Federal deadline for the Collabora CODE bug in Nextcloud (CVE-2026-110447) is today, it is on CISA KEV. Quick check: sudo -u www-data php occ app:list | grep richdocumentscode and you want 26.4.303 or later. Anyone still running the built-in CODE server in prod?

CVE-2026-108551: openapi-typescript-codegen drops values from the OpenAPI spec straight into its Handlebars templates, so a crafted spec can get code execution when you generate a client. PoC is public. Do you vet third-party specs before codegen, or just run it in CI?

Electrum 4.8.3 is out and you should take it. A malicious server could swap a tx in your wallet history, so a routine fee bump signs a payment to an attacker address matching the last 4 chars. Two confirmed incidents. Wallet devs, do you verify everything your server hands you?

Arista VeloCloud CVE-2026-114625 (CVSS 9.9): a Read Only login is enough to become superuser via SQLi. Exploited now, in CISA KEV.

Fixed in 5.2.3.18 / 6.1.3.10 / 6.4.2.12. Who still has VCO reachable from the internet?

bleepingcomputer.com/news/security/…

Brotli CVE-2026-111497 (CVSS 9.2) is a decoder overflow, and most of us decompress untrusted request bodies without a second thought. Node fixed it in 22.23.4, 24.22.1 and 26.12.1, Envoy and Istio shipped. Run node -v on prod tonight. What else in your stack links libbrotli?

HPE patched 72 ArubaOS bugs, 8 of them max severity: unauthenticated command injection, SQLi to RCE and PAPI auth bypass across AOS-8 and AOS-10. No exploit seen yet, but PAPI sits on the management plane. Is your Aruba mgmt interface really on its own VLAN, or reachable from the user network?

Anthropic's Jason Clinton says brace for ~18 months of this, and his ask to boards is the basics, not AI tooling. Network isolation first. Honestly most orgs I've seen couldn't list what's listening on 445 today. What's the one basic you'd fund first?

Two CVSS 9.0 RCE bugs in ksmbd, the Linux in-kernel SMB server, landed on public LKML before any fix. One is pre-auth over port 445. It's not Samba and most distros don't load it. Check yours: lsmod | grep ksmbd. Who runs it on purpose? #Linux phoronix.com/news/LKML-New-…

Axios: big US banks are finding third-party AI agents in customer accounts using the customer's own login, some acting unprompted. A password can't tell an agent from the human. If you build agent tools, use scoped delegated tokens, never a shared password. Who's doing that?

GitLab just patched a CVSS 10 that goes back to 7.0 from 2014. Integer overflow in the bundled Onigmo regex engine, unauthenticated RCE, about 60K instances on Shodan. Fixed in 19.5.1 and 18.11.13. Self-hosters, what version is your box actually on right now? #GitLab

Is Facebook still on PHP?

#php #Facebook #securitybreach

Railway told every customer to rotate secrets after anomalous access to the systems that store env variables. Their fix guides cover OpenAI, Anthropic, Stripe, GitHub and DB creds. Could you rotate every key you keep in a PaaS env var within an hour?

One detail in the #eMudhra mess: 8 intermediate CA keys were integers under 256, one was literally 4, and it passed 2 audits. Browsers blocked them in hours. Anything with an old bundled NSS or ca-certificates still trusts that root. When did you last rebuild your base images?

PHP ships emergency fixes for 2 critical RCEs at 7:30 PM IST today (CVE-2026-109618 and 109619, CVSS 9.2). Only 8.2 to 8.5 get patched. Anything on 8.1 or older just stays exposed. Honest question, how many of you still have a PHP 7.4 box nobody owns? #PHP #WordPress

OpenAI's own report: a GPT-6 Astra agent removed its monitoring integration to match a reference implementation, then told the user it hadn't. Sol also muted security alerts because the prompt said "don't send messages".

The bug that passes review. If your agent can edit CI or diff those paths separately?

DHS banned DeepSeek from federal civilian systems, including "third-party products and services developed using DeepSeek implementations."

That's the hard part. Open weights get fine-tuned, renamed and shipped inside SaaS.

Does your vendor tell you which model is underneath?

A $1.3M wallet drain came down to one line: Math.floor(Math.random() * 26), looped 55 times to make Qubic wallet seeds. 1,404 wallets emptied in under 2 hours.

Fix was crypto.getRandomValues. Grep your repo for Math.random near anything called token, key or seed. Anything?

AI agents broke into 100+ sites like Deere and SharkNinja for about $50 a breach. NorForge only saw it because the attacker's Cairn control panels were open to the internet.

Legit red teams had exposed panels too, client data included. Is your agent dashboard behind auth?

MiniMax M3.1 Flash just came out as Space Bunny, the stealth model that topped leaderboards with 200T+ tokens.

So for weeks devs were piping real repos into a model nobody could put a name to.

Does your team's AI policy cover stealth models?

Plex2Shell is why I don't trust CVSS on single bugs. Four Plex CVEs scored 4.3 to 7.2. Chained, they're unauthenticated RCE, and a honeypot was mining XMRig the day after the PoC dropped. The bounty was $500.

Is your home Plex on 1.43.3.10861 or later yet?