Latest cybersecurity dispatches

Fresh reporting on active vulnerabilities, security patches, incident response, and threat research for defenders.

Articles: 407
Page: 23 / 51
Desks: 9

Data graphic: slope chart of vLLM startup on H200, before v0.30 versus v0.30: engine init from 28.9s to 8.2s 20.7s saved, 3.5x faster and CUDA graph capture from 12s to 2s 10s saved .

vLLM v0.30.0 Upgrade Notes: Fast Start, HiSparse, New Models and the Breaking Changes

vLLM v0.30.0 adds DeepSeek-V4.1-Flash, GLM-5.3-Flash, Fast Start and HiSparse, and changes defaults that can break an upgrade. What to check.

Oct 2 · 4 min

Data graphic: "GLM-5.3 writes exploits" with a large $20.40, the API cost of a working Chrome exploit built in about eight hours of model time and roughly 20 minutes of human attention; ExploitBench 50 of 410 against 56 of 410 for Mythos Preview, 92% compliance under prefilled reasoning, 100% engagement after abliteration.

highAI Security Glm 5 3

Anthropic: Open-Weight GLM-5.3 Nearly Matches Mythos Preview at Writing Exploits

Anthropic finds open-weight GLM-5.3 solves 50 of 410 ExploitBench exploits, near Mythos Preview, and its safeguards fall to abliteration.

Oct 2 · 3 min

Data graphic: the California AI Transparency Act's 1,000,000 monthly-user threshold struck through in red, removed by SB 1000 effective immediately.

elevatedPolicy Ai Transparency Regulation

California Drops the 1M-User Threshold From Its AI Transparency Act and Signs No Robo Bosses

SB 1000 removes the 1M-user threshold from California's AI Transparency Act, effective now; SB 947 limits AI in firing and discipline from July 2027.

Oct 2 · 3 min

Data graphic: MiniMax M3.1 Flash, a multimodal coding model that always thinks before it answers, shown with a huge "1M" for its 1-million-token context window. Two smaller stats give its 5 effort levels low to max, default max and a 66.25% score 53/80 points on KingBench 3, an independent 8-task test.

watchResearch Minimax M3 1 Flash

MiniMax M3.1 Flash: 1M-Context Coding Model That Always Thinks

MiniMax's M3.1 Flash preview brings a 1M-token context, image and video input and five effort levels to MiniMax Code. What it does, and how it tests.

Oct 2 · 8 min

Data graphic: Claude Code v2.1.287 turned mods on by default. A hub diagram shows a mod with unsandboxed access to files, secrets, prompts and network, approving tool calls before you are asked and spawning processes outside the sandbox. Mods install from any plugin marketplace, the org control is allowManagedModsOnly, and the community catalog lists 45 mods.

elevatedAI Security Claude Code

Claude Code Mods Are On by Default, and They Run Unsandboxed With Your Permissions

Claude Code 2.1.287 turns on mods by default: unsandboxed plugins that can read secrets and approve tool calls before you are asked. How to lock them down.

Oct 2 · 8 min

Data graphic: timeline of WSO2 CVE-2026-5430. WSO2's advisory and fix on May 3, the CVE record on Aug 6 95 days later , the first forged admin token in a watchTowr honeypot on Sep 13 133 days after the fix , and CISA KEV on Sep 24.

criticalExploits Cve 2026 5430

WSO2 API Manager JWT Bypass Exploited 133 Days After the Fix

Forged admin tokens for WSO2 API Manager flaw CVE-2026-5430 (CVSS 10.0) hit honeypots 133 days after the fix. CISA's KEV entry describes the wrong bug.

Oct 2 · 5 min

Data graphic: Mythos breaks HFS sessions. A huge 12 marks the leaked Math.random values from an unauthenticated login; CVSS 9.8 critical, fixed in 3.2.1 3.0.0–3.2.0 affected , no authentication required.

highAI Security Cve 2026 61500

Mythos Cracked Rejetto HFS Sessions From 12 Leaked Math.random() Values

Horizon3 used Anthropic's Mythos to find CVE-2026-61500: Rejetto HFS 3.x leaks Math.random() values that let attackers forge admin cookies. Fixed in 3.2.1.

Oct 2 · 6 min

Data graphic: a CVSS severity scale showing CVE-2026-94127 for F5 BIG-IP APM rated 9.8 critical.

criticalExploits Cve 2026 94127

F5 BIG-IP APM: An Oversized Bearer Token Is Enough for Unauthenticated RCE

An unauthenticated attacker can run code on F5 BIG-IP APM with one oversized Bearer token — but only when APM is configured as an OAuth Authorization Server.

Oct 2 · 6 min