September 30, 2026
- Unauthenticated-to-RCE chain in OpenBao and HashiCorp Vault, built by ControlPlane from three independent reporters' disclosures via certificate auth, URI SANs and ACME. This is only the second-ever RCE in Vault/OpenBao. OpenBao v2.6.3 / 2.7.0 are patched; IBM's HashiCorp Vault is not yet, which ControlPlane frames as a case study in what happens when forks stop coordinating on critical fixes (ControlPlane).
· Vulnerabilities & Exploits
- OperTraitor — Unit 42's open-source, LLM-backed engine that ingests RBAC from locally installed Kubernetes operators and the OperatorHub catalog, diffs documented functionality against granted privileges and produces a normalized risk score for downscoping service accounts. It surfaced CVE-2026-6389 (CVSS 8.8) in IBM's Turbonomic and flagged abandoned, wildcard-permissioned operators in default registries (Unit 42).
· New Tools & Releases
in Mandiant Names the NetScaler Post-Exploitation Kit as Patch Rates Stay Under 10%
September 19, 2026
- Two unauthenticated CVSS 9.8 file read/write bugs in Synology DSM — CVE-2026-13684 (improper encoding/escaping in SCGI) and CVE-2026-13639 (insufficient entropy in login logic) — affect DSM 7.4, 7.3, 7.2.2 and 7.2.1 with no workarounds listed (Synology-SA-26:13). IBM separately patched a cluster of criticals in Guardium Data Protection 12.2, including CVE-2026-82340, an unauthenticated deserialization and reflective method dispatch in the Change Audit System listener reachable on TCP/16017 (IBM).
· Vulnerabilities & Active Exploitation
in From a Help Forum to OpenAI's Monorepo in 72 Hours
September 15, 2026
in Scope Questions Recast Anthropic’s “Rogue Agent” Incidents
August 6, 2026
- CISA gave federal agencies three days to fix three actively exploited flaws, including the N-able N-central auth bypasses (CVE-2026-18556, CVE-2026-18577) (earlier coverage), a Langflow unauthenticated RCE (CVE-2026-9198, CVSS 9.8), and an Apache Tomcat flaw (BleepingComputer, The Hacker News). Horizon3 published attack-research validation for the N-central bypasses (Horizon3); the Langflow-based IBM agentic platform is separately reported under active attack (The Register).
· Vulnerabilities & Exploits
in OpenAI's Rogue-Agent Post-Mortem: A Swarm That Rebuilt Its Own Message Board
July 28, 2026
- NVIDIA and 37 members (including CrowdStrike, IBM, Palantir, Microsoft and Hugging Face) launched the Open Secure AI Alliance and open-sourced its NOOA framework, aimed at giving defenders open tooling to test, audit and protect models and agents (The Hacker News, SecurityWeek).
· AI & Model Security
in Agentic AI Muscles Into the Offensive Toolkit