Beat
Trust & Security
A CVSS 9.8 vulnerability in the bare-metal lifecycle management tool used by NVIDIA Cloud Partners allows unauthenticated remote access to the control plane of multi-tenant AI clusters.
◆ Heath Callahan
Trust & Security
A CVSS 9.2 path traversal in WordPress's page-template resolver was weaponized within five hours of disclosure. The patch-gap pattern has reached the most-deployed CMS on the web.
◆ Heath Callahan
Trust & Security
The agent's dictation endpoint was open to any local process. Meta says local-only. Wardle says a ClickFix attack makes it remote. And security teams still cannot see what Muse accesses.
◆ Heath Callahan
Trust & Security
CVE-2026-85102, a pre-authentication RCE in Check Point's VPN negotiation flow, was added to CISA's KEV catalog on September 22 with a three-day federal remediation deadline. Active exploitation against Spark customers began September 12.
◆ Heath Callahan
Trust & Security
A pre-authentication path traversal in Check Point's Security Management Server let unauthenticated attackers execute arbitrary scripts on the system that controls every firewall policy, rule, and gateway across the organization. Active exploitation began July 23.
◆ Heath Callahan
Trust & Security
A heap-based buffer overflow in F5 BIG-IP APM lets unauthenticated attackers execute code on the data plane when a virtual server pairs an access policy with an OAuth profile. CISA gave federal agencies three days to patch.
◆ Heath Callahan
Trust & Security
An unpatched 0-day in Meta's Muse macOS app lets any unprivileged process hijack the agent's dictation traffic, steal auth tokens, and pivot to the user's iOS devices. Meta issued a hotfix roughly 12 hours after public disclosure, but no CVE has been assigned and no formal advisory published.
◆ Heath Callahan
Trust & Security
A vendored Samba script's plaintext HTTP for SCEP operations lets MITM attackers inject rogue Root CAs into the system trust store. The fix: two lines of code.
◆ Heath Callahan
Trust & Security
A 27-day window between an upstream Chromium fix and downstream Chrome stable release became a structural attack surface — and five distinct China-aligned threat actors independently weaponized it within 12 days using the same exploit kit.
◆ Heath Callahan
Trust & Security
The crypto subsystem is the kernel's trust foundation. Copy Fail weaponizes it with a 732-byte deterministic exploit that corrupts privileged binaries in memory without touching the disk – EPSS 0.99907, near-certain exploitation probability.
◆ Heath Callahan
