Curated intelligence at the intersection of offensive security and AI — the latest items, newest first. See Top Picks for the highest-impact stories.

Sunday, October 25, 2026

HIGHOpenAI AI Agents Demonstrate VM Escapes and Cross-Sandbox Communicationai-security · openai · vm-escape · sandbox-escape

Saturday, October 24, 2026

HIGHBlackX UEFI Bootkit Exploits Baton Drop to Bypass Secure Bootuefi-bootkit · secure-boot · apt41 · espionageCRITICALBrotli Decoder Flaw (CVE-2026-111497) Affects Node.js, Bun, Python, and Morerce · memory-corruption · brotli · supply-chainCRITICALLiteLLM Master Key Leak Leads to Supply Chain Attack and Info-Stealer Distributionsupply-chain · github · credential-theft · ai-agentsHIGHResearchers Remotely Disable Popcorn Time Updater, Preventing Botnet Formationbotnet · rce · popcorn-time · ethical-hacking

Friday, October 23, 2026

CRITICALPHP2Shell Critical RCE Vulnerabilities Under Active Exploitationphp · rce · zero-day · exploitationHIGHAI Agents Used by Ransomware Affiliates for Automated Intrusionsai · ransomware · threat-actor · automationHIGHQuest Diagnostics Confirms Data Breach Exposing Patient Recordsdata-breach · healthcare · patient-data · quest-diagnosticsHIGHHackers Breach Enterprise Firewalls and VPNs, Exposing 70,000+ Credentialsbreach · firewall · vpn · credentialsHIGHCritical Flaw in Python's Pillow Image Library Allows Code Executionpython · rce · image-processing · vulnerability

Thursday, October 22, 2026

HIGHCapcom Confirms Data Breach Affecting 11.7 Million Accountsdata-breach · gaming · capcom · customer-dataCRITICALeMudhra Exits Global SSL/TLS Business After Intermediate CA Key Compromisecertificate-authority · ssltls · cryptographyCRITICALTwo CVSS 9.0 Linux KSMBD RCE Flaws Publicly Disclosed Without Kernel Fixeslinux · rce · ksmbd · zero-dayHIGHRailway Warns Developers to Rotate Secrets After Potential Breachdata-breach · cloud-security · secrets-management · developer-toolsHIGHNew QPACK Flaws Can Crash HTTP/3 Servers and Trigger Memory Amplificationhttp3 · qpack · dos · memory-amplificationHIGHChina-Linked Storm-0940 Uses ARTEX AI Agents in ConnectWise Supply Chain Attackapt · supply-chain · ai-agents · connectwise

Wednesday, October 21, 2026

CRITICALUnauthenticated RCE Affects 35 Million ASUS Routersrouter · rce · asus · vulnerabilityCRITICALCritical GitLab RCE Affects All Versions Since 2014gitlab · rce · vulnerability

Sunday, October 18, 2026

CRITICALConnectWise Cloud Backup Compromised, Leading to Microsoft 365 Tenant Breachessupply-chain · breach · microsoft-365 · msp

Saturday, October 17, 2026

CRITICALDrupal Patches Critical RCE Flaws, Exploits Expecteddrupal · rce · vulnerability · cms

Friday, October 16, 2026

CRITICALBeyondTrust Remote Support Zero-Day Exploited by China-Linked Groupzero-day · beyondtrust · apt · exploitationCRITICALCritical BlockStrap RCE Flaw in Magento and Adobe Commercemagento · adobe-commerce · rce · vulnerabilityCRITICALCandiru Spyware Delivered via Zero-Click Targeted Adsspyware · zero-click · candiru · ad-techCRITICALAOMEI Backupper Update Servers Tampered to Deliver Backdoorsupply-chain · malware · backdoor · aomeiHIGHOpenAI Research Model Spent Third-Party Test ETH Without Permissionai-security · openai · ai-ethics · unintended-behavior