and the substitution suppresses the ErrAuthenticationServiceMissing path that would otherwise have failed closed. Requests reach handlers expecting an API key or OAuth token with nothing checked, and nothing in the logs says so; upgrade to 0.144.0 and grep your own middleware for the same fail-open-on-nil pattern.

nvd.nist.gov → (opens in a new tab)

CVE-2026-13622 (CVSS 8.8): A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside (opens in a new tab)

NVD ·fetched 15 Aug 2026, 19:37 UTC Must read CVE-2026-13622 CVSS 8.8 EPSS 0.2% agreed3/3

Why readA namespace-scoped Kubernetes user with pods/exec can swap a KubeVirt migration socket for a symlink to the host CRI-O socket and take the node.

KubeVirt's virt-handler dials Unix sockets inside target virt-launcher pods through /proc/<pid>/root/ paths using net.Dial() with no symlink protection, and those paths live in qemu-owned directories the virt-launcher user can write. An attacker with namespace edit and pods/exec rights replaces a migration proxy socket with an absolute symlink to the host CRI-O socket; because virt-handler runs as root in the host mount namespace, the bidirectional io.Copy proxy then relays attacker bytes straight to the container runtime. Full node compromise from a tenant namespace, CVSS 8.8 with scope change.

nvd.nist.gov → (opens in a new tab)

CVE-2026-12263 (CVSS 8.8): Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerabil (opens in a new tab)

NVD ·fetched 15 Aug 2026, 23:38 UTC Must read CVE-2026-12263 CVSS 8.8 EPSS 0.7% agreed3/3

Why readAuthentication bypass via improper SAML validation in ManageEngine Password Manager Pro and PAM360, the vault holding your privileged credentials.

Zohocorp fixed an authentication bypass caused by improper SAML assertion validation in Password Manager Pro before build 13232 and PAM360 before build 8551. CVSS 8.8, EPSS still low at 0.007 with no observed exploitation, but these are privileged access management consoles that are frequently reachable from the internet and have a history of being targeted after disclosure. Patch to the fixed builds and review SSO login records for logins that do not match a corresponding IdP event.

nvd.nist.gov → (opens in a new tab)

CVE-2026-17083 (CVSS 9.8): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. (opens in a new tab)

NVD ·fetched 15 Aug 2026, 15:40 UTC CVE-2026-17083 CVSS 9.8 EPSS 0.5% agreed3/3

Why readUnauthenticated remote code execution in IBM i 7.3 through 7.6 via a stack-based buffer overflow, with no user interaction required.

CVE-2026-17083 carries CVSS 9.8 with AV:N/AC:L/PR:N/UI:N, meaning a remote attacker needs no credentials and no interaction to reach arbitrary code execution on affected IBM i releases 7.3, 7.4, 7.5 and 7.6. IBM's advisory text is terse and gives no component or protocol detail, and CISA's SSVC record currently lists exploitation as none with technical impact total; EPSS is 0.0046. IBM i typically runs core financial and ERP workloads on long patch cycles, so the exposure question is which of these systems are reachable from anywhere other than the internal network.

nvd.nist.gov → (opens in a new tab)

CVE-2026-49478 (CVSS 8.7): Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follo (opens in a new tab)

NVD ·fetched 15 Aug 2026, 23:38 UTC CVE-2026-49478 CVSS 8.7 EPSS 0.3% agreed3/3

Why readSigstore's Fulcio CA follows cross-host redirects during OIDC discovery with Kubernetes ServiceAccount tokens attached, allowing JWKS substitution and token disclosure to external hosts.

Fulcio through 1.8.5 attaches Kubernetes ServiceAccount tokens while following cross-host redirects in OIDC discovery, giving a malicious or compromised issuer blind SSRF, the ability to substitute and cache malicious JWKS keys, and a path to leaking the ServiceAccount token off-cluster. Poisoning the JWKS cache of a code-signing CA is the serious end of that list. Version 1.8.6 blocks cross-host redirects, restricts token injection and restricts local token loading, and there are no workarounds for anyone running their own Fulcio instance.

nvd.nist.gov → (opens in a new tab)

CVE-2026-73483 (CVSS 9.4): Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An au (opens in a new tab)

NVD ·fetched 15 Aug 2026, 23:38 UTC CVE-2026-73483 CVSS 9.4 EPSS 0.4% agreed3/3

Why readA complete path from an authenticated Flowise user to root command execution on the host, with the exact parameters and the config flag that gates it.

Flowise 3.1.2 and earlier let anyone with access to /api/v1/node-custom-function break out of the vm2 based nodevm sandbox by handing puppeteer.launch() an attacker controlled executablePath and args, which reaches child_process.spawn() outside the sandbox boundary. The result is arbitrary commands as the Flowise process user, root in the official Docker image, plus host file disclosure through Chromium's file:// handling. Versions 3.0.8 through 3.1.2 need ALLOW_BUILTIN_DEP=true to be exploitable; anything earlier is exploitable by default, and 3.1.3 is the fix.

nvd.nist.gov → (opens in a new tab)

CVE-2026-73407 (CVSS 9.0): Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/rest.ts attached credentials f (opens in a new tab)

NVD ·fetched 15 Aug 2026, 15:40 UTC CVE-2026-73407 CVSS 9.0 EPSS 0.4% agreed3/3

Why readAn unauthenticated caller of a public Budibase query could redirect the request to their own host and receive the datasource's stored bearer, basic or static-header credentials.

CVE-2026-73407 sits in RestIntegration._req in packages/server/src/integrations/rest.ts, which attached credentials from getAuthHeaders and defaultHeaders without checking that the final destination matched the datasource origin. Calling PUBLIC POST /api/v2/queries/:queryId with an absolute or parameterized path pointing at attacker infrastructure exfiltrates the stored secret with no authentication at all. Fixed in Budibase 3.40.1; treat any credential configured on a REST datasource on an exposed instance as burned and rotate it.

nvd.nist.gov → (opens in a new tab)

CVE-2026-73519 (CVSS 9.3): WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, (opens in a new tab)

NVD ·fetched 15 Aug 2026, 19:37 UTC CVE-2026-73519 CVSS 9.3 EPSS 0.6% agreed3/3

Why readWolfStack before 25.9.2 ships a hard-coded cluster secret in src/auth/mod.rs that unauthenticated attackers can replay in the X-WolfStack-Secret header for root command execution in any container.

The authentication gate require_auth() accepts a constant compiled into every build and published in source, so any request carrying that value in the X-WolfStack-Secret header passes without a session, API key or account. From there an attacker reaches the management port to enumerate all Docker and LXC containers on the host and run arbitrary commands as root via POST /api/containers/{runtime}/{id}/exec. Fixed in 25.9.2; rotate nothing, because there is nothing to rotate until you upgrade.

nvd.nist.gov → (opens in a new tab)

CVE-2026-73625 (CVSS 8.7): GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git (opens in a new tab)

NVD ·fetched 15 Aug 2026, 23:38 UTC CVE-2026-73625 CVSS 8.7 EPSS 0.5% agreed3/3

Why readGitPython's check_unsafe_options guard can be bypassed by hiding git options in single-character kwarg values, giving command execution through clone_from, fetch, pull, push and six other methods.

GitPython before 3.1.54 fails to catch smuggled git options passed inside single-character kwarg values, so a crafted option dictionary reaching clone_from, fetch, pull, push, ls_remote, iter_commits, blame or archive can set --upload-pack and run arbitrary OS commands. This is a bypass of an existing hardening control rather than a fresh oversight, which matters because callers were told the guard made user-supplied options safe. CI systems, build tooling and repo-analysis services that pass any user-influenced dictionary into these methods should upgrade rather than rely on their own filtering.

nvd.nist.gov → (opens in a new tab)

ZDI-26-583: Clam AntiVirus 7z Archive Parsing Integer Overflow Remote Code Execution Vulnerability (opens in a new tab)

ZDI Published Advisories ·fetched 15 Aug 2026, 15:40 UTC Research CVE-2026-20215 EPSS 0.5% agreed3/3

Why readRemote code execution in ClamAV via an integer overflow when parsing 7z archive streams, which matters because ClamAV sits in mail and file-upload paths and eats attacker-supplied archives by design.

CVE-2026-20215 is an integer overflow in ClamAV's parsing of streams inside 7z files: user-supplied data is not validated before a buffer allocation, allowing code execution in the ClamAV process context. Cisco has shipped a fix under advisory cisco-sa-clamav-88cFYyxR. The interaction requirement is weak in practice for gateway deployments, where scanning an inbound archive is the interaction.

zerodayinitiative.com → (opens in a new tab)

CVE-2026-16770 (CVSS 9.8): PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document. For an HTML string or file (opens in a new tab)

NVD ·fetched 15 Aug 2026, 19:37 UTC CVE-2026-16770 CVSS 9.8 EPSS 0.4% agreed3/3

Why readHTML meta tags become wkhtmltopdf command-line options in Perl's PDF::WebKit, so an untrusted document can turn on --enable-local-file-access and pull local files into the rendered PDF.

PDF::WebKit through 1.2 collects every <meta name="pdf-webkit-KEY" content="VALUE"> from the document head and converts each into a renderer option, normalising KEY to --[a-z0-9-]+ with no allow list and passing VALUE through untouched; a VALUE of "yes" emits a bare flag. BUILD merges these last, so document-supplied options override both module defaults and the options the application set, reaching switches such as --enable-local-file-access and --cookie-jar. It is argument injection rather than shell injection since the renderer is exec'd with an argument list, and the same pattern is worth checking in any wrapper that maps document metadata onto a renderer CLI.

nvd.nist.gov → (opens in a new tab)

From alert to forensic insight, automatically, with the Magnet Nexus API (opens in a new tab)

Magnet Forensics ·HaadiyaAli ·fetched 15 Aug 2026, 07:39 UTC agreed3/3

Why readArgues for triggering forensic collection off SOC alerts automatically so memory and rolling logs survive the gap between tier-1 escalation and DFIR pickup.

The scenario is the real point: an alert flagged at 11pm Friday, a machine rebooted before Monday, memory gone and logs rolled over. Magnet's Nexus API is offered as the fix, wiring collection and case creation into SIEM, SOAR, EDR/XDR and ticketing triggers. The preservation-window argument stands on its own for anyone building automated triage, but the post is a vendor product explainer with no endpoints, versions or configuration detail.

magnetforensics.com → (opens in a new tab)

An Empirical Study of Output-to-Input Loops for Black-Box Backdoor Detection in Fine-Tuned Open-Weight LLMs (opens in a new tab)

arXiv cs.CR (AI) ·Md. Nahid Hasan, Mohammad Arif Hossain ·fetched 15 Aug 2026, 15:40 UTC Must read Research agreed3/3

Why readGives a black-box method for spotting backdoors in fine-tuned open-weight models without training data, clean weights or knowledge of the trigger: feed the model's own output back as its next input and watch it drift toward its fine-tuning data.

Self-feeding was tested on six open-weight LLMs from 3B to 15B, each fine-tuned with backdoors across eleven attack categories, using twenty benign starting prompts and chains up to ten steps. It surfaced backdoors in five of six models at 92.0 percent pooled precision, against a repeated same-prompt baseline that hit on one of 120 prompt-model pairs; starting prompts as mundane as a joke request or a coffee recipe reached a trigger within a few steps. Per-prompt recall is low, so this is a cheap screening pass to run many times rather than a clearance test for a model you pull off a hub.

arxiv.org → (opens in a new tab)

The Agentic AI threat cluster: Seven incidents, three actors, and what they mean for your exposure (opens in a new tab)

Tenable Research ·Research Special Operations ·fetched 15 Aug 2026, 03:42 UTC Must read CVE-2025-3248 EPSS 100.0% agreed3/3

Why readIt attaches confirmed numbers and a named CVE to autonomous-agent intrusions, including a Taiwanese government breach that ran largely without a human at the keyboard.

Tenable's Research Special Operations team links seven incidents since late July 2026 into a single agentic AI cluster, anchored by Taiwan's Ministry of Digital Affairs confirming that autonomous agents mapped 21 government systems, took 85 accounts and pulled over 2,564 personnel records in roughly four days. The cluster also covers JADEPUFFER, which exploited CVE-2025-3248 in Langflow for automated database extortion, and knaithe/KnYuan, a Chinese-speaking operator Unit 42 assesses with moderate confidence as using the same agent framework for autonomous scanning. The through line the report draws is unglamorous: every incident started at identity and authentication exposure, meaning discoverable federation endpoints and weak credentials, not novel agent capability.

tenable.com → (opens in a new tab)

Backdoor Decontamination Dynamics in LLM Agents (opens in a new tab)

arXiv cs.CR (AI) ·Gabriel Huang, Abhay Puri, Léo Boisvert, Alexandre Drouin ·fetched 15 Aug 2026, 19:37 UTC Must read Research agreed3/3

Why readMeasures whether installing and then unlearning a known backdoor removes an unknown one in tool-calling LLM agents, with a 56% erasure rate across 115 experiments.

The authors build a framework on AgentDyn that decouples trigger, response, teacher and fine-tuning method to study what happens to an unknown fine-tuning backdoor when a defender deliberately poisons and then unlearns a known one. Defensive poisoning alone erased roughly 56% of original backdoors, and the subsequent decontamination step drove nearly all survivors to erasure; malicious backdoors did not persist when the defensive trigger differed from the original. The result that trigger recognition and malicious execution are behaviourally dissociable is the part that matters for anyone assessing open-weight agent models.

arxiv.org → (opens in a new tab)

CVE-2026-73487 (CVSS 9.0): Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inje (opens in a new tab)

NVD ·fetched 15 Aug 2026, 23:38 UTC Must read CVE-2026-73487 CVSS 9.0 EPSS 0.4% agreed3/3

Why readThis is the one Flowise flaw that needs no credentials at all: a chat message sent to the public prediction API turns into Python running on the host.

Flowise before 3.1.3 validated Python in its CSV and Airtable Agent nodes with a regex blocklist that never covered pandas helpers such as pd.read_json(), so a crafted prompt reaching the unauthenticated prediction endpoint can pull remote data, hit internal services over SSRF, or execute code. The CVSS 4.0 vector is AV:N/PR:N/UI:N with high confidentiality impact and a scope change, and CISA's SSVC record marks it proof-of-concept and automatable even though EPSS still sits near 0.4 percent. Upgrading to 3.1.3 is the only fix; any Flowise instance whose prediction API is reachable without auth should be treated as exposed now, not after the EPSS number moves.

nvd.nist.gov → (opens in a new tab)

CVE-2026-73296 (CVSS 9.4): Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and (opens in a new tab)

NVD ·fetched 15 Aug 2026, 07:39 UTC Research CVE-2026-73296 CVSS 9.4 EPSS 2.6% agreed3/3

Why readMicrosoft's UFO agent framework exposed unauthenticated MCP servers on TCP 8020 and 8021 that let anyone drive an ADB-connected Android phone.

create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py bound Streamable HTTP MCP services to ports 8020 and 8021 with no authentication before version 3.0.8. A remote attacker could call capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key and click_control against the attached device, reading the screen and changing device state. It is a clean example of the wider pattern worth hunting for: agent frameworks shipping MCP tool servers that assume localhost is a trust boundary.

nvd.nist.gov → (opens in a new tab)

xyiqq/skilldoctor: Quality gate for Agent Skills: lint, security audit, and Claude/Cursor/Codex/OpenCode compatibility. (opens in a new tab)

GitHub: new security tools ·xyiqq ·fetched 15 Aug 2026, 15:40 UTC Research ★ 171 agreed3/3

Why readAgent skill files are an emerging supply chain surface, and this is a CI-ready gate that flags SKILL.md instructions attempting to override system or hidden-user policy.

skilldoctor lints Agent Skill definitions against the published spec, audits them for unsafe instructions, and checks whether a single SKILL.md actually behaves across Claude Code, Cursor, Codex, OpenCode, Gemini CLI and Copilot. The audit rule set includes a prompt-injection check that errors on instructions trying to override system policy, and findings carry exit codes and GitHub annotations so they can block a pull request. Suppression is per-rule with a documented warning against using it to permanently hide security errors, which is the right default for teams adopting skills from third-party repositories.

github.com → (opens in a new tab)

Non-Degenerate Risk Certification for Automated Security Decisions: A Decision-Contract Theory with ATT\&CK-Aligned Triage as a Worked Instance (opens in a new tab)

arXiv cs.CR (AI) ·Zhenpeng Li ·fetched 15 Aug 2026, 11:37 UTC Research agreed3/3

Why readFormalises why risk bounds on automated triage can be vacuous, since a system that abstains from every decision satisfies the bound, and proposes an actionability certificate that excludes all-abstain solutions.

The paper argues any risk certificate is only meaningful relative to a decision contract: the inputs acted on plus the semantic relation defining a correct output. It introduces an error-conservation law showing error is merely reassigned among harmful automation, human deferral and semantic masking, plus a label-free capacity test separating recoverable threshold misalignment from genuine incapacity. Evaluation on ATT&CK-aligned alert triage across 3 IDS datasets, 6 LLMs and 4 error-rate thresholds holds false-attribution risk at or below target in 90.3% of configurations.

arxiv.org → (opens in a new tab)

Privacy-Preserving RAG by Concealing Sensitive Information from External LLMs (opens in a new tab)

arXiv cs.CR (AI) ·Saleh Almohaimeed, Saad Almohaimeed, Mousa Jari, Fahad Alotaibi ·fetched 15 Aug 2026, 03:42 UTC Research agreed3/3

Why readAddresses the RAG privacy hole nobody patches: the third-party model provider sees both your query and every retrieved document.

SEAG uses a lightweight local model to locate sensitive entities, generate aliases for them, and build a replacement table applied to the query and retrieved documents before anything is sent to an external generator, with the mapping reversed on the response. The authors built two datasets, one for fine-tuning the entity locator. Relevant to anyone approving a RAG deployment over confidential corpora against a hosted API, where the usual controls stop at access management and ignore what leaves the boundary.

arxiv.org → (opens in a new tab)

CVE-2026-73299 (CVSS 10.0): Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .p (opens in a new tab)

NVD ·fetched 15 Aug 2026, 07:39 UTC CVE-2026-73299 CVSS 10.0 EPSS 1.2% agreed3/3

Why readA prompt template file is executable input: an attacker supplied .prompty file reaches JavaScript execution in the Node.js process running your LLM pipeline.

Prompty's TypeScript Nunjucks renderer evaluated .prompty template bodies with unrestricted JavaScript member access, letting a template walk constructor and prototype properties into code execution in the host process. Fixed in 0.1.5 and 2.0.0-beta.5. CVSS is 10.0 with a changed scope, but EPSS sits near 0.01 and the package is niche; the value here is the class of bug, namely prompt assets fetched from registries, repos or user uploads being treated as data when the renderer treats them as code.

nvd.nist.gov → (opens in a new tab)

CVE-2026-73484 (CVSS 8.6): Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv (opens in a new tab)

NVD ·fetched 15 Aug 2026, 23:38 UTC CVE-2026-73484 CVSS 8.6 EPSS 0.3% agreed3/3

Why readFlowise's Python sandbox blocklist misses native Pandas DataFrame methods, so to_csv and friends give file write and data exfiltration from an LLM workflow node.

Flowise before 3.1.3 validates Python code in pythonCodeValidator.ts but does not block DataFrame methods such as to_csv, to_json, pipe and query, which reach the filesystem without going through any of the banned imports. An authenticated user can exfiltrate uploaded CSV data or write arbitrary files on the server. Proof-of-concept exploitation is recorded; upgrade to 3.1.3, and treat blocklist-based Python sandboxes in agent platforms as failing open by default.

nvd.nist.gov → (opens in a new tab)

Unclecheng-li/DeepSec: DeepSec — AI Security Offense & Defense Platform. Shield audits AI-generated code for hallucinated packages, missing safeguards & AI pattern errors in real time. Spear automates authorized penetrat (opens in a new tab)

GitHub: new security tools ·Unclecheng-li ·fetched 15 Aug 2026, 19:37 UTC Research ★ 240 agreed3/3

Why readA CLI and TUI that scans AI-generated code for hallucinated package imports and wraps 40-plus recon tools behind a signed scope manifest that refuses out-of-scope targets.

DeepSec, evolved from VibeGuard, ships two halves: Shield, which audits AI-written code for hallucinated dependencies and missing safeguards, and Spear, an authorized pentest engine driving nmap, nuclei, sqlmap, ffuf, subfinder, httpx, dirsearch and feroxbuster as skill packs. Scope control is the notable design choice: targets must appear in a scope.json manifest, optionally signed via DEEPSEC_SCOPE_SIGNING_KEY, and anything outside it is rejected. Prebuilt binaries and a 0.2.0 wheel are on the releases page, though at 240 stars and an early version number this is worth a look rather than a rollout.

github.com → (opens in a new tab)

CVE-2026-73614 (CVSS 8.7): Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the (opens in a new tab)

NVD ·fetched 15 Aug 2026, 23:38 UTC CVE-2026-73614 CVSS 8.7 EPSS 0.4% agreed3/3

Why readNetwork-AI's ClaudeHookBridge truncates the command to 500 characters before applying denyPatterns, so padding past byte 500 defeats the operator's hard-deny list.

ClaudeHookBridge before 5.15.1 evaluates deny patterns against a 500-character truncation of the target string while Claude Code executes the full command, letting an attacker place the dangerous portion beyond the cut-off and bypass the operator hard-deny list entirely. Proof-of-concept exploitation is recorded in the SSVC data. Anyone building hook-based approval gates for coding agents should check whether their matcher and their executor see the same bytes.

nvd.nist.gov → (opens in a new tab)

Trump signs memo authorizing private sector to launch cyberattacks (opens in a new tab)

Google News: incidents · washingtonpost.com ·fetched 15 Aug 2026, 11:37 UTC Must read agreed3/3

Why readA presidential memorandum reportedly clearing private companies to conduct offensive cyber operations, which reopens a legal question most general counsel had treated as closed.

The Washington Post reports that President Trump has signed a memorandum authorising private sector entities to launch cyberattacks, apparently aimed at foreign threat actors. If the reporting holds, it displaces the long-standing position that hack-back exposes firms to Computer Fraud and Abuse Act liability and leaves the operational boundaries, attribution standards and escalation controls to be defined. Security leaders should expect the question of whether their own organisation will now be asked to retaliate, and should read the memorandum text rather than the coverage before answering it.

news.google.com → (opens in a new tab)

Private security firms will soon be allowed to hack overseas cybercriminals (opens in a new tab)

Ars Technica Security ·Dan Goodin ·fetched 15 Aug 2026, 03:42 UTC Must read agreed3/3

Why readA presidential memorandum sets up a programme under which private security firms would run US authorised offensive cyber operations against foreign criminal groups, which changes what hack back means legally.

A National Security Presidential Memorandum directs the National Coordination Center to build a programme for cyber operations against foreign transnational criminal organisations, with private sector firms brought in to conduct both Cyber Surveillance Operations and Cyber Effects Operations under Justice and Homeland Security oversight. The accompanying fact sheet names ransomware, sextortion, phishing, financial fraud and impersonation scams as in scope targets. The authorisation mechanics, liability treatment, attribution standards and vetting of participating firms are all still undefined, and those details determine whether this is a narrow deputisation or a broad licence.

arstechnica.com → (opens in a new tab)

SoK: From Generation to Consumption of Privacy Documents in Software Systems (opens in a new tab)

arXiv cs.CR (AI) ·Shidong Pan, Clark LaChance, Zhen Tao, Sepideh Ghanavati ·fetched 15 Aug 2026, 07:39 UTC agreed3/3

Why readSystematisation of 290 papers from 2010 to 2025 on how privacy policies and privacy labels are generated, analysed for noncompliance, and evaluated, with 15 trends and 21 open problems named.

The paper organises the privacy-document literature around five lifecycle questions: definition and scoping, generation, extraction and analysis, inconsistency and noncompliance checking, and usability evaluation. It surfaces where automated compliance checking has been attempted and where the gaps remain. Relevant mainly to privacy engineering and GRC teams building or buying policy-analysis tooling, less so to day-to-day operations.

arxiv.org → (opens in a new tab)

Enforcement set to ramp up over sanctions compliance, warn lawyers (opens in a new tab)

Compliance Week ·Neil Hodge ·fetched 15 Aug 2026, 03:42 UTC agreed3/3

Why readThe FCA found sanctions compliance falling short across multiple areas and lawyers expect enforcement to follow, which matters if your controls are documented rather than tested.

The UK financial regulator's review found firms' sanctions compliance deficient in several areas, and counsel quoted expect oversight and enforcement to increase. The stated bar is that "paper policies" will not satisfy regulators, meaning screening and controls need evidence of operation. Relevant to financial services GRC teams, though the text here is thin on which specific failings the FCA named.

complianceweek.com → (opens in a new tab)

France probes unprecedented cyberattack after tax data of 678,000 users stolen (opens in a new tab)

Google News: incidents · RFI ·fetched 15 Aug 2026, 15:40 UTC agreed3/3

Why readFrench authorities are investigating theft of tax data belonging to 678,000 users, a named-scale public-sector breach with GDPR and national-notification consequences.

RFI reports France has opened an investigation into a cyberattack described as unprecedented, in which the tax data of 678,000 users was stolen. No attribution, intrusion vector or timeline is given in the supplied text. The figure and the sector make this the story a European board or public-sector executive will raise on Monday, and a marker for how the French regulator responds.

Also covered byaa.com.tr (opens in a new tab).

news.google.com → (opens in a new tab)

Sogang University data breach exposes 180,000 student, staff accounts (opens in a new tab)

Google News: incidents · Korea JoongAng Daily ·fetched 15 Aug 2026, 11:37 UTC agreed3/3

Why readSogang University disclosed a breach affecting 180,000 student and staff accounts, a scale that puts Korean higher education back in front of regulators.

Korea JoongAng Daily reports a data breach at Sogang University exposing roughly 180,000 student and staff accounts. The feed carries only the headline, so the intrusion vector, data categories and disclosure timeline are not available here. Higher education continues to hold large identity datasets on thin security budgets, and account credentials at this volume feed downstream credential stuffing.

news.google.com → (opens in a new tab)

Possible cyberattack hits Wake election software vendor, leaving poll workers' data exposed (opens in a new tab)

Google News: incidents · WRAL ·fetched 15 Aug 2026, 07:39 UTC agreed3/3

Why readAn election software vendor serving Wake County, North Carolina was apparently breached, exposing poll worker data ahead of an election cycle.

WRAL reports a possible cyberattack on the software vendor used by Wake County elections, with poll workers' personal data exposed. Only the headline reached us, so scope, vendor name and attack detail are not established here. Election-sector third-party compromise is the kind of item that draws immediate questions from officials and press, which is why it lands for leaders even without technical detail.

news.google.com → (opens in a new tab)

A crippling cyberattack hit a small California city, shuttering City Hall. Residents wonder: Why us? (opens in a new tab)

Google News: incidents · Los Angeles Times ·fetched 15 Aug 2026, 19:37 UTC agreed2/3

Why readA concrete picture of what a total operational shutdown looks like at a municipality with no dedicated security staff, and why small cities keep getting picked.

The Los Angeles Times reports on a small California city where a cyberattack was severe enough to close City Hall and halt public services. The piece centres on the question residents ask after these events, which is why a town of their size was targeted at all; the answer is that small municipalities are chosen for weak controls and high disruption cost, not for prominence. Useful as evidence when arguing local-government budget and continuity planning, less so for technical detail, since no attribution or intrusion mechanics are given.

news.google.com → (opens in a new tab)

Judge refuses to dismiss Aflac data breach lawsuit (opens in a new tab)

Google News: incidents · BenefitsPRO ·fetched 15 Aug 2026, 03:42 UTC agreed2/3

Why readThe Aflac breach class action survived a motion to dismiss, the stage where most breach suits are killed off.

A judge declined to throw out the consumer litigation arising from Aflac's data breach, so the case moves into discovery rather than ending early. Coverage is thin on which specific claims survived and on the standing theory the court accepted, which is the part that would make this useful as precedent. For now it is a marker that breach plaintiffs are clearing the dismissal bar more often, and a reason for risk and legal teams to expect longer, costlier tails on incidents.

news.google.com → (opens in a new tab)