Topic
A process where security researchers privately report vulnerabilities to vendors, allowing time to develop fixes before public disclosure.
OpenBao fixed a four-bug chain in 2.6.3 and 2.7.0 that lets unauthenticated attackers seize servers with a Raft snapshot policy set. A dev.to post says HashiCorp Vault has no fix yet, so Vault operators have to close network paths to the API themselves.
Reality
Commercial AI models refused every query from Hugging Face's breach responders, Veracode's Chris Wysopal wrote, forcing them onto a self-hosted Chinese model. Security leaders now have to settle which AI model their responders can use before an intrusion starts.
Perspective Coverage
3 publishersReality
Faav, a 16-year-old researcher, reached admin SQL over 17.3 trillion rows on Microsoft's Titan service because it never checked login-token signatures. Microsoft locked the endpoint four days after his report and paid a $5,000 bounty.
Reality
Copilot Autofix swapped an env-var-and-jq pattern for inline interpolation in a public GitHub Actions file, and Wiz's autonomous agent exploited it inside a week.
Reality
Cloudflare has fixed a flaw in Containers that let a Workers Paid account read the 60 KiB it had not written inside each 64 KiB disk block it touched. The fleet-wide fix needed no customer configuration changes.
Reality
Adversa AI says its Cryptographic Context Injection recovers hostile prompts inside the code sandbox, where filters do not look. xAI has not replied; Google scopes jailbreaks out entirely.
Perspective Coverage
6 publishersReality
CVE-2026-75501 puts an unauthenticated UPnP control endpoint on the WAN side of a premium ISP gateway. With no patch and no vendor reply, the carriers own the mitigation.
Reality
Olivier Laflamme walked an unpaired Bluetooth write up to root on the G1 EDU's Locomotion PC by way of a Unitree cloud API that decrypted key material for any logged-in account. Unitree fixed that check in July, but no patched firmware has been named.
Perspective Coverage
4 publishersReality
CERT Polska dated successful attacks to at least September 2 and published its warning on September 5, so operators who deferred the RouterOS update have three days of configuration changes to read as well as a patch to install.
Perspective Coverage
8 publishersReality
MikroTik published RouterOS fixes in four branches with no CVE and no technical detail. The same upgrade runs a compromise check and writes a critical log entry marking the device Flagged.
Perspective Coverage
3 publishersReality
CISA lists 14 CVEs in two Botslab G980H dashcam firmware lines, including session flaws that can give an attacker on the camera's network privileged access. Botslab has not answered CISA, so operators have no fix date to plan around.
Reality
CERT Polska rebuilt the MikroTrick attack chain from MikroTik's unlabeled September 3 patch and had a working exploit for CVE-2026-86060 in about an hour. The fix quietly disables a rogue "ops" account, evidence the chain was already exploited in the wild.
Reality
Two flaws disclosed on September 23rd let anyone on the network path read repository objects in transit, and let a connecting peer claim a Node ID it does not own. Radicle tells users to treat anything already sent as leaked.
Reality
Anthropic says Claude Mythos Preview found and exploited previously unknown flaws in every major operating system and web browser during a month of testing. Its disclosure process keeps the rest unnamed until patches ship.
Reality
A University of British Columbia team showed that three selection functions in Soatok's constant-time-js leak their condition through V8's cache behaviour. He shipped version 0.5.0 and requested a CVE.
Reality
Siemens ProductCERT reported the traversal itself, and fixed builds are out for four SIMOVE Fleetmanager branches and SIPLANT V3.1. For SIPLANT V1.7, V2.2 and V3.0 the advisory's remedy is an email to support.
Reality
CVE-2026-50093 lets an attacker upload arbitrary files to the Open Interface Services web module and take root on the host running Siveillance Control. Siemens reported it to CISA and has fixed builds out for all four affected branches.
Reality
CVE-2026-18963 sits in the Keycloak reset-credentials flow that Siemens embeds in Industrial Edge Management. Siemens closed its own Cloud service on September 2, and owners of self-hosted IEM Pro and IEM Virtual patch or block the path themselves.
Reality
Oren Yomtov of Accomplish found two ways out of the Codex sandbox, both silent and neither stopped by an approval prompt. OpenAI patched them within eight days, and other researchers have found the same design in rival agents.
Reality
Researchers at AIR found that four AI coding agents accepted a Git checkout they never verified, and because no marketplace can close the gap, the repair now travels through agent version numbers inside each enterprise.
Reality
Security · September 20, 2026 · 1 publisher
Security · September 18, 2026 · 2 publishers
Build · September 17, 2026 · 1 publisher
Security · September 16, 2026 · 1 publisher
Security · September 16, 2026 · 1 publisher
Build · September 15, 2026 · 1 publisher
Security · September 15, 2026 · 1 publisher
Security · September 14, 2026 · 1 publisher
Invest · August 27, 2026 · 3 publishers
Build · September 11, 2026 · 1 publisher
Build · September 10, 2026 · 1 publisher
Security · September 10, 2026 · 1 publisher
Security · September 9, 2026 · 1 publisher
Security · September 8, 2026 · 2 publishers
Invest · September 7, 2026 · 1 publisher
Product · September 5, 2026 · 1 publisher
Security · September 5, 2026 · 1 publisher
Security · September 3, 2026 · 1 publisher
Security · September 3, 2026 · 1 publisher
Security · September 2, 2026 · 1 publisher
Invest · September 2, 2026 · 1 publisher
Security · September 1, 2026 · 1 publisher
Leadership · August 30, 2026 · 1 publisher
Invest · August 29, 2026 · 2 publishers
Product · August 28, 2026 · 1 publisher
Security · August 27, 2026 · 1 publisher
Security · August 26, 2026 · 1 publisher
Security · August 25, 2026 · 1 publisher
Security · August 25, 2026 · 1 publisher
Security · August 25, 2026 · 1 publisher
Security · August 23, 2026 · 1 publisher
Build · August 21, 2026 · 1 publisher
Leadership · August 20, 2026 · 1 publisher
Security · August 20, 2026 · 1 publisher
Security · August 19, 2026 · 1 publisher
Leadership · August 19, 2026 · 1 publisher
Build · August 19, 2026 · 1 publisher
Build · August 18, 2026 · 1 publisher
Security · August 17, 2026 · 1 publisher
Build · August 15, 2026 · 1 publisher