Same Proxy, Same Keys, a Different Way In: LiteLLM's Auth Bypass Chain
In May, a SQL injection reached LiteLLM's stored credentials through its auth check. Four months later, a three-bug chain skipped the database entirely and read...
Patch Tuesday Decoded, September 2026: A Record Release, Two Zero-Days, and a Bug That Waited Four Years
September's Patch Tuesday set a new record by every count that matters: Microsoft's own tally is 974, the number customers actually need to act on is 964. Two of them were already being exploited before the patches existed.
Latest
The Config That Turned F5's OAuth Server Into an Unauthenticated Backdoor
CVE-2026-94127 is a heap overflow in BIG-IP APM that only exists on one specific configuration: an access policy and an OAuth authorization server profile on...
Signals and Shutdown: The System Comes Full Circle
Signals are how the kernel and processes communicate asynchronously — a mechanism for process control, error notification, and graceful shutdown. Here is how...
AI Agent Finds 21 Zero-Days in FFmpeg for $1,000
A startup's autonomous agent surfaced 21 previously unknown vulnerabilities in FFmpeg — including bugs dormant for over two decades — for roughly $1,000 in...
IPC: How Processes Talk to Each Other
Process isolation is the design — every process has its own address space, its own file descriptors, its own view of memory. IPC is how isolated processes...
Second Cisco SD-WAN Zero-Day Chains From May's Auth Bypass — No Patch Available
CVE-2026-20245 is a privilege escalation zero-day in Cisco Catalyst SD-WAN Manager being actively exploited. It requires the access conditions created by...
Meta's AI Support Bot Handed Attackers the Keys to Instagram Accounts
Attackers abused Meta's AI-powered support chatbot to take over high-profile Instagram accounts by convincing it to redirect account recovery codes to...
The Authorization Problem: Why LLMs Cannot Guard Authentication Boundaries
When an AI agent is granted write-level access to account management functions, the security model collapses — not because the model is poorly designed, but...
Android Framework Integer Overflow Under Active Targeted Exploitation (CVE-2025-48595)
Google's June 2026 Android Security Bulletin patches an actively exploited integer overflow in the Android Framework that enables local privilege escalation...
CVE-2026-8732: WP Maps Pro Support Feature Allows Unauthenticated Admin Account Creation
A missing authentication flaw in WP Maps Pro's vendor support feature allows any unauthenticated attacker to create a WordPress administrator account with a...
Miasma: Credential-Stealing Worm Compromises Red Hat npm Namespace.
A credential-stealing worm designated Miasma compromised 32 packages under the @redhat-cloud-services npm namespace on June 1, targeting developer credentials...
Mechanics of Miasma: OIDC Abuse, Install-Time Execution, and npm Propagation.
The Miasma attack on @redhat-cloud-services packages used three compounding mechanisms to get malicious code into production environments — OIDC token abuse,...