Skip to main content
Category

Security

Penetration tests, monitoring, and the boring controls that stop a quiet breach.

Featured

Security

GitLab's AI Gateway had a 9.9 flaw that let users run commands on the host

GitLab patched a CVSS 9.9 sandbox escape (CVE-2026-90970) in its self-hosted AI Gateway that let Duo Agent Platform users reach arbitrary command execution on the host.

Read
Security

SalesBleed: how a web form hijacked Salesforce's AI agents

Zenity Labs found three Salesforce Agentforce flaws, dubbed SalesBleed, that let a single lead form hijack AI agents for zero-click CRM data theft and phishing.

Read
Security

Eleven breaches in twenty-six seconds

GreyNoise says a Russian-speaking actor pointed hundreds of AI agents at PaperCut NG/MF and took 440 servers in 48 countries. The patch had been out for three days before the campaign even started.

Read
Security

IKE is not a set-and-forget VPN checkbox

CISA put a Windows IKE Extension RCE on the KEV list after seeing it used. If your edge still speaks IPsec, treat IKE like a live service, not a set-and-forget box.

Read
Security

The patch that broke the guard

Microsoft shipped a fix for Windows Defender crashing with 0xc0000005 after a security update. The same week Ars reported a Mac bug under active exploitation. Patch is not a vibe.

Read
Security

Someone else has to sign the tree

Trail of Bits is an independent signer on Signal's key-transparency work. If your product stores secrets or model memory, you also need a third party who can say the tree is wrong.

Read
Security

Shared metal still has a memory

Cloudflare revisited Spectre-class attacks on Workers. AWS wrote up passing user auth into Bedrock agents the same day. Isolation and identity are still the job.

Read
Security

Eight hours in someone else's EHR

CareCloud told HHS that 3.76 million people were affected after an attacker spent eight hours in an EHR environment. Dwell time is the product. Detection is the service.

Read

Send the ticket

Write what is broken or what you want shipped. We will say if it is a week or a quarter.

Start a project