Latest cybersecurity dispatches

Fresh reporting on active vulnerabilities, security patches, incident response, and threat research for defenders.

Articles: 407
Page: 6 / 51
Desks: 9

Data graphic: DHS FASCSA Order #2026-01 path from DeepSeek and products built on it to exclusion from civilian procurement and removal from civilian agency IT.

DHS Orders DeepSeek, and Anything Built on It, Out of Federal Civilian IT

A DHS FASCSA order bars DeepSeek, and third-party products built on DeepSeek models, from federal civilian IT, effective immediately. Vendors should map their models.

Oct 21 · 4 min

Data graphic: llama-server request path from an audio client through the /v1/realtime websocket to Voxtral Mini 4B Realtime and transcript deltas, with a separate POST /tts call returning WAV audio.

watchResearch Llama Cpp

llama.cpp Gains a Realtime Transcription Websocket and a /tts Endpoint

llama-server now speaks OpenAI-style realtime transcription and text-to-speech. Here is how to run it with Voxtral Mini 4B, and what isn't ready yet.

Oct 21 · 3 min

Data graphic: a huge 10.0 for the five unauthenticated maximum-score flaws in Oracle's October 2026 CPU, among 1,295 patches, with 9.8s in WebLogic and APEX.

highExploits Oracle Weblogic

Oracle's October CPU: Patch SOA Suite, Access Manager and EBS Mailer First

Oracle's October 2026 patch update fixes 1,295 flaws. Five unauthenticated CVSS 10.0s in SOA Suite, Access Manager and EBS set the first-week order.

Oct 21 · 3 min

Data graphic: dot plot of the five CVSS 3.1 scores for MCP TypeScript SDK CVE-2026-111767 to -111771, from 8.6 down to 6.5, with the two fixes that also need a config change marked.

highAI Security Mcp Typescript Sdk

Five MCP TypeScript SDK Flaws Let Clients Read Each Other's Messages and Tasks, and Two Fixes Need Config Changes

Five new CVEs in the official MCP TypeScript SDK leak messages across clients and expose tasks. Upgrade to 1.32.0 or 2.3.0, then change two settings.

Oct 21 · 5 min

Data graphic: SGLang CVE-2026-93034, CVSS 3.1 9.8 Critical; the setting SGLANG_USE_PICKLE_IPC=false is struck through because it does not stop the RCE, and no fixed version is confirmed.

highAI Security Cve 2026 93034

SGLang CVE-2026-93034: Turning Off Pickle IPC Does Not Stop Remote Code Execution

SGLang's ZMQ decoder still unpickles attacker data with pickle IPC disabled. Multi-node DP-attention clusters are open to unauthenticated RCE; no fix yet.

Oct 21 · 3 min

Data graphic: MoviePilot CVE-2026-77931, CVSS 8.8: a poisoned page or torrent reaches the AI assistant, which calls execute_command with confirm_dangerous=true and gets a shell on the host.

elevatedAI Security Cve 2026 77931

MoviePilot's AI Assistant Can Be Steered Into Running Host Commands (CVE-2026-77931)

A poisoned web page or torrent can make MoviePilot's AI agent run shell commands on the host. Versions through 3.1.5 are affected and no fix is confirmed.

Oct 21 · 3 min