Lab
Claude Code vs Codex: Only 1 of 17 Tries Fixed an Unseen Vulnerability
SecurityAIDevelopment
We planted brand-new vulnerabilities that the models had never seen, cut off internet access so they could not look up the answer, and asked Claude Code and Codex to fix them. Across 17 runs, only one actually closed the real hole. Knowing the file was not enough, and a green test suite did not mean the bug was gone.
2026.06.1972 views
News
Acer, Toshiba and More: A Secure Boot Hole That Never Gets Revoked
LinuxSecurityInfrastructure
PCs from several makers—Acer, ASUS, GIGABYTE, Toshiba and more—have a weakness that lets attackers slip past Secure Boot, the startup safety check (JVNVU#93024090). If abused, malware that survives an OS reinstall and evades antivirus can be planted deep in the machine. The attack needs admin rights or physical access; fix it with maker firmware updates and DBX updates.
2026.06.1968 views
News
mcp-pinot, the Bridge Between AI and Your Database, Lets Anyone In: CVE-2026-49257, Update to v3.1.0
SecurityDevelopmentAI
mcp-pinot, the component that connects AI assistants to an analytics database, was left reachable by anyone from the outside at its default settings. CVE-2026-49257 carries the maximum 10.0 severity. An attacker can read and write the database without authentication, risking a full takeover. No-auth holes keep surfacing in the 'MCP servers' that connect AI to external systems; affected v3.0.1 and earlier should be updated to v3.1.0 immediately.
2026.06.1950 views
News
Bitnami Cassandra Images Leave a Default Password Active: CVE-2026-47846, Update Now
DevelopmentSecurityInfrastructure
A flaw in the Bitnami official container images of Apache Cassandra, the popular database that distributes large volumes of data across servers, can leave a well-known default password active. CVE-2026-47846 is rated 9.8 out of 10. Even if you set up your own administrator, an attacker can break in from the outside with the default account and read or write all data. The affected 4.0/4.1/5.0 branches should be updated to a fixed version immediately.
2026.06.1939 views
News
Account Takeover Flaw in AI Agent Tool AutoGPT: CVE-2026-55237, Update to 0.6.62
AIDevelopmentSecurity
A vulnerability in AutoGPT, the well-known tool for building AI agents, can let an attacker hijack a user's account just by getting them to click a crafted link. Published June 18, 2026 as CVE-2026-55237 with a severity of 8.8 out of 10, it affects self-hosted installs. Updating to the latest version, 0.6.62, closes the hole.
2026.06.1955 views
News
Is FFmpeg safe? A run of subtitle, audio & video flaws (CVE-2026-64830 and more) — even 8.1.2 needs another update
DevelopmentSecurity
Is FFmpeg safe to use? In July 2026 four more high-severity flaws were disclosed together in the go-to video software—in subtitle and audio parsing and in hardware video playback (CVE-2026-64830/64831/64832/64835), all rated 8.8, where a single crafted file can lead to code execution. None is fixed by June's 8.1.2 release.
2026.06.19160 views
News
Is SignalRGB Safe? Its Driver Flaws Are Fixed. What to Check Now
SecurityLinux
Two flaws in the kernel driver that SignalRGB installs — CVE-2026-8049, where any local user can reach admin-level hardware operations, and CVE-2026-8050, which can repeatedly crash the PC — were disclosed via JVN and CERT/CC. Both are local but usable for privilege escalation, and because the driver is signed it can be carried onto other machines as a BYOVD tool. WhirlwindFX fixed them in 1.3.6 / 1.3.7.0. Here is how to update and what to check.
2026.06.1888 views
News
Picklescan Can Be Bypassed: 8 Flaws Let Malicious AI Models Pass as Safe (CVE-2026-3490), Update to v1.0.4
AISecurity
Picklescan, the tool that detects dangerous code hidden in AI models, has eight flaws that let attackers slip past the scan. The most severe, CVE-2026-3490, scores a perfect 10.0. Even a model marked safe can hijack your PC or server the moment it loads, and since it runs behind hubs like Hugging Face, the impact is broad. Here is what to do, how to update to v1.0.4, and a safer model format.
2026.06.1850 views
Roundup
Awa Bank's 27,745-record leak: what happened in a test environment left running
Japanese CompaniesPrivacySecurity
Awa Bank leaked a cumulative 27,745 records of customer and shareholder data. The cause was a test environment left running long after development ended, with real customer data never deleted, then accessed from outside. We break down what leaked, how it could be abused, and how it should have been prevented.
2026.06.1742 views
News
Joomla JCE takeover flaw CVE-2026-48907: update to 2.9.99.9
DevelopmentSecurity
A critical flaw, CVE-2026-48907, in JCE, a hugely popular editor add-on used by many Joomla sites, lets attackers take over a server with no login. Severity is a perfect 10.0, exploit code is public, and automated attacks are underway. CISA has ordered urgent remediation. Here are the affected versions and what to do now.
2026.06.17140 views
News
Data-Theft Flaw in WordPress 'The Events Calendar', Fixed in 6.16.3
SecurityDevelopment
The Events Calendar, a WordPress plugin on 700,000+ sites, has a critical flaw (CVE-2026-49772, severity 9.3) that lets anyone read the database with no login. Here are the affected versions, how to check your site, and how to update to 6.16.3 now.
2026.06.1642 views
News
Zyxel GS1900 Switch Takeover Flaw CVE-2026-7273: Patch 10 Models Now
InfrastructureGlobal CompaniesSecurity
Zyxel's GS1900 office network switches — 10 models — have a flaw, CVE-2026-7273, that lets anyone on the same local network take the device over without a password, enabling traffic spying or cut-offs. Here are the affected models, the fixed firmware, and the update steps to run now.
2026.06.1642 views
