Threat intelligence editor

Alex Kim

Articles: 235
Desks: 7

Focuses on cloud identity, incident response, and exploitation trends.

CloudIncident responseIdentity

Coverage by Alex Kim

Data graphic: headed 'One request kills the decode engine', a CVSS v4 score of 8.7 on five vLLM connector CVEs and a four-step path from a bad kv_transfer_params request to a decode instance, an uncaught exception, and the engine exiting. vLLM is affected through 0.29.0, all 6 of 6 fix pull requests are open, and no fixed release is named.

vLLM NIXL and Mooncake Flaws Let One Request Kill Decode Engines, With No Fixed Release Named

Five CVSS 8.7 denial-of-service CVEs hit vLLM's disaggregated serving connectors, and every fix pull request was still open on 3 October.

Oct 2 · 6 min

Data graphic: a CVSS 3.1 score of 10.0 Critical, Arista PSIRT for CVE-2026-93952 in Arista VeloCloud Orchestrator, exploited and on the CISA KEV list since 22 Sep. A 'No fix listed' stamp marks the 6.1.x and 7.0.x release trains, while only 5.2.x and 6.4.x are listed as fixed.

criticalExploits Cve 2026 93952

Arista VeloCloud Orchestrator Exploited at CVSS 10.0, With No Fix Listed for Two Release Trains

Arista confirms active exploitation of CVE-2026-93952 in on-prem VeloCloud Orchestrator. CISA added it to KEV, but 6.1.x and 7.0.x have no listed fix.

Oct 2 · 4 min

Data graphic: MiniMax M3.1 Flash, a multimodal coding model that always thinks before it answers, shown with a huge "1M" for its 1-million-token context window. Two smaller stats give its 5 effort levels low to max, default max and a 66.25% score 53/80 points on KingBench 3, an independent 8-task test.

watchResearch Minimax M3 1 Flash

MiniMax M3.1 Flash: 1M-Context Coding Model That Always Thinks

MiniMax's M3.1 Flash preview brings a 1M-token context, image and video input and five effort levels to MiniMax Code. What it does, and how it tests.

Oct 2 · 8 min

Data graphic: timeline of WSO2 CVE-2026-5430. WSO2's advisory and fix on May 3, the CVE record on Aug 6 95 days later , the first forged admin token in a watchTowr honeypot on Sep 13 133 days after the fix , and CISA KEV on Sep 24.

criticalExploits Cve 2026 5430

WSO2 API Manager JWT Bypass Exploited 133 Days After the Fix

Forged admin tokens for WSO2 API Manager flaw CVE-2026-5430 (CVSS 10.0) hit honeypots 133 days after the fix. CISA's KEV entry describes the wrong bug.

Oct 2 · 5 min

Data graphic: Mythos breaks HFS sessions. A huge 12 marks the leaked Math.random values from an unauthenticated login; CVSS 9.8 critical, fixed in 3.2.1 3.0.0–3.2.0 affected , no authentication required.

highAI Security Cve 2026 61500

Mythos Cracked Rejetto HFS Sessions From 12 Leaked Math.random() Values

Horizon3 used Anthropic's Mythos to find CVE-2026-61500: Rejetto HFS 3.x leaks Math.random() values that let attackers forge admin cookies. Fixed in 3.2.1.

Oct 2 · 6 min

Data graphic: a CVSS severity scale showing CVE-2026-94127 for F5 BIG-IP APM rated 9.8 critical.

criticalExploits Cve 2026 94127

F5 BIG-IP APM: An Oversized Bearer Token Is Enough for Unauthenticated RCE

An unauthenticated attacker can run code on F5 BIG-IP APM with one oversized Bearer token — but only when APM is configured as an OAuth Authorization Server.

Oct 2 · 6 min

Data graphic: Apple's CoreGraphics zero-day CVE-2026-86950 , an out-of-bounds write that lets a crafted file run code on iPhone, iPad and Mac, scores CVSS 3.1 8.8 and is exploited per CISA KEV. Fixes are iOS, iPadOS and macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, with a CISA KEV deadline of 2 Oct.

highExploits Cve 2026 86950

Apple Patches CoreGraphics Zero-Day Used Against Targeted iPhone Users

CVE-2026-86950, a CoreGraphics out-of-bounds write hit via a crafted file, was exploited on iOS before 27. Update to iOS 26.7.1, macOS 26.7.1 or 15.8.1.

Oct 2 · 6 min

Data graphic: a timeline of WordPress core flaw CVE-2026-87902 CVSS 4.0 9.2 , zooming into 22 September, the day the fix shipped in 25 releases. Patchstack logged the first exploit attempt at 11:49 UTC and the first pearcmd.php file-write attempt at 15:34 UTC that same day; the bug had been reported 64 days earlier on 20 July, and CISA added it to KEV on 25 September with a 28 September deadline.

highExploits Cve 2026 87902

WordPress Core Flaw CVE-2026-87902 Drew Exploit Attempts on Patch Day

A WordPress core path traversal, CVE-2026-87902, can reach RCE through pearcmd.php. Probes began the day the fix shipped and CISA lists it as exploited.

Oct 2 · 7 min