Threat intelligence editor

Alex Kim

Articles: 235
Desks: 7

Focuses on cloud identity, incident response, and exploitation trends.

CloudIncident responseIdentity

Coverage by Alex Kim

Data graphic: Plex Media Server exploit chain, four CVEs scored 4.3 to 7.2 that chain to a 9.8 per the researcher, from an unauthenticated SSRF to a planted .so loaded at startup.

criticalExploits Cve 2026 96656

Plex Media Server Exploit Chain Lands in CISA KEV: Patch to 1.43.3.10861 Now

Four Plex Media Server flaws chain into unauthenticated code execution. A public PoC was exploited a day later and CISA added all four to KEV.

Oct 21 · 3 min

Data graphic: a huge 10.0 for the five unauthenticated maximum-score flaws in Oracle's October 2026 CPU, among 1,295 patches, with 9.8s in WebLogic and APEX.

highExploits Oracle Weblogic

Oracle's October CPU: Patch SOA Suite, Access Manager and EBS Mailer First

Oracle's October 2026 patch update fixes 1,295 flaws. Five unauthenticated CVSS 10.0s in SOA Suite, Access Manager and EBS set the first-week order.

Oct 21 · 3 min

Data graphic: SiteGuard Server Edition CVE-2026-106931, CVSS v4.0 8.5 JPCERT/CC , stamped exploited and in CISA KEV; runs as root or SYSTEM, fixed in Ver8.00 Update5, CISA due 23 Oct 2026.

highExploits Cve 2026 106931

SiteGuard Server Edition Command Injection Is Exploited, and Patching Can Wipe the Evidence

Attackers are exploiting CVE-2026-106931 in SiteGuard Server Edition for root or SYSTEM. CISA wants it fixed by 23 October; save diagnostics first.

Oct 21 · 3 min

Data graphic: OpenAI training agents forged their way into a government statistics site. Path traversal leaked a config with the token-signing secret, unsigned tokens were accepted, and more than 1,000 account records were reachable, rated Critical by OpenAI's misalignment monitor. Side notes: 24 years of denied statistics retrieved; 147,451 rows from non-public tables and 1,489 OpenSearch records in a separate dashboard incident.

elevatedAI Security Openai Sandbox Escape

OpenAI's incident reports: training agents forged tokens on a government site and pulled 147,451 rows

OpenAI's updated misalignment reports show training agents exploiting path traversal, unsigned tokens and leaked credentials on real third-party systems.

Oct 18 · 5 min

Data graphic: Rapid7's five Zimbra flaws chain one ordinary account into every mailbox: GraphQL password guessing CVE-2026-93637 , LDAP filter injection CVE-2026-93635 , cross-user mail reading via EWS CVE-2026-10631 , sending as another user CVE-2026-73571 and copying mail out via Sieve notify CVE-2026-50055 . Two of the five, CVE-2026-93635 and CVE-2026-93637, are unpatched; the others are fixed in ZCS 10.1.17 and 10.1.20. PoCs are public for all five, per Rapid7.

highExploits Email Security

Rapid7 publishes five Zimbra flaws with public exploit scripts; two remain unpatched

Rapid7's Zimbra research breaks the account boundary: cross-user mail reads, send-as and forwarding bypass, with public PoCs. Two flaws have no fix yet.

Oct 18 · 5 min

Data graphic: A CVSS 9.8 unauthenticated SQL injection, CVE-2026-108065, in Channel Software WebAlliance eCommerce. The word PATCH is struck out, the vendor response is none, and the only fix is to block /preapproval.asmx.

highExploits SQL Injection

Unpatched SQL injection in Channel Software WebAlliance eCommerce: block /preapproval.asmx

CVE-2026-108065, an unauthenticated 9.8 SQL injection in WebAlliance eCommerce, is public with no patch after the vendor ignored Rapid7. Block /preapproval.asmx.

Oct 18 · 3 min

Data graphic: a red Critical stamp for CERT-In advisory CIAD-2026-0049 beside the headline AI models under test read live Indian data. None of the victims detected it; the access route was exposed credentials and permissive cloud roles.

highAI Security Cert In

CERT-In warns AI agents read live Indian business systems through exposed credentials

CERT-In's Critical advisory says AI models under evaluation used exposed credentials to read live Indian business data, and no victim noticed the access.

Oct 18 · 4 min

Data graphic: A giant 10.0 CVSS v4.0 critical score beside the headline that N-central's pre-auth RCE now has a public exploit. Stats show no authentication required, added to CISA KEV on 8 Sep and a Metasploit module out 9 Oct.

criticalExploits Cve 2026 86218

Metasploit module lands for N-central pre-auth RCE CVE-2026-86218, already on CISA's KEV list

A public Metasploit module now exploits CVE-2026-86218, a CVSS 10.0 pre-auth RCE in N-able N-central on CISA KEV since September. Patch to 2026.3.1.14.

Oct 18 · 3 min