Latest cybersecurity dispatches

Fresh reporting on active vulnerabilities, security patches, incident response, and threat research for defenders.

Articles: 407
Page: 14 / 51
Desks: 9

Data graphic: lollipop chart of verified bugs the ToFu fuzzer found in open-source MCP servers, by class: reflected output 115, path traversal 64, log injection 58, SSRF 7, data exfiltration 5, OS command injection 3, leftover temp file 1. The top three classes account for 237 of the 253 bugs.

elevatedAI Security Model Context Protocol

Fuzzing 273 MCP Servers Found 253 Verified Bugs, and Most Tools Trust Whatever the Model Sends

Researchers fuzzed 273 open-source MCP servers and verified 253 bugs in 118 of them, led by reflected output, path traversal and log injection. No CVEs yet.

Oct 13 · 3 min

Data graphic: vLLM 0.31 upgrade poster headed Check your flags. The default CUDA build moves from 12.9 to 13.0, with five old-to-new config changes: fp8 quantization, tokenizer_mode slow to hf, the mamba prefix-cache flag rename, mm kwargs needing --trust-request-mm-kwargs, and the -cu129 image kept. 717 commits from 307 contributors, 96 new.

watchResearch Vllm Serving

vLLM v0.31.0 Upgrade Notes: Preload Daemon, CRIU Snapshots, CUDA 13 Default and the Breaking Changes

vLLM 0.31.0 adds a preload daemon and CRIU snapshots, moves the default build to CUDA 13.0, and removes or renames flags. What to check before upgrading.

Oct 13 · 3 min

Data graphic: Ollama 0.40 poster with a giant 2 on a green block, meaning two copies on disk per upgraded model, the upgraded model plus its original backup. Version rows: v0.40.0 makes MLX the default on Apple Silicon, v0.40.2 upgrades models in the background and keeps backups, v0.40.3 pauses the upgrade.

watchResearch Ollama

Ollama 0.40 Makes MLX the Default on Macs, and 0.40.2 Keeps a Backup of Every Upgraded Model

Ollama 0.40 runs supported models on MLX by default on Apple Silicon, and 0.40.2 keeps a backup of every upgraded model on disk. How to clean up.

Oct 13 · 4 min

Data graphic: GPT-5.5 was retired from Codex for users signed in with ChatGPT on 14 Oct 2026 at noon PDT 19:00 UTC . Plus, Pro, Business, Enterprise and Edu move to GPT-6.1 Sol when available and Free and Go move to GPT-6 Luna in the desktop app. The OpenAI API and API-key Codex sessions are not affected.

watchResearch OpenAI Codex

GPT-5.5 Retired From Codex on October 14: What Replaces It on Each Plan

OpenAI retired GPT-5.5 from Codex for ChatGPT sign-ins on 14 October 2026. Paid plans move to GPT-6.1 Sol, Free and Go to GPT-6 Luna; the API keeps GPT-5.5.

Oct 13 · 4 min

Data graphic: cream poster headlined "Plain prompts: right math, no walls", with a huge 53 of 54 for the plain-prompt rooms drawn at the exact area asked for, with no wall thickness and no windows. Side stats: none of the six plain-prompt drawings had a window, and Gemini through a floor-plan editor's tools got 9, 9 and 0 of 9 rooms within 10%.

stableResearch Floorgen

ChatGPT Floor Plan to Scale? We Tested Claude and Gemini

A plain prompt got the room math right but drew no walls or windows. Through FloorGen's tools, Claude and Gemini built real plans, with new flaws.

Oct 13 · 9 min

Data graphic: SAP Cloud SDK for Python OAuth2 SSRF, CVE-2026-89111, rated CVSS 3.1 Critical at 10.0, with a stamp reading "None reported" for exploitation. Fixed in version 0.45.2, weakness CWE-918 SSRF.

highExploits Cve 2026 89111

SAP Cloud SDK for Python OAuth2 SSRF (CVE-2026-89111, CVSS 10.0) Leads October Patch Day

A tenant_subdomain value can redirect OAuth2 token requests and leak client credentials in SAP's Python SDK. Three more critical SAP flaws shipped; no exploitation reported.

Oct 13 · 7 min