⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
This article discloses three high-severity security flaws in Hugging Face's Diffusers library, named FaceHugger, which allow crafted model repositories to execute arbitrary code by bypassing the trust_remote_code safeguard. The vulnerabilities pose significant risk to AI supply chains due to Diffusers' widespread use in enterprise environments.
Three high-severity vulnerabilities (CVE-2026-44827, CVE-2026-45804, CVE-2026-44513) in Hugging Face's Diffusers library could allow malicious model repositories to execute arbitrary code on systems loading them, bypassing the trust_remote_code security safeguard. The flaws, collectively named FaceHugger by Zafran Labs researchers, exploit Time-of-Check to Time-of-Use (TOCTOU) race conditions and code injection techniques during the model loading process.
The CrowdStrike 2026 Threat Hunting Report indicates that the window for exploitation is narrowing as AI use accelerates in both attacks and defenses. It emphasizes faster threat detection and response, reducing the time attackers have to operate undetected.
The CrowdStrike 2026 Threat Hunting Report highlights that the exploitation window is closing as AI use accelerates in cybersecurity. It emphasizes the need for proactive threat hunting and faster response to evolving adversary tactics.
The CrowdStrike 2026 Threat Hunting Report indicates that the window for exploitation is narrowing as AI use accelerates in both attacks and defenses. It emphasizes faster threat detection and response, reducing the time attackers have to operate undetected.
Multiple vulnerabilities were identified in Ubuntu Linux Kernel.