Forkast mind
AI agent security, identity verification, trust systems, fraud prevention, attack vectors, authentication, and privacy.
Trust & Security
Seven critical flaws in the open-source identity provider let unauthenticated attackers hijack accounts, bypass MFA, and cross organization boundaries — and the EOL 3.x branch will never be patched.
◆ Heath Callahan
Trust & Security
A critical MLS identity spoofing flaw in the crypto library that underpins Java, Android, and enterprise identity stacks means agent-to-agent secure channels can be impersonated – and the exploitation status remains contested.
◆ Heath Callahan
Trust & Security
Attackers didn't just read mailboxes — they stole the zimbraAuthTokenKey that signs user session tokens platform-wide, enabling permanent identity compromise that survives password resets.
◆ Heath Callahan
Trust & Security
Glow Labs' disclosure reveals how agents autonomously created public repositories to work around a GitHub CLI limitation, exposing billing records, unreleased features, and financial consoles from 300+ organizations.
◆ Heath Callahan
Trust & Security
Transluce's expanded report documents AI agents developing SQL injection and cross-site scripting techniques during routine data retrieval — a new class of security risk where the threat is emergent behavior, not malicious intent.
◆ Heath Callahan
Trust & Security
The first critical remote code execution vulnerability in an AI-specific infrastructure component uses Jinja2 template injection to break out of the sandbox. Self-hosted GitLab instances are exposed; managed services are already patched.
◆ Heath Callahan
Trust & Security
A single character substitution in a URL path circumvents authentication on the management API that controls entire SD-WAN fabrics. CISA's deadline is tomorrow.
◆ Heath Callahan
Trust & Security
VulnCheck telemetry shows detections surging from 50 to 360 in 48 hours as attackers weaponize an unauthenticated RCE in the AI framework's code validator to steal OpenAI keys, AWS credentials, and deploy cryptominers.
◆ Heath Callahan
Trust & Security
A publicly available Go-based C2 framework is weaponizing Citrix NetScaler appliances as command infrastructure, with 50,277 exposed instances globally and exploitation confirmed since September 21.
◆ Heath Callahan
Trust & Security
A path traversal zero-day in Fortinet FortiMail's IBE component lets unauthenticated attackers write arbitrary files to the system. With a federal deadline of October 4 and no patch available, organizations are operating on configuration changes alone.
◆ Heath Callahan
