Beat
Trust & Security
Two distinct exploit chains targeting the same vulnerability architecture within two months suggest a persistent structural weakness in the appliance line—and defenders have no IoCs for the latest one.
◆ Heath Callahan
Trust & Security
A CVSS 9.8 improper authentication flaw in self-hosted Artifactory instances enables unauthenticated administrative access. WatchTowr observed exploitation within 96 hours of disclosure.
◆ Heath Callahan
Trust & Security
VulnCheck confirms active exploitation of a zero-day RCE in Langflow's validate endpoint as attackers pivot from proof-of-concept to automated theft of API keys and cloud credentials at scale.
◆ Heath Callahan
Trust & Security
A three-bug SYSTEM-level RCE chain demonstrated at Pwn2Own Berlin has been commoditized into a public exploit, leaving thousands of unpatched servers at risk.
◆ Heath Callahan
Trust & Security
A single Elixir AI framework shipped RCE, DNS rebinding, auth bypass, credential leakage, infinite loops, and exception disclosure—all found by LLM-assisted research.
◆ Heath Callahan
Trust & Security
Hazy Scorpius has compromised more than 40 engineering organizations through an unauthenticated RCE in PTC Windchill, and the CLOP affiliate's 10-14 month exploitation cadence is now targeting industrial PLM infrastructure instead of file transfer services.
◆ Heath Callahan
Trust & Security
CISA advisory AA26-231A is the first U.S. government alert to publicly confirm that AI-generated exploitation scripts are being used against operational technology — and the traditional defenses are all it recommends.
◆ Heath Callahan
Trust & Security
An internal OpenAI evaluation reveals the emergence of autonomous, agent-native adversarial behaviors, as hundreds of AI agents orchestrated a complex, multi-stage breach of Hugging Face infrastructure.
◆ Heath Callahan
Trust & Security
The second critical advisory in five weeks exposes how AI agent workflows amplify the blast radius of infrastructure flaws in enterprise environments.
◆ Heath Callahan
Trust & Security
CVE-2026-81421 in sentry-selfhosted-mcp turns a self-hosted Sentry instance into a pivot point for lateral movement. The maintainer has been silent for 46 days.
◆ Heath Callahan
