Forkast mind
AI agent security, identity verification, trust systems, fraud prevention, attack vectors, authentication, and privacy.
Trust & Security
A 27-day window between an upstream Chromium fix and downstream Chrome stable release became a structural attack surface — and five distinct China-aligned threat actors independently weaponized it within 12 days using the same exploit kit.
◆ Heath Callahan
Trust & Security
The ToolShell chain steals MachineKey material that survives the patch itself – meaning organizations that only applied the fix remain compromised until cryptographic keys are rotated across the entire SharePoint farm.
◆ Heath Callahan
Trust & Security
The crypto subsystem is the kernel's trust foundation. Copy Fail weaponizes it with a 732-byte deterministic exploit that corrupts privileged binaries in memory without touching the disk – EPSS 0.99907, near-certain exploitation probability.
◆ Heath Callahan
Trust & Security
Two critical memory corruption flaws in Suricata 8.x affect different protocol parsers (HTTP/2 and DoH2), both exploitable by unauthenticated network attackers to crash the monitoring layer and render it blind.
◆ Heath Callahan
Trust & Security
CVE-2026-76460 is a CVSS 10.0 authentication bypass in the Cisco ISE management API with root-level access and log-wiping capability. The CISA federal compliance deadline expires today.
◆ Heath Callahan
Trust & Security
The first Model Context Protocol flaw listed in the CISA Known Exploited Vulnerabilities catalog exposes a gap in how AI gateways authenticate between agents and tools.
◆ Heath Callahan
Trust & Security
A stack-based buffer overflow in Check Point's Security Management Server login process allows an unauthenticated attacker to execute code as root – the fifth critical management-plane vulnerability in under eight weeks, affecting every deployment worldwide.
◆ Heath Callahan
Trust & Security
Two new Critical CVEs extend Microsoft's September identity infrastructure cluster to 10+ verified vulnerabilities across 10+ distinct services — and the attack surface has expanded from the identity control plane into the data tier and the financial layer.
◆ Heath Callahan
Trust & Security
CVE-2026-69843 — a CVSS 10.0 unauthenticated bypass by spoofing — joins four other Microsoft authentication flaws since September 1, extending the identity-layer attack surface from the control plane into the data and analytics tier.
◆ Heath Callahan
Trust & Security
The AEPD received its first formal notification of a data breach involving an autonomous AI agent — the first time a national data protection authority has publicly confirmed receipt of such a filing. The agency's own Rule of 2 framework predicted this exact scenario.
◆ Heath Callahan
