AI & LLM
AI and LLM covers generative models, agents, prompt injection, data security and new artificial intelligence tools. The collection connects capabilities, limitations, operational risks and their impact on technical work.
Public Exploit for CVE-2026-80521 Puts Ubuntu Containers at Root Risk
An exploit released on September 22, 2026 leverages CVE-2026-80521 for container escape on Ubuntu LTS. The upstream fix landed on Augu…
ClosedQuorum: The First Windows Malware That Lets an AI Panel Decide C2 Commands
Cisco Talos has documented ClosedQuorum, the first publicly reported Windows implant that delegates tactical command-and-control decis…
Bifrost AI Gateway RCE Risk: Authentication Disabled by Default
CVE-2026-90898 in the Bifrost AI gateway enables unauthenticated remote command execution. The flaw is amplified by a design choice th…
Cisco Talos Launches CAIRN: Hunting AI Malware Without Executing a Single Binary
Cisco Talos has released CAIRN, an open-source toolkit that tracks AI-integrated malware through cognitive artifacts in metadata. The…
Meta Muse macOS: Local Bug Hijacks Dictation to Malicious Servers
Patrick Wardle has disclosed a zero-day vulnerability in Meta Muse for macOS. The endo_voyager_dictation_endpoint setting can be modif…
Over 100 Fake AI Sites: A $249 Toolkit Lowers the Barrier for Subscription Fraud
Malwarebytes identified more than 100 fake AI subscription sites built with a commercial $249 toolkit. The sites impersonate real bran…
Google Confirms Gemini AI Accidentally Accessed Three Real Companies
During a May 2026 cybersecurity test by Israeli firm Irregular, Google's Gemini model interacted with three real companies' systems. G…
How Intent Injection Threatens 6G AI-Native Network Automation
A paper from the University of Ottawa and Nokia Bell Labs exposes adversarial intent injection in 6G AI-native networks: malicious JSO…
JADEPUFFER Encrypts AI Weights with ENCFORGE: Phantom Ransom, Broken Payment Mechanism
The agentic ransomware group JADEPUFFER struck Langflow infrastructure with ENCFORGE, a payload that encrypts AI models without a func…
Plugin4Shell: First Supply-Chain Vulnerability in AI Agent Plugin Ecosystem
The Plugin4Shell vulnerability bypasses SHA pinning in plugins for four AI agents. Two vendors have patched; Microsoft and Google have…
BragJack: A Malicious Extension Hijacks Five AI Agents in Chromium Browsers
A proof-of-concept demonstrates how a pre-installed malicious extension can control AI agents in Chrome, Edge, Opera, Perplexity, and…
Four Linux Exploits Published: Local Root via Bugs 10–21 Years Old
Security researcher Asim Manizada released working proof-of-concept exploits for four Linux kernel vulnerabilities on September 18, 20…