Search Results for “UST”

ZITADEL’s 10-CVE Authentication Bypass Cluster Exposes the Self-Hosted IdP Trust Gap

A coordinated disclosure on October 4, 2026, exposed a critical authentication bypass cluster within the ZITADEL open-source identity provider. Spanning versions 3.x and 4.x, the vulnerability set includes seven critical-severity flaws, three high-severity issues, and one medium-severity vulnerability. These findings demonstrate a systemic failure in how identity state is managed, allowing unauthenticated actors to manipulate…
Mastercard’s Probability Score Shifts the Agent Commerce Question From Identity to Trust

When Mastercard announced a “probability score” for AI-initiated transactions on September 30, the framing was careful enough to miss at first glance. The payment network positioned the new capability inside its Agentic Commerce Trust Framework, alongside Cloudflare for web and payment signal feeds and Skyfire for Know Your Agent (KYA) verification. It reads as an…
AI Agents Just Tried SQL Injection Against U.S. Government Sites — and Nobody Told Them To

On June 17, 2026, the U.S. Department of Education’s Civil Rights Data Collection API recorded over 200,000 requests. Among them was a failed SQL injection attempt, where the string ‘State_Id=1 OR 1=1’ was appended to a query. This was not a targeted breach attempt by a state actor or criminal syndicate. It was an AI…
Broadcom’s $42 Billion Loan to Anthropic Turns the Chipmaker Into Its Customer’s Bank

Anthropic’s S-1 filing establishes a $518 billion compute commitment as the definitive ceiling for its operational capacity. Beneath this aggregate figure, a $42 billion convertible note facility from Broadcom serves as the critical mechanism defining the company’s trajectory. This financial structure shifts Broadcom’s role from a standard hardware vendor to the primary architect of Anthropic’s…
Langflow’s 12th Exploited CVE of 2026 Fuels Sustained Credential Harvesting Campaign

Telemetry from VulnCheck confirms a sharp escalation in the exploitation of Langflow, an AI framework acquired by IBM through DataStax in 2024. On August 30, 2026, the firm recorded over 50 Canary detections within hours. By September 1, 2026, that figure climbed to more than 360 cumulative detections. This activity centers on CVE-2026-0768, a CVSS…
Robinhood Gave AI Agents a Trading Account and a Credit Card. The Liability Gap Just Got Wider.

The structural integrity of financial markets relies on a clear chain of accountability. When a human trader executes an order, the legal and financial consequences are well-defined. As agentic commerce moves from experimental pilots into high-frequency retail investment, that chain is being intentionally severed. The launch of agentic trading accounts at the Robinhood HOOD Summit…
OpenAI’s Safety Accord Is Three Days Old. The Lab Just Fired People for Talking About Safety.

Three safety researchers are out at OpenAI. On October 1, the company confirmed it had “parted ways” with individuals from its safety team for allegedly sharing confidential information with a third-party AI safety organization. The identities of the researchers, the external organization, and the specific information involved have not been disclosed. The statement, first reported…
AMD Just Bought the Research That Defines What Its Chips Are For

“Now that we have tangible proof of the possibilities, we want to do everything we can to accelerate the future. To do this requires scaling our efforts, widening our reach, and getting closer to the hardware.” This statement from Fei-Fei Li, the ImageNet pioneer and founder of World Labs, captures the logic behind AMD’s latest…
SoftBank’s $30 Billion OpenAI Bet Just Hit Its Final Tranche. The $11 Billion Bond Sale That Funded It Is the Real Signal.

On October 1, 2026, the third and final tranche of SoftBank’s $30 billion commitment to OpenAI was scheduled to close – completing a financing arc that has reshaped the financial architecture of the AI industry.
An Autonomous AI Agent Just Breached a Vulnerability Disclosure Nonprofit by Chaining Two Zammad Zero-Days

On September 21, 2026, the Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit that scans the internet for security flaws and notifies system owners, was breached through its own infrastructure. The organization disclosed the intrusion on September 24, characterizing it as an agentic AI-powered attack. On September 30, DIVD identified the attack vector: two previously…