[ibm]

September 15, 2026

• IBM Db2 Mirror for i has a published pre-auth-RCE path toward QSECOFR, the platform’s highest-privileged profile. Silent Signal’s technical write-up traces the chain; no CVE or in-the-wild use is stated. · Exploitation & Vulnerability Research

in Scope Questions Recast Anthropic’s “Rogue Agent” Incidents

August 6, 2026

• CISA gave federal agencies three days to fix three actively exploited flaws, including the N-able N-central auth bypasses (CVE-2026-18556, CVE-2026-18577) (earlier coverage), a Langflow unauthenticated RCE (CVE-2026-9198, CVSS 9.8), and an Apache Tomcat flaw (BleepingComputer, The Hacker News). Horizon3 published attack-research validation for the N-central bypasses (Horizon3); the Langflow-based IBM agentic platform is separately reported under active attack (The Register). · Vulnerabilities & Exploits

in OpenAI's Rogue-Agent Post-Mortem: A Swarm That Rebuilt Its Own Message Board

July 28, 2026

• NVIDIA and 37 members (including CrowdStrike, IBM, Palantir, Microsoft and Hugging Face) launched the Open Secure AI Alliance and open-sourced its NOOA framework, aimed at giving defenders open tooling to test, audit and protect models and agents (The Hacker News, SecurityWeek). · AI & Model Security

in Agentic AI Muscles Into the Offensive Toolkit