// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Today
-
Microsoft Teams to get AI-powered, context-aware phishing detection
Microsoft plans to add AI-powered, context-aware phishing detection to Teams messages beginning in early November 2026.
-
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Researchers reported a UEFI bootkit named BlackX bypassing Secure Boot on patched Windows systems during targeted attacks on Central Asian diplomatic organizations.
-
Ruby Regexp compilation fixes related to GitLab's CVE's
Ruby released Regexp compilation fixes related to GitLab CVEs.
-
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby released updates fixing three regex engine bugs linked to four GitLab remote code execution flaws caused by memory corruption during pattern compilation.
-
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Researchers reported ransomware affiliates used AI agents and an automated intrusion framework to carry out attacks and data extortion.
-
CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server
An open-source Multi Model Server has CVE-2026-115812 and CVE-2026-115813 affecting model archive extraction; the AWS inference tool is end-of-life.
-
CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server
CVE-2026-87912 and CVE-2026-87913 identify missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server.
-
CVE-2026-87911
A security bulletin describes CVE-2026-87911, an AWS-related vulnerability report.
-
CVE-2026-85788 - Issue with awslabs mysql-mcp-server
A CVE reports an issue in awslabs mysql-mcp-server, a tool for connecting MySQL databases with Model Context Protocol clients.
-
CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards
A stored cross-site scripting issue in OpenSearch Dashboards involves a bypass of a Vega expression function.
-
CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope
CVE-2026-85787 affects Amazon's PostgreSQL MCP server, allowing disallowed SQL inputs to modify data beyond read-only limits.
-
FCC bans two devices with surveillance chips linked to Huawei
The FCC banned two surveillance devices containing chips manufactured by Huawei subsidiary HiSilicon.
-
Microsoft: Windows Server 2016 reaches end of support in January
Windows Server 2016 will reach end of support in January 2027 and will no longer receive security updates.
-
Knicks sent employees fake offer of championship rings in phishing test: Report
The Knicks reportedly sent employees a fake offer of championship rings as part of a corporate phishing test.
-
PHP Informational advisory: Session upload progress (CVE-2026-115560)
PHP published an informational security advisory for CVE-2026-115560, which affects session upload progress functionality.
-
Quest Diagnostics confirms data breach exposed patient records
Quest Diagnostics confirmed a data breach exposed patient records after unauthorized access to its Quanum LSM system.
-
Senators say targeted ads are a security risk. Ad groups say the critics are off base.
Some senators and Citizen Lab researchers linked targeted ads to security risks, while IAB Europe and Google defended industry vetting practices.
-
Metasploit Wrap Up: Langflow, MongoDB, and More
Metasploit adds modules for Langflow authentication bypass and remote code execution flaws, along with other targets such as MongoDB.
-
PHP shares mitigation for new RCE vulnerability with no patch
PHP security team shared mitigation measures for an unpatched remote code execution vulnerability affecting non-default configurations.
-
Oracle Security Alert Advisory - CVE-2026-91403
An out-of-cycle security alert from Oracle addresses CVE-2026-91403 with a fix considered too critical to wait for the next patch update.
-
You gave your AI agent access, but who is giving it orders?
AI agents can be manipulated via malicious emails, websites, or plugins to misuse legitimate permissions for commands, data access, or file deletion, prompting discussion of runtime controls.
-
CVE-2026-115748: Apache Vysper: Authorization bypass
A security advisory reports an authorization bypass in Apache Vysper, an XMPP server library, affecting all versions and allowing authenticated users to compromise other accounts.
-
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Researchers reported a campaign compromising exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls and VPNs, exposing more than 70,000 credentials.
-
CVE-2026-115721: Apache Vysper: Unbounded allocation
A CVE describes unbounded XML parsing allocation in the retired Apache Vysper XMPP server library, potentially causing out-of-memory conditions.
-
CVE-2025-60497: NULL pointer dereference in GPAC/MP4Box GetESD via crafted MP4 input
A medium-severity CVE-2025-60497 describes a NULL pointer dereference in GPAC MP4Box GetESD triggered by crafted MP4 input, causing denial of service.
-
PHP Vulnerability Wrap-Up, (Fri, Oct 23rd)
A security alert update summarized recent PHP vulnerabilities and returned to normal status.
-
CVE-2025-60494: invalid memory read in GPAC/MP4Box gf_props_equal_internal via crafted MP4 input
A CVE describes an invalid memory read in GPAC MP4Box when processing crafted MP4 files, potentially causing denial of service.
-
CVE-2025-60492: uncontrolled recursion in GPAC/MP4Box BIFS decoder via crafted MP4 input
A CVE describes uncontrolled recursion in GPAC MP4Box BIFS decoder triggered by crafted MP4 files, causing stack exhaustion.
-
CVE-2025-60491: heap use-after-free in GPAC/MP4Box dasher_flush_segment via crafted MPEG-2 TS input
A heap use-after-free in GPAC MP4Box's dasher_flush_segment function can be triggered by crafted MPEG-2 TS input, assigned CVE-2025-60491.
-
CVE-2025-60490: heap use-after-free in GPAC/MP4Box gf_filter_pid_send_event_downstream via crafted MPEG-2 TS input
A heap use-after-free vulnerability in GPAC MP4Box can be triggered by crafted MPEG-2 Transport Stream input and has been assigned CVE-2025-60490.