Latest cybersecurity dispatches

Fresh reporting on active vulnerabilities, security patches, incident response, and threat research for defenders.

Articles: 407
Page: 17 / 51
Desks: 9

Data graphic: Sonnet 5.5 cache reads fell from $0.20 struck through to $0.10 per MTok on Oct 7, which is 0.05x the $2 base input price. Break-even is unchanged at 2 requests for the 5-minute cache.

Claude Sonnet 5.5 cache reads drop to $0.10 per MTok: when prompt caching pays

Sonnet 5.5 cache reads fell from $0.20 to $0.10 per MTok on Oct 7. Break-even stays at 2 requests (5-min cache) or 3 (1-hour); each hit costs half as much.

Oct 8 · 7 min

Data graphic: Poster for llama.cpp server bug CVE-2026-107183, a use after free CWE-416 in llama-server, rated CVSS v4.0 9.2 critical. Builds b8227 to b11392 are affected, the fix is b11393, and no exploitation is known.

highAI Security Cve 2026 107183

llama.cpp Server Bug CVE-2026-107183: A Crafted Chat Parser in One Request Corrupts the Heap

A use-after-free in llama-server lets a remote client crash it with one POST /completion request. Builds b8227 to b11392 are affected; upgrade to b11393.

Oct 8 · 4 min

Data graphic: Ollama /api/pull path traversal CVE-2026-103663 , unauthenticated and reaching root in typical Docker; CVSS 9.4 when /usr/lib/ollama is writable, 6.9 when not, fixed in 0.35.0, port 11434.

highAI Security Cve 2026 103663

Ollama Path Traversal Lets Remote Attackers Plant Files, and Reach Root in Docker Deployments (CVE-2026-103663)

Ollama's unauthenticated /api/pull path traversal (CVE-2026-103663) can plant a binary that runs as root on restart in Docker. Fixed in 0.35.0.

Oct 8 · 5 min

Poster: Max and Team now include API credits, Claude Code excluded

watchResearch Anthropic

Claude Max and Team Plans Now Include Monthly API Credits, but Claude Code Is Not Covered

Claude Max and Team now include monthly API credits: $100 on Max 5x, $200 on Max 20x, up to $500 for Team. Claude Code is excluded and credits expire monthly.

Oct 7 · 6 min

Chart of Claude Haiku 5.5 input price per million tokens: $0.10 up to 100K-token prompts against $1 on Haiku 4.5, and $0.50 above 100K, 5x the lower tier; effective $0.65 versus $1 at roughly 30% more tokens.

watchResearch Claude 4 5 Haiku

Claude Haiku 5.5 is 90% cheaper per token, until a prompt crosses 100K

Haiku 5.5 costs $0.10/$0.50 per MTok vs $1/$5 on Haiku 4.5, but a tokenizer change and a 5x tier above 100K tokens decide your real bill.

Oct 7 · 7 min

Three Cisco Nexus feature doors NGOAM, MPLS OAM, NX-API all lead to root, each CVSS 9.8, no exploitation known

highExploits Cisco

Three Unauthenticated Root RCEs Hit Cisco Nexus 3000 and 9000: Check Which Feature Is On

Cisco's NGOAM, MPLS OAM and NX-API flaws on Nexus 3000/9000 all score CVSS 9.8. Each needs a feature enabled; here's how to check.

Oct 7 · 6 min

Splunk Enterprise search head clusters carry a critical unauthenticated RCE, CVE-2026-76268, CVSS 9.8

highExploits Cve 2026 76268

Splunk Enterprise search head clusters exposed to critical unauthenticated RCE in Patroni API (CVE-2026-76268)

Splunk patched CVE-2026-76268, a CVSS 9.8 unauthenticated RCE in the Patroni API on search head cluster members. Fixed in 10.4.3 and 10.2.7; no exploitation stated.

Oct 7 · 5 min

Data graphic: LMCache one-message remote code execution flaw, CVE-2026-105192, rated CVSS 3.1 Critical 9.8, shown with a green stamp reading "Fixed in 0.5.6". Versions 0.3.9 to 0.5.5 are affected and the flaw needs no authentication; only routable binds are exposed, and workers and servers should be upgraded together.

highAI Security Cve 2026 105192

LMCache CVE-2026-105192: Unauthenticated Pickle RCE in Multiprocess Mode, Fixed in 0.5.6

CVE-2026-105192 is an unauthenticated pickle RCE in LMCache multiprocess mode, fixed in 0.5.6. Upgrade workers and servers together; routable binds were exposed.

Oct 7 · 9 min