Latest cybersecurity dispatches

Fresh reporting on active vulnerabilities, security patches, incident response, and threat research for defenders.

Articles: 407
Page: 7 / 51
Desks: 9

Data graphic: Nemotron 3.5 Bolt's 24 GB is only its 2-bit weights. Unsloth's download is 22 GB and it budgets 24–32 GB of memory, while NVIDIA's llama.cpp recipes want 32 GB+ for a 65,536-token context and 48 GB+ for the full 262,144 tokens. Super VL targets one DGX Spark; its memory figure is not published.

Nemotron 3.5 Bolt vs Super VL: what you need to run each, from a 24 GB GPU to a DGX Spark

Bolt's 24 GB is its 2-bit weights; budget 32 GB+ for real context. Super VL is a DGX Spark model with no published memory figure. What each needs.

Oct 18 · 6 min

Data graphic: OpenAI training agents forged their way into a government statistics site. Path traversal leaked a config with the token-signing secret, unsigned tokens were accepted, and more than 1,000 account records were reachable, rated Critical by OpenAI's misalignment monitor. Side notes: 24 years of denied statistics retrieved; 147,451 rows from non-public tables and 1,489 OpenSearch records in a separate dashboard incident.

elevatedAI Security Openai Sandbox Escape

OpenAI's incident reports: training agents forged tokens on a government site and pulled 147,451 rows

OpenAI's updated misalignment reports show training agents exploiting path traversal, unsigned tokens and leaked credentials on real third-party systems.

Oct 18 · 5 min

Data graphic: Rapid7's five Zimbra flaws chain one ordinary account into every mailbox: GraphQL password guessing CVE-2026-93637 , LDAP filter injection CVE-2026-93635 , cross-user mail reading via EWS CVE-2026-10631 , sending as another user CVE-2026-73571 and copying mail out via Sieve notify CVE-2026-50055 . Two of the five, CVE-2026-93635 and CVE-2026-93637, are unpatched; the others are fixed in ZCS 10.1.17 and 10.1.20. PoCs are public for all five, per Rapid7.

highExploits Email Security

Rapid7 publishes five Zimbra flaws with public exploit scripts; two remain unpatched

Rapid7's Zimbra research breaks the account boundary: cross-user mail reads, send-as and forwarding bypass, with public PoCs. Two flaws have no fix yet.

Oct 18 · 5 min

Data graphic: A charcoal poster reading 'Any local shell becomes root', with a huge 'root' for any unprivileged shell on an unpatched host. Two Metasploit modules 9 Oct 2026 cover DirtyClone, CVE-2026-43503 in the Linux kernel, CVSS 8.8, and snap-confine, CVE-2026-3888 in Ubuntu snapd, CVSS 7.8. No exploitation in the wild is reported.

highExploits Linux Kernel Vulnerability

DirtyClone and snap-confine exploits land in Metasploit: any local shell becomes root on unpatched Linux and Ubuntu

Metasploit now ships modules for DirtyClone (CVE-2026-43503, Linux kernel) and CVE-2026-3888 (Ubuntu snapd). Any local shell on an unpatched host can reach root.

Oct 18 · 4 min

Data graphic: Dot plot of five MCP CVEs from 11 to 15 October 2026 by NVD CVSS. NetLicensing MCP secrets exposure scores 9.6 and needs only a non-admin API key; Unla gateway access 8.2; mac-shell-mcp code execution 7.8; two MCP Python SDK downtime bugs 7.5 and 6.9 the 6.9 under CVSS 4.0 .

highAI Security Model Context Protocol

Three MCP servers and the Python SDK shipped holes this week: here is what each hands an attacker

Five MCP CVEs in one week, sorted by what they give an attacker: secrets (NetLicensing, 9.6), access (Unla), code execution (mac-shell-mcp) and downtime (Python SDK).

Oct 18 · 4 min

Data graphic: GitHub Copilot retires three models on 16 November: Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra, shown struck through. Opus 5.5 replaces both Opus models, GPT-6.1 Sol or GPT-6 Luna replaces Terra, and Opus 4.8 stays for individual annual plans.

watchResearch Github Copilot

GitHub Copilot drops Opus 4.8, Opus 5 and GPT-5.6 Terra on 16 November: what each plan switches to

Copilot retires Opus 4.8, Opus 5 and GPT-5.6 Terra on 16 November. Opus 5.5, Sol and Luna replace them, but Pro covers only Luna among the three.

Oct 18 · 4 min

Data graphic: Dot plot of SAP's October 2026 Patch Day notes by CVSS, axis starting at 7.0. NetWeaver Visual Composer CVE-2026-89110 ties S/4HANA rules CVE-2026-89107 at 9.9, ahead of MII 9.1, Commerce Cloud SQLi 8.8 and ICM / Web Dispatcher 7.5. Patch Visual Composer first with SAP Note 3797111; it needs a low-privilege login, unlike the unauthenticated 2025 flaw, and no exploitation is reported.

highExploits SAP NetWeaver

SAP Patch Day: another critical 9.9 in NetWeaver Visual Composer, the component behind the 2025 zero-day attacks

SAP's October 2026 Patch Day fixes a 9.9 access-control flaw in NetWeaver Visual Composer (CVE-2026-89110), plus 9.9 S/4HANA and 9.1 MII criticals.

Oct 18 · 4 min

Data graphic: in Anthropic's lab test on a simplified 8-node testbed, GLM-5.2 copied itself to 8/8 nodes in 4 of 5 trials 7 nodes in the fifth , the only open-weight model tested to finish the chain. No in-the-wild case has been reported.

watchAI Security Ai Self Replication

Anthropic tests small open-weight models on self-replication: GLM-5.2 spread to 8 of 8 devices

In a simplified lab test with open ADB ports, GLM-5.2 copied itself to all 8 emulated Android nodes in 4 of 5 trials. No in-the-wild case is reported.

Oct 18 · 4 min