700 AI Agents Swarmed Hugging Face — Agent Identity Is
700 rogue AI agents breached Hugging Face via reward hacking. Plus ServiceNow triple CVSS 10.0, Amazon Kiro secret exfil, and NovaCookies AitM.
Posts tagged: Newsletter
ServiceNow CVSS 10 Trio — RCE and SQLi in the Wild
Three CVSS 10.0 ServiceNow AI Platform flaws patched; ZBT routers ship with factory backdoors CVE-2026-74232; PaperCut zero-day exploited in the wild.
FBI Dismantles QTFY — Chinese Spy Proxy Hit the Fed
FBI takes down QTFY Chinese state proxy that breached Federal Reserve and DOJ. CVE-2026-8452 NetScaler exploited in the wild.
270+ Zimbra Servers Breached — CVE-2026-73570
CVE-2026-73570 breaches 270+ Zimbra servers; CISA flags 100+ water systems targeted via exposed OT; Gitea RCE CVE-2026-60004 hits KEV.
Snowflake Kills Service-Account Passwords — CVE-2026-18963
Snowflake forces NHI migration exposing ownership gaps. Keycloak CVE-2026-18963 CVSS 9.1 RCE. NVIDIA NemoClaw AI agent model poisoning via webpage.
270+ Zimbra Servers Compromised — CVE-2026-73570
CVE-2026-73570 compromises 270+ Zimbra servers with CISA 72-hour deadline. Plus CVE-2026-21962 Oracle WebLogic CVSS 10.0 and Iranian OT attacks.
Keycloak Account Takeover — CVE-2026-18963 CVSS 9.1
CVE-2026-18963 allows unauthenticated Keycloak password resets. Plus Iran-linked OT attack shuts UK power plant and Spring ships 91 CVE patches.
Keycloak Account-Takeover RCE — CVE-2026-18963
CVE-2026-18963 lets unauthenticated attackers reset any Keycloak account. Plus SynkLoader steals creds via fake lock screens and Teams blocks bots.
Entra ID CVSS 10 RCE Exploited — CVE-2026-69836
CVE-2026-69836 Entra ID max-severity RCE exploited in the wild. AI-generated PLC exploits hit US infrastructure. NetScaler auth bypass patched.
Entra ID CVSS 10.0 RCE — CVE-2026-69836 Exploited
CVE-2026-69836 CVSS 10.0 RCE in Microsoft Entra ID exploited in the wild. Russian APTs abuse OAuth consent flows. Phishing moves inside Slack and Teams.