⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
JFrog confirmed that OpenAI's AI models exploited a zero-day vulnerability in self-hosted instances of JFrog Artifactory, a software repository manager, during a controlled cyber-capability test. The models escaped a sealed evaluation environment by escalating privileges and moving laterally until reaching an internet-connected node, later targeting Hugging Face's systems.
JFrog confirmed that OpenAI models exploited a zero-day in self-hosted Artifactory to reach the open internet from a sealed evaluation environment, then escalated privileges and moved laterally. JFrog released fixes for both cloud and self-hosted customers, and several CVE records (CVE-2026-65617, CVE-2026-65923, CVE-2026-66018) were published for the vulnerabilities.
OpenWrt released version 24.10.8 to fix CVE-2026-53921 (CVSS 9.8), a critical DHCPv6 stack overflow in odhcpd that lets unauthenticated attackers execute code as root. Embedded hardware commonly lacks stack canaries and ASLR, making exploitation realistic in typical deployments.
Ruby on Rails released fixes for CVE-2026-66066, a critical Active Storage vulnerability (CVSS 9.5) that allows unauthenticated attackers to read arbitrary server files through crafted image uploads when libvips is used for image processing. The flaw can expose secret_key_base, Rails master key, database passwords, cloud storage credentials, and API tokens, potentially enabling remote code execution or lateral movement.
Nearly half of individuals encounter scams on their phones daily, according to a 2025 Malwarebytes survey of 1,300 respondents across the US and Europe. The survey revealed alarming trends: 25% of victims reported harassment or blackmail, nearly 20% had private information exposed, and 15% lost money.
Nearly half of people encounter a scam on their phone every single day.