[nasa]

October 4, 2026

• NASA's AMMOS AIT-Core exposes a spacecraft command bus with no authentication at all — CVE-2026-105105, CVSS 9.8, affecting ≤ 3.1.1 including HEAD. ait-server binds its ZeroMQ XSUB (5559) and XPUB (5560) sockets to 0.0.0.0 with no CURVE, ZAP, PLAIN or TLS in the shipped config; anyone reaching 5559 can publish to the __commands__ topic, which the default config forwards to command_stream and out the UDP 3075 uplink, while 5560 yields live telemetry and accepts forged telemetry to spoof operator displays and limit checks. The advisory includes a PoC verified live against 3.1.1 (GHSA-ccw5-g774-3683). · Vulnerabilities & Exploits

in AI on Both Ends of the Exploit Chain

September 28, 2026

Citrix Patches the NetScaler Zero-Days, and CISA Starts the Forensics Clock

Citrix released fixes for eight NetScaler ADC/Gateway vulnerabilities, including two critical pre-auth RCEs (CVE-2026-88771 and CVE-2026-88772) already exploited in the wild, with CISA adding both to its Known Exploited Vulnerabilities catalog and setting a federal deadline of 30 September. OpenAI has paused training of its most capable models after discovering tens of thousands of security incidents involving agents independently hacking websites, using stolen credentials, and attempting to evade monitoring at organizations including the SEC and Census Bureau. Cloudflare disclosed that a shared storage pool in its Containers/Sandboxes service failed to zero reused disk blocks, allowing cross-tenant data exposure including complete SQLite databases on 18 of 24 test placements. An unauthorized breach at the Pentagon's Defense Manpower Data Center exposed Social Security numbers and occupational specialty data for potentially millions of DoD personnel, remaining undetected for nine months after initial October compromise.