https://threatfrontier.com/articles/windows-cross-device-cve-2026-66804-system-privilege-escalation ThreatFrontier.com en 2026-10-02T19:31:20.872Z Windows Cross Device flaw gives local users SYSTEM, with a public PoC https://threatfrontier.com/articles/storm-3168-azure-service-principal-github-issue-7-minute-wipe ThreatFrontier.com en 2026-10-02T19:29:13.494Z Storm-3168: A Secret Left in a GitHub Issue Led to a 7-Minute Azure Deletion Run https://threatfrontier.com/articles/vllm-nixl-mooncake-kv-connector-dos-cve-2026-94622 ThreatFrontier.com en 2026-10-02T19:28:35.735Z vLLM NIXL and Mooncake Flaws Let One Request Kill Decode Engines, With No Fixed Release Named https://threatfrontier.com/articles/open-webui-0-11-4-19-advisories-session-token-theft ThreatFrontier.com en 2026-10-02T19:28:33.493Z Open WebUI 0.11.4 Patches 19 Advisories, Including Session Token Theft https://threatfrontier.com/articles/arista-velocloud-orchestrator-cve-2026-93952-exploited-no-fix-for-6-1-and-7-0 ThreatFrontier.com en 2026-10-02T19:28:31.095Z Arista VeloCloud Orchestrator Exploited at CVSS 10.0, With No Fix Listed for Two Release Trains https://threatfrontier.com/articles/claude-desktop-cowork-macos-command-execution-ghsa-v234-4jrq-mgg6 ThreatFrontier.com en 2026-10-02T19:27:46.911Z Claude Desktop Cowork Folder Flaw Let a File Run Commands on macOS https://threatfrontier.com/articles/adobe-commerce-magento-cve-2026-71362-kev-authorization-flaw ThreatFrontier.com en 2026-10-02T19:27:44.564Z Adobe Commerce and Magento Authorization Flaw CVE-2026-71362 Now Exploited https://threatfrontier.com/articles/litellm-salt-key-ghsa-7hp6-4w63-5g45-proxy-admin-rce ThreatFrontier.com en 2026-10-02T19:27:41.317Z LiteLLM Salt-Key Flaw Lets Any Internal User Forge a Proxy Admin Token and Run Commands https://threatfrontier.com/articles/oracle-peoplesoft-cve-2026-35273-shinyhunters-waf-bypass-exploited ThreatFrontier.com en 2026-10-02T19:27:39.028Z ShinyHunters Exploits Oracle PeopleSoft CVE-2026-35273 via WAF Bypass https://threatfrontier.com/articles/gemini-3-8-flash-tts-pricing-doubles-january-2027 ThreatFrontier.com en 2026-10-02T19:27:31.798Z Gemini 3.8 TTS Pricing Doubles on Jan 1, 2027: What Voice-App Builders Should Budget https://threatfrontier.com/articles/coding-agents-tamper-with-own-traces-audit-logs ThreatFrontier.com en 2026-10-02T19:27:11.665Z Coding Agents Can Erase Their Own Audit Trails, and Auto-Mode Monitors Often Miss It https://threatfrontier.com/articles/zyxel-gs1900-cve-2026-7273-kev-switch-exploitation ThreatFrontier.com en 2026-10-02T19:25:44.708Z Zyxel GS1900 switch overflow exploited on 996 devices, now in CISA KEV https://threatfrontier.com/articles/microsoft-sharepoint-cve-2026-65660-cisa-kev-rescored-rce ThreatFrontier.com en 2026-10-02T19:25:41.975Z Microsoft SharePoint CVE-2026-65660 Added to CISA KEV After Rescore to RCE https://threatfrontier.com/articles/cloudflare-clef-decision-models-ollama-systemone ThreatFrontier.com en 2026-10-02T19:25:38.757Z Cloudflare Open-Sources Clef Decision Models as Ollama Adds a Decision-Model API https://threatfrontier.com/articles/agentxploit-autonomous-red-teaming-ai-agent-frameworks ThreatFrontier.com en 2026-10-02T19:25:37.110Z AgentXploit Rediscovers Known Agent-Framework Flaws 59% of the Time, Beating Codex at 38% https://threatfrontier.com/articles/salesbleed-salesforce-agentforce-zero-click-dns-exfiltration ThreatFrontier.com en 2026-10-02T19:25:35.236Z SalesBleed: A Public Web Form Let Attackers Pull Agentforce CRM Data Out Over DNS https://threatfrontier.com/articles/vllm-0-30-upgrade-notes-fast-start-hisparse-breaking-changes ThreatFrontier.com en 2026-10-02T19:25:00.126Z vLLM v0.30.0 Upgrade Notes: Fast Start, HiSparse, New Models and the Breaking Changes https://threatfrontier.com/articles/anthropic-glm-5-3-open-weight-exploit-development-safeguards ThreatFrontier.com en 2026-10-02T19:22:31.811Z Anthropic: Open-Weight GLM-5.3 Nearly Matches Mythos Preview at Writing Exploits https://threatfrontier.com/articles/california-sb-1000-ai-transparency-act-no-robo-bosses-sb-947 ThreatFrontier.com en 2026-10-02T19:22:29.628Z California Drops the 1M-User Threshold From Its AI Transparency Act and Signs No Robo Bosses https://threatfrontier.com/articles/minimax-m3-1-flash-preview-1m-context-coding-model ThreatFrontier.com en 2026-10-02T17:04:56.671Z MiniMax M3.1 Flash: 1M-Context Coding Model That Always Thinks https://threatfrontier.com/articles/claude-code-mods-unsandboxed-plugins-on-by-default ThreatFrontier.com en 2026-10-02T16:37:51.617Z Claude Code Mods Are On by Default, and They Run Unsandboxed With Your Permissions https://threatfrontier.com/articles/wso2-api-manager-cve-2026-5430-jwt-bypass-exploited ThreatFrontier.com en 2026-10-02T12:06:11.824Z WSO2 API Manager JWT Bypass Exploited 133 Days After the Fix https://threatfrontier.com/articles/mythos-rejetto-hfs-cve-2026-61500-math-random-admin-cookie ThreatFrontier.com en 2026-10-02T12:06:09.858Z Mythos Cracked Rejetto HFS Sessions From 12 Leaked Math.random() Values https://threatfrontier.com/articles/f5-big-ip-apm-cve-2026-94127-unauthenticated-rce ThreatFrontier.com en 2026-10-02T12:06:07.265Z F5 BIG-IP APM: An Oversized Bearer Token Is Enough for Unauthenticated RCE https://threatfrontier.com/articles/apple-coregraphics-zero-day-cve-2026-86950 ThreatFrontier.com en 2026-10-02T12:06:02.570Z Apple Patches CoreGraphics Zero-Day Used Against Targeted iPhone Users https://threatfrontier.com/articles/ollama-agent-mode-cve-2026-102697-approval-bypass ThreatFrontier.com en 2026-10-02T12:06:00.441Z Ollama's Agent Mode Approved Bash Commands by Prefix, So Prompt Injection Could Chain Its Own (CVE-2026-102697) https://threatfrontier.com/articles/wordpress-core-cve-2026-87902-path-traversal-rce-exploited ThreatFrontier.com en 2026-10-02T12:05:58.661Z WordPress Core Flaw CVE-2026-87902 Drew Exploit Attempts on Patch Day https://threatfrontier.com/articles/check-point-cve-2026-93616-cve-2026-85102-exploited ThreatFrontier.com en 2026-10-02T12:05:56.909Z Check Point Management Servers Were a Zero-Day for Two Months Before the Fix https://threatfrontier.com/articles/mcp-atlassian-cve-2026-77244-unauthenticated-operator-access ThreatFrontier.com en 2026-10-02T12:05:55.155Z MCP Atlassian Server Let Anyone on the Network Act as the Operator in Jira and Confluence https://threatfrontier.com/articles/cisco-sd-wan-manager-cve-2026-76504-hex-encoding-auth-bypass ThreatFrontier.com en 2026-10-02T12:05:52.832Z Cisco SD-WAN Manager Zero-Day CVE-2026-76504: One Encoded Character Unlocks the Admin API https://threatfrontier.com/articles/fortimail-cve-2026-104286-exploited-no-patch ThreatFrontier.com en 2026-10-02T12:05:50.188Z Exploited FortiMail Flaw Has No Patch Yet: Disable IBE Now https://threatfrontier.com/articles/citrix-netscaler-zero-days-cve-2026-88771-cve-2026-88772 ThreatFrontier.com en 2026-10-02T12:05:45.080Z Citrix NetScaler Zero-Days Planted Webshells Weeks Before the Patch https://threatfrontier.com/articles/memtensor-openclaw-plugin-memoryos-sckit-worm ThreatFrontier.com en 2026-10-02T12:05:42.195Z MemTensor's OpenClaw Plugin and MemoryOS Shipped the sckit Credential Worm https://threatfrontier.com/articles/stolen-chatgpt-logins-358-of-482-companies-socradar ThreatFrontier.com en 2026-10-02T12:05:39.887Z Stolen ChatGPT Logins Turned Up at 358 of 482 Big Companies https://threatfrontier.com/articles/xing4-0-29b-a4b-china-telecom-swe-bench-coding-model ThreatFrontier.com en 2026-10-02T12:05:36.258Z Xing4.0-29B-A4B: China Telecom's Open Coding Model Claims SWE-bench 75 on One GPU https://threatfrontier.com/articles/github-copilot-retires-six-models-october-19 ThreatFrontier.com en 2026-10-02T12:05:33.050Z GitHub Copilot Drops Six Models on Oct 19: What Replaces GPT-5.5, GPT-5.4 and Grok 4.5 https://threatfrontier.com/articles/openai-moonshot-encrypted-reasoning-replay-distillation ThreatFrontier.com en 2026-10-02T12:05:30.800Z OpenAI Says Moonshot-Linked Accounts Replayed Encrypted Reasoning to Distill Its Models https://threatfrontier.com/articles/carbonato-botnet-docker-hermes-agent-ai-api-keys ThreatFrontier.com en 2026-10-02T12:05:29.029Z CARBONATO Botnet Turns Exposed Docker Hosts Into Hermes Agent Bots That Hunt AI Keys https://threatfrontier.com/articles/pixelleak-ai-coding-agents-leaked-13000-screenshots-to-public-github ThreatFrontier.com en 2026-10-02T12:05:27.280Z PixelLeak: AI Coding Agents Pushed 13,000 Internal Screenshots to Public GitHub Repos https://threatfrontier.com/articles/openai-pauses-tool-use-after-training-agent-escaped-through-dns ThreatFrontier.com en 2026-10-02T12:05:25.441Z OpenAI Pauses Tool Use on Its Most Capable Models After a Training Agent Escaped Through DNS https://threatfrontier.com/articles/plugin4shell-pinned-sha-bypass-claude-code-codex-copilot-gemini-cli ThreatFrontier.com en 2026-10-02T12:05:23.446Z Plugin4Shell: A Pinned Commit SHA Didn't Stop Repo Owners Swapping Plugin Code in Claude Code, Codex, Copilot and Gemini CLI https://threatfrontier.com/articles/claude-sonnet-4-5-retirement-sonnet-5-5-migration ThreatFrontier.com en 2026-10-02T12:05:20.490Z Claude Sonnet 4.5 Retires Nov 30: Six Requests That Return a 400 on Sonnet 5.5 https://threatfrontier.com/articles/mcp-python-sdk-oauth-credential-theft-issuer-fix ThreatFrontier.com en 2026-10-02T11:33:51.820Z Official MCP Python SDK Let Malicious Servers Steal OAuth Secrets, and Upgrading Isn't Enough https://threatfrontier.com/articles/ai-agent-breaches-divd-zammad-zero-days ThreatFrontier.com en 2026-10-02T11:33:33.999Z AI Agent Breached Bug-Hunting Nonprofit DIVD by Chaining Two Zammad Zero-Days https://threatfrontier.com/articles/tensorfold-local-llm-server-unauthenticated-api ThreatFrontier.com en 2026-10-01T18:56:36.421Z TensorFold Speeds Up Local LLMs but Leaves Its API Unauthenticated https://threatfrontier.com/articles/gemini-4-argon-vs-gpt-6-astra-vs-claude-opus-5-5 ThreatFrontier.com en 2026-10-01T06:02:39.034Z Gemini 4 Argon vs GPT-6 Astra vs Claude Opus 5.5: Is Google's New Model Actually Better?