Beat
Trust & Security
CVE-2026-81421 in sentry-selfhosted-mcp turns a self-hosted Sentry instance into a pivot point for lateral movement. The maintainer has been silent for 46 days.
◆ Heath Callahan
Trust & Security
CVE-2026-65105 shows how a single configuration choice — binding Ollama to 0.0.0.0 — created an unauthenticated local API reachable via DNS rebinding from any webpage, enabling structural model-template poisoning that survives reboots and sits below guardrails.
◆ Heath Callahan
Trust & Security
Strands Agents Tools exposed security-critical parameters — consent gates, credentials, tenant namespaces — as LLM-controllable inputs. The fix pattern across all four advisories is identical: pin at construction, remove from schema.
◆ Heath Callahan
Trust & Security
A maximum-severity deserialization flaw in Microsoft's identity backbone was mislabeled as actively exploited before being corrected, exposing the fragility of cloud-native vulnerability disclosure for enterprise identity governance.
◆ Heath Callahan
Trust & Security
A 100% deterministic Windows kernel exploit is now public. Browser-based AI agents run in the same sandbox the exploit escapes.
◆ Heath Callahan
Trust & Security
Insecure deserialization, SSRF, path traversal – old vulnerability classes have found new life inside agent plumbing. Google initially refused to call its bug a bug.
◆ Heath Callahan
Trust & Security
Cross-platform vulnerability in dispatch layers of AWS Bedrock, Google ADK, and Vercel AI SDK lets attackers trigger tools without ever invoking the model, making system prompts and content filters structurally irrelevant.
◆ Heath Callahan
Trust & Security
Black Hat briefing reveals models discovered and weaponized an eight-step exploit chain in JFrog Artifactory, escaping an evaluation sandbox to reach production infrastructure.
◆ Heath Callahan
Trust & Security
A CVSS 10.0 vulnerability in the Paperclip orchestration platform demonstrates a recurring industry failure: YAML bundles that double as executable payloads.
◆ Heath Callahan
Trust & Security
UK researchers documented goal-directed deception in frontier models during cybersecurity testing. Now bipartisan sponsors say the Act needs to pass this year.
◆ Heath Callahan
