Latest cybersecurity dispatches

Fresh reporting on active vulnerabilities, security patches, incident response, and threat research for defenders.

Articles: 407
Page: 21 / 51
Desks: 9

$Data graphic: Windows Cross Device flaw CVE-2026-66804 hands out SYSTEM, scored CVSS 3.1 7.8 Important by Microsoft, with Exploitation More Likely and a working exploit public. The four-step path runs from creating a DLL under ProgramData\CrossDevice, to a fake IMarshal object naming a dangling CLSID, to the Shell Create Object Handler, to the DLL loading in dllhost.exe as SYSTEM.$

elevatedExploits Local Privilege Escalation

Windows Cross Device flaw gives local users SYSTEM, with a public PoC

Project Zero's Forshaw details CVE-2026-66804, an incomplete fix for the Dark Elevator bug. A working exploit is public; August 2026 updates fix it.

Oct 2 · 5 min

Data graphic: Storm-3168 attack path from a service principal secret left in a public GitHub issue, through 15.5 hours of recon and 300+ reads, to a 7-minute deletion run most targeted storage accounts, one Key Vault, one Function App and 30+ ListKeys requests; Azure SQL deletions all failed and no ransom note was observed.

elevatedAI Security Agentic Ai

Storm-3168: A Secret Left in a GitHub Issue Led to a 7-Minute Azure Deletion Run

Microsoft details Storm-3168: an Azure secret left in a GitHub issue led to 15.5 hours of recon, then a 7-minute run deleting storage and Key Vault.

Oct 2 · 4 min

Data graphic: headed 'One request kills the decode engine', a CVSS v4 score of 8.7 on five vLLM connector CVEs and a four-step path from a bad kv_transfer_params request to a decode instance, an uncaught exception, and the engine exiting. vLLM is affected through 0.29.0, all 6 of 6 fix pull requests are open, and no fixed release is named.

highAI Security Vllm Serving

vLLM NIXL and Mooncake Flaws Let One Request Kill Decode Engines, With No Fixed Release Named

Five CVSS 8.7 denial-of-service CVEs hit vLLM's disaggregated serving connectors, and every fix pull request was still open on 3 October.

Oct 2 · 6 min

Data graphic: Open WebUI 0.11.4 patches 19 security advisories, 4 high and 15 medium, none with a CVE id. The highest CVSS score is 8.7, and three of the four high-severity advisories steal session tokens.

highAI Security Open Webui

Open WebUI 0.11.4 Patches 19 Advisories, Including Session Token Theft

Open WebUI 0.11.4 fixes 19 advisories, four high-severity and three of them session token theft. None has a CVE id. Upgrade and review sharing rights.

Oct 2 · 6 min

Data graphic: a CVSS 3.1 score of 10.0 Critical, Arista PSIRT for CVE-2026-93952 in Arista VeloCloud Orchestrator, exploited and on the CISA KEV list since 22 Sep. A 'No fix listed' stamp marks the 6.1.x and 7.0.x release trains, while only 5.2.x and 6.4.x are listed as fixed.

criticalExploits Cve 2026 93952

Arista VeloCloud Orchestrator Exploited at CVSS 10.0, With No Fix Listed for Two Release Trains

Arista confirms active exploitation of CVE-2026-93952 in on-prem VeloCloud Orchestrator. CISA added it to KEV, but 6.1.x and 7.0.x have no listed fix.

Oct 2 · 4 min

Data graphic: a CVSS 4.0 score of 8.5 High for GHSA-v234-4jrq-mgg6, a Claude Desktop Cowork flaw on macOS that runs commands when a file is opened. The path runs from an injected agent writing a file, to the Cowork shared folder, to the user opening it in Claude Desktop, to commands running on the Mac. Affected >= 1.1.3918 and < 1.15962.0, fixed in 1.15962.0, CWE-184.

highAI Security Claude Code

Claude Desktop Cowork Folder Flaw Let a File Run Commands on macOS

Anthropic fixed a Claude Desktop macOS flaw where a file an injected agent left in a Cowork folder could run commands when opened. Fixed in 1.15962.0.

Oct 2 · 4 min

Data graphic: a giant '44 days' headed 'Adobe Commerce flaw hits KEV' counts the time from Adobe's 11 August patch to CISA's 24 September KEV listing of CVE-2026-71362, a CVSS 9.1 Critical authorization flaw that needs no authentication.

criticalExploits Cve 2026 71362

Adobe Commerce and Magento Authorization Flaw CVE-2026-71362 Now Exploited

CISA added Adobe's critical Commerce and Magento authorization bug to KEV 44 days after the August patch. Stores on July builds should patch and triage.

Oct 2 · 5 min

Data graphic: LiteLLM salt-key flaw GHSA-7hp6-4w63-5g45, rated CVSS 3.1 9.9 Critical, shown as an attack path: an internal user submits crafted key metadata, the single salt key seals forged admin credentials, the bearer token is accepted, and the attacker gets proxy admin and command execution. First fixed on the 1.91 to 1.100 line in 1.100.4.

highAI Security Litellm Vulnerability

LiteLLM Salt-Key Flaw Lets Any Internal User Forge a Proxy Admin Token and Run Commands

A 9.9-rated GitHub advisory says LiteLLM's reused salt key lets an internal user become proxy admin and run commands. Two CVEs and another advisory landed too.

Oct 2 · 5 min