1,167 articles
Threat IntelA high-severity flaw in vLLM EngineCore guided decoding allows crafted JSON Schema requests to trigger non-recoverable state crashes across multi-tenant GPU workers.
KubernetesA critical flaw in Model Context Protocol (MCP) Kubernetes bridge servers allows attackers to inject malicious flags into kubectl tool calls, exposing cluster service tokens.
Palo AltoPalo Alto Networks resolves a critical buffer overflow in PAN-OS XML parsing (CVE-2026-0310) allowing unauthenticated attackers to execute root code.
Deep DiveNew research reveals side-channel and prompt-leakage vectors capable of intercepting hidden chain-of-thought reasoning tokens in frontier reasoning models.
Data BreachUpbound Group disclosures reveal cloud storage exfiltration led to $13 million in fraudulent lease-to-own contracts generated via the Acima platform.
Threat IntelA sophisticated typosquatted Python package targets AI engineering pipelines, masquerading as vLLM inference worker daemons to exfiltrate proprietary model weights.
Deep DiveAn architectural analysis of the Lethal Trifecta in autonomous enterprise AI agents: untrusted input, autonomous execution, and access to privileged external tools.
Deep DiveResearchers demonstrate Morris II style self-replicating adversarial prompt worms propagating autonomously across connected LLM agents and multi-agent workflows.
Threat IntelA critical template injection flaw in Next.js next/og (CVE-2026-94545) allows unauthenticated remote attackers to execute arbitrary code via Satori SVG parsing.
AppleApple resolves a critical out-of-bounds write zero-day in CoreGraphics (CVE-2026-86950) exploited in targeted cyber-espionage attacks against iOS and macOS.
CiscoA critical URL hex-encoding vulnerability in Cisco Catalyst SD-WAN Manager allows unauthenticated remote attackers to bypass authentication and hijack fabrics.
AWS CloudAn architectural research study comparing AWS Firecracker and Google gVisor, analyzing hypervisor boundaries, KVM virtio mechanics, and container breakout vectors.
Deep DiveDeep-dive security research demonstrating how indirect prompt injection exploits Model Context Protocol (MCP) to trigger cascading failures across multi-agent swarms.
Deep DiveAn architectural research study on NIST FIPS 203/204/205 standards, evaluating hybrid TLS 1.3 key exchange to safeguard financial clearing from quantum decryption.
Gov / DefenseA technical compliance guide for Indian enterprises implementing automated SIEM/SOAR playbooks to meet CERT-In and RBI 6-hour mandatory breach disclosure deadlines.
Threat IntelA high-severity path traversal vulnerability in langchain-core allows attackers processing untrusted prompt configurations to read arbitrary host filesystem data.
GoogleGoogle Cloud Security Bulletin GCP-2026-068 details a gVisor sandboxing namespace defect in Cloud Run worker nodes permitting local privilege escalation.
AWS CloudAWS resolves a critical SSRF vulnerability in amazon-ssm-agent where port forwarding denylist bypasses permit link-local IMDS temporary credential exfiltration.
Threat IntelA critical CVSS 9.8 vulnerability in Nginx UI permits unauthenticated attackers to execute arbitrary commands via exposed Model Context Protocol endpoints.
AWS CloudAWS Security Bulletin details an environment leakage defect in Amazon Bedrock Agent action group runtimes permitting cross-session IAM credential exposure.
Data BreachThe operationalization of the Data Protection Board of India (DPBI) brings mandatory breach notifications and statutory penalties up to ₹250 Crore into active enforcement.
AWS CloudAn analysis of recent SEC Form 8-K Item 1.05 material cyber incident filings shows misconfigured cloud buckets and IAM token leaks driving corporate extortion.
MicrosoftMicrosoft MSRC bulletin details an untrusted search path vulnerability in Azure Monitor Agent Metrics Extension allowing low-privileged users to attain SYSTEM privileges.
Threat IntelA critical CVSS 9.8 remote code execution vulnerability in Code Runner Model Context Protocol servers permits arbitrary host code execution via untrusted AI agent tool calls.