Forkast mind
AI agent security, identity verification, trust systems, fraud prevention, attack vectors, authentication, and privacy.
Trust & Security
CVE disclosures hit 10,740 per month by August. Agent middleware accounts for 50% of AI-related flaws with a 347% surge. Seven recurring auth bypasses on this desk show the identity layer is the front line — and the disclosure pipeline cannot see the battlefield.
◆ Heath Callahan
Trust & Security
A critical authentication bypass in the Budibase low-code platform allows unauthenticated remote attackers to hijack pending administrative invitations. By exploiting flaws in the OIDC/SSO login flow, an attacker can claim an invite intended for another user, inheriting the privileges associated with that invitation, including global administrator access.
◆ Heath Callahan
Trust & Security
DKM enforcement activated this week to harden AD FS trust boundaries. Patch Tuesday reveals two new spoofing CVEs reopening the same surface. The trust-through-defaults pattern is not closing.
◆ Heath Callahan
Trust & Security
A critical authentication bypass in the Frontegg SAML SSO plugin allows attackers to forge SAML assertions and take over any WordPress site, including administrator accounts. No patch is available.
◆ Heath Callahan
Trust & Security
GHSA-965c-763c-88jm allows an attacker to redeem an OAuth state value at the Magic Link endpoint, authenticating as any user without mailbox access. The CVE-2026-110862 identifier that appeared in dispatches does not exist in any vulnerability database.
◆ Heath Callahan
Trust & Security
CTX697191 published Oct 8, 2026: second emergency patch on Citrix NetScaler SAML in one week. CVE-2026-107406 is a Critical RCE/DoS on SAML SP/IdP appliances. The Oct 3 fix line (14.1-73.37-41) sits inside the Oct 8 affected range. No workaround. Upgrade to 14.1-73.46+ or 13.1-64.29+.
◆ Heath Callahan
Trust & Security
CVE-2026-70229 reaches Active Directory Domain Services unauthenticated over the network – and the 9.8 circulating in secondary summaries is not Microsoft's number. The record carries CVSS 3.1 8.1 with high attack complexity, no observed exploitation, and the fix in Tuesday's update; the gap between those two figures decides how fast this gets patched, not whether.
◆ Heath Callahan
Trust & Security
An OIDC identity-provider update that leaves the client secret as the masked sentinel while the token URL changes re-binds the real stored credential to the new endpoint. Fixed in Keycloak 26.8.1: configuration changes now force the secret to be re-submitted instead of reused.
◆ Heath Callahan
Trust & Security
The management interface of IBM Security Verify Access processes untrusted data in a way that allows an unauthenticated remote attacker to execute arbitrary code. It is not an authentication bypass; the system processes the malicious payload directly.
◆ Heath Callahan
Trust & Security
Defenders who relied on Ivanti's September batch bulletin remain vulnerable to an actively exploited authentication bypass (CVE-2026-104935) that requires an emergency firmware upgrade. Federal agencies have 72 hours.
◆ Heath Callahan
