All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
Two security flaws in Anthropic's Claude for Chrome extension allow malicious browser extensions to trick Claude into performing privileged actions like reading Gmail, Google Docs, and Calendar data on a user's behalf. The vulnerabilities have remained unfixed for months despite being reported to Anthropic in May, with the company marking an internal tracking issue as 'resolved' while the problematic code remained unchanged across eight releases. The first flaw involves synthetic clicks (fake user interactions generated by malicious code) bypassing verification checks, while the second involves a URL parameter that improperly grants elevated privileges.
Fix: The source explicitly mentions a fix for the first vulnerability: adding one line of code, 'if (!n.isTrusted) return;' at the top of the click handler to verify clicks are from real users. For the second vulnerability, the source recommends general practices (validating genuine user interactions, avoiding URL-driven privilege transitions, and strengthening internal extension authentication) but does not describe a specific implemented fix or version where these are resolved.
CSO OnlineThe US is developing AI safety standards through coordinated state and federal legislation, with California, New York, and Illinois leading efforts to create a common framework for governing powerful AI systems. These states are implementing three key elements: documented safety frameworks with risk assessments and public disclosure, reporting of serious safety incidents, and independent audits for accountability. This approach, called reverse federalism (states establishing shared direction through common frameworks), aims to create a de facto national standard that prevents regulatory chaos while keeping the US competitive in AI innovation globally.
Microsoft released a record 569 patches in a single month, with 59 rated as critical, partly because AI models can now help discover vulnerabilities faster. The company is recommending that customers speed up their patching schedules to address critical flaws more quickly. Separately, SAP patched a critical memory corruption bug with a CVSS score (a 0-10 rating of how severe a vulnerability is) of 9.9.
Cribl acquired CardinalOps to help security operations teams map their detection rules (the specific checks that catch attacks) to the MITRE ATT&CK framework (a standardized list of real-world hacking techniques). This lets SecOps teams see where their defenses have gaps and turn threat intelligence (information about current attacks) into actual security actions.
OpenAI is planning to release a smart speaker device that lets users speak to ChatGPT and includes a camera and sensors to understand the surrounding environment, though it will have no screen. The device will have a rechargeable battery for portability and smart home control features, though this announcement comes amid legal disputes with Apple over alleged hardware theft.
NVIDIA TensorRT-LLM (a tool for running large language models efficiently) contains a vulnerability in its OpenAI-compatible API where an attacker could trigger a reachable assertion (a failed safety check in the code) in the sampler thread, potentially causing the system to crash. This vulnerability could lead to a denial of service attack (making the service unavailable to legitimate users).
NVIDIA TensorRT-LLM (a tool for running large language models efficiently on NVIDIA GPUs) has a vulnerability in its OpenAI-compatible inference API that allows attackers to request unlimited GPU resources without restrictions. This could cause a denial of service (making the system unavailable to legitimate users) by exhausting the GPU's memory and processing power.
NVIDIA TensorRT-LLM for Linux has a vulnerability in its unpickler (a tool that converts serialized data back into usable objects) that allows local attackers to deserialize untrusted data. A successful attack could lead to code execution, privilege escalation, data tampering, and information disclosure.
In n8n-mcp (a tool that connects AI models to workflows) running in multi-tenant HTTP mode (where multiple separate users share one server), an authenticated user could bypass access controls and read or delete workflow backups stored in the default single-tenant scope instead of being restricted to their own workspace. This could expose sensitive workflow configuration information.
CVE-2026-47482 is a memory leak vulnerability (a bug where a program fails to free up memory it's no longer using) in NVIDIA Triton Inference Server for Linux that allows attackers to cause a denial of service (making a service unavailable to legitimate users). The vulnerability stems from the software not properly releasing memory after it's finished using it.
CVE-2026-47481 is a vulnerability in NVIDIA Triton Inference Server for Linux that allows attackers to bypass authentication (security checks that verify a user's identity) through an alternative path or channel. If successfully exploited, this flaw could let attackers run their own code on the system, gain higher-level access, steal information, or modify data.
CVE-2026-47480 is a vulnerability in NVIDIA Triton Inference Server for Linux that allows an attacker to trigger an uncaught exception (an error that the program doesn't handle properly), potentially causing a denial of service (making the service unavailable to legitimate users). The vulnerability has a CVSS 4.0 severity rating, though a detailed assessment has not yet been provided.
CVE-2026-47479 is a vulnerability in NVIDIA Triton Inference Server for Linux that allows an attacker to cause uncontrolled resource consumption (using up all available computing power or memory), potentially leading to a denial of service (making the service unavailable to legitimate users). The vulnerability has a CVSS 4.0 severity rating, though a complete assessment from NIST has not yet been provided.
Fix: According to the source, states should align on three core elements: (1) a documented safety framework with risk assessments for frontier models (AI systems at the cutting edge of capability) and public disclosure of those assessments and their results, (2) reporting of serious safety incidents, and (3) governance and accountability through independent, objective audits. The source states that California, New York, and Illinois have already implemented these elements as a model for other states to follow.
OpenAI BlogTraditional SASE (Secure Access Service Edge, a cloud-based security tool that inspects network traffic) cannot protect against modern data risks because it inspects encrypted traffic at network checkpoints, but today's threats happen inside applications and AI workflows where the network cannot see them. Modern encryption protocols like TLS 1.3 prevent network proxies from inspecting traffic without breaking applications, forcing organizations to create exemptions that weaken security, while AI agents can leak sensitive data through chat interfaces or tool calls before the network ever sees the interaction.
Fix: The source explicitly describes a shifted architecture: enforcement must happen "at the point of interaction, on the device: the browser and the endpoint" with "contextual data protection" where "copy, paste, and prompt content are inspected locally before data ever leaves the device." Traffic should be "steered dynamically to the closest available edge infrastructure, eliminating redundant hops," and the source mentions adoption of the "Perfect Packet" architecture, which "evaluates context at the endpoint before routing, invoking cloud inspection only when a session requires additional verification."
The Hacker NewsResearchers discovered TuxBot v3 Evolution, a modular IoT botnet (malware that infects internet-connected devices and controls them remotely) framework where the developers used an LLM (large language model, an AI trained to understand and generate text) to help write the malware code. Although the LLM generated working botnet code, it included safety warnings that the developers left in place, and the code contained several bugs that manual review could have caught, suggesting more polished versions may already exist in the wild.
GPT-Red is an automated red-teaming model (a system designed to find vulnerabilities by simulating attacks) that helps discover weaknesses in AI systems before they're released to the public. OpenAI trained GPT-Red using self-play reinforcement learning (a technique where the model competes against defender models to improve both sides) to find prompt injection attacks (tricks that hide malicious instructions in user input), and then used these findings to train GPT-5.6, making it six times more resistant to such attacks compared to earlier models.
Fix: OpenAI directly incorporated GPT-Red into the training process of their production models. The source states they "directly incorporate GPT‑Red into the training process of our production models" through self-play reinforcement learning, where GPT-Red is trained alongside defender LLMs (large language models) on realistic red-teaming scenarios. As defenders become more robust, GPT-Red discovers stronger attacks, creating an iterative improvement cycle. The source also notes they "will continue to scale this approach alongside human and third-party red-teaming, layered safeguards, and real-time monitoring."
OpenAI BlogThe cybersecurity industry has over-invested in detection tools (systems that identify attacks after they happen) rather than prevention tools (systems that block attacks before they occur), even though prevention is more cost-effective and reduces actual risk. Modern attacks now move faster than human teams can respond, so relying on detection and alerts creates alert fatigue (when too many false alarms overwhelm security staff) and leaves organizations vulnerable to initial compromises from known vulnerabilities, stolen credentials, or misconfigurations.
Security engineers design and deploy systems to protect organizations from cyber threats, and their role is evolving due to AI. Elite security engineers need skills in using AI-powered tools (software that uses machine learning to automate security tasks), understanding AI-related threats like prompt injection (tricking an AI by hiding instructions in its input) and model poisoning (corrupting training data to make AI systems malfunction), and balancing security with business performance goals. As AI automates detection and vulnerability scanning work, security engineers are shifting from responding to incidents toward interpreting AI findings and deciding on appropriate responses.
Fix: Microsoft is recommending that customers accelerate their patching schedules to more quickly deal with critical flaws.
CSO OnlineKNX Protocol Connection Authorization Option 1 has a vulnerability where its account lockout mechanism (a security feature that blocks access after failed login attempts) is too weak, allowing attackers to delete all devices and lock them without needing other security protections enabled. This vulnerability is currently being exploited in real attacks.
Fix: Apply mitigations according to vendor instructions while following CISA's BOD 26-04 guidance on prioritizing security updates based on risk. If mitigations are unavailable, discontinue use of the product. Organizations must evaluate whether their systems are exposed to the internet and ensure they meet BOD 26-04 patching deadlines (due by 2026-07-29).
CISA Known Exploited VulnerabilitiesOracle E-Business Suite has a vulnerability in its privilege management (the system controlling who can access what features) that allows attackers without credentials to access Oracle Payments over the internet and take it over. This flaw is actively being exploited by attackers in the wild.
Fix: Apply mitigations according to vendor instructions from Oracle's security alerts, following CISA's BOD 26-04 guidance for prioritizing security updates. If mitigations are unavailable, discontinue use of the product. The patch deadline is July 18, 2026.
CISA Known Exploited VulnerabilitiesFix: Upgrade to n8n-mcp version 2.57.4 or later. The fix requires a complete tenant context in multi-tenant mode and fails closed for workflow-version access that cannot be attributed to a specific tenant. Alternatively, restrict network access to the HTTP endpoint using a firewall or reverse proxy, run in stdio mode (which has no multi-tenant HTTP surface), or remove default-scope backups from prior single-tenant deployments if they are no longer needed.
GitHub Advisory Database