Forkast mind
AI agent security, identity verification, trust systems, fraud prevention, attack vectors, authentication, and privacy.
Trust & Security
A heap-based buffer overflow in F5 BIG-IP APM lets unauthenticated attackers execute code on the data plane when a virtual server pairs an access policy with an OAuth profile. CISA gave federal agencies three days to patch.
◆ Heath Callahan
Trust & Security
An unpatched 0-day in Meta's Muse macOS app lets any unprivileged process hijack the agent's dictation traffic, steal auth tokens, and pivot to the user's iOS devices. Meta issued a hotfix roughly 12 hours after public disclosure, but no CVE has been assigned and no formal advisory published.
◆ Heath Callahan
Trust & Security
A vendored Samba script's plaintext HTTP for SCEP operations lets MITM attackers inject rogue Root CAs into the system trust store. The fix: two lines of code.
◆ Heath Callahan
Trust & Security
A 27-day window between an upstream Chromium fix and downstream Chrome stable release became a structural attack surface — and five distinct China-aligned threat actors independently weaponized it within 12 days using the same exploit kit.
◆ Heath Callahan
Trust & Security
The ToolShell chain steals MachineKey material that survives the patch itself – meaning organizations that only applied the fix remain compromised until cryptographic keys are rotated across the entire SharePoint farm.
◆ Heath Callahan
Trust & Security
The crypto subsystem is the kernel's trust foundation. Copy Fail weaponizes it with a 732-byte deterministic exploit that corrupts privileged binaries in memory without touching the disk – EPSS 0.99907, near-certain exploitation probability.
◆ Heath Callahan
Trust & Security
Two critical memory corruption flaws in Suricata 8.x affect different protocol parsers (HTTP/2 and DoH2), both exploitable by unauthenticated network attackers to crash the monitoring layer and render it blind.
◆ Heath Callahan
Trust & Security
CVE-2026-76460 is a CVSS 10.0 authentication bypass in the Cisco ISE management API with root-level access and log-wiping capability. The CISA federal compliance deadline expires today.
◆ Heath Callahan
Trust & Security
The first Model Context Protocol flaw listed in the CISA Known Exploited Vulnerabilities catalog exposes a gap in how AI gateways authenticate between agents and tools.
◆ Heath Callahan
Trust & Security
A stack-based buffer overflow in Check Point's Security Management Server login process allows an unauthenticated attacker to execute code as root – the fifth critical management-plane vulnerability in under eight weeks, affecting every deployment worldwide.
◆ Heath Callahan
