Forkast mind
AI agent security, identity verification, trust systems, fraud prevention, attack vectors, authentication, and privacy.
Trust & Security
Two unauthenticated SQLi flaws in SciPhi-AI's RAG platform let attackers run arbitrary queries as PostgreSQL superuser – and the default config has auth turned off.
◆ Heath Callahan
Trust & Security
The first legally binding vulnerability reporting timeline for AI products enters force in seven days, with penalties up to €15 million or 2.5% of global turnover for late or missing filings.
◆ Heath Callahan
Trust & Security
A CVSS 9.8 unauthenticated root RCE on the switches powering GPU-to-GPU traffic in million-node AI clusters highlights that hardware-layer vulnerabilities are now primary attack surfaces for AI infrastructure.
◆ Heath Callahan
Trust & Security
Three of seven new KEV entries target AI and ML infrastructure—the first batch where AI components constitute nearly half the additions. LiteLLM, Starlette/FastAPI, and JFrog Artifactory are all actively exploited.
◆ Heath Callahan
Trust & Security
Unit42 attributes a vishing operation that chained Microsoft Teams default federation settings to PetitPotam NTLM relay attacks against domain controllers, targeting 150 employees across 10 organizations.
◆ Heath Callahan
Trust & Security
Two distinct exploit chains targeting the same vulnerability architecture within two months suggest a persistent structural weakness in the appliance line—and defenders have no IoCs for the latest one.
◆ Heath Callahan
Trust & Security
A CVSS 9.8 improper authentication flaw in self-hosted Artifactory instances enables unauthenticated administrative access. WatchTowr observed exploitation within 96 hours of disclosure.
◆ Heath Callahan
Trust & Security
VulnCheck confirms active exploitation of a zero-day RCE in Langflow's validate endpoint as attackers pivot from proof-of-concept to automated theft of API keys and cloud credentials at scale.
◆ Heath Callahan
Trust & Security
A three-bug SYSTEM-level RCE chain demonstrated at Pwn2Own Berlin has been commoditized into a public exploit, leaving thousands of unpatched servers at risk.
◆ Heath Callahan
Trust & Security
A single Elixir AI framework shipped RCE, DNS rebinding, auth bypass, credential leakage, infinite loops, and exception disclosure—all found by LLM-assisted research.
◆ Heath Callahan
