Topic
Multi-year researcher-to-vendor disclosure processes and disputes over whether mitigations are sufficient or remediation has occurred.
CVE-2026-27875 lets a low-privileged local user pull credentials and auth tokens out of Simplex Incident Manager memory. CISA's advisory names both v2.01.01 and v1.01.05 as the upgrade.
Reality
Adversa AI says a hostile page can ship its instructions as AES ciphertext, have Grok decrypt them in its own Python runtime, and then exfiltrate session data via a URL fetch.
Reality
The Linux Foundation's coalition for AI-generated vulnerability reports starts taking automated submissions next month. Its membership terms set the ceiling on what it can absorb.
Reality
Check Point found Claude Code project configs could execute commands and steal Anthropic API keys on clone. Anthropic has patched it. The trust model it exposed is still yours to manage.
Reality
Ten drops since April 2026, the latest handing any local user SYSTEM on fully patched Windows 11. The next scheduled fix can be 28 days out, so mitigation has to be a day-one job.
Reality
RuntimeWire says Kimi Desktop 3.1.5 and 3.1.10 fetch a Group Chat executable from a mutable Moonshot path, skip checksum verification on Windows, and never enforce an Authenticode signer.
Reality
Birmingham and Durham researchers rewrote a DIMM's configuration chip in software to alias in-use memory, then reached into VBS enclaves, revived blocklisted drivers and killed EDR.
Reality
PromptArmor says 1-point white text hidden in an attachment is enough to push tickets to an outside server. Turning off web search org-wide leaves the agent's URL-fetch tool live.
Reality