All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
Attackers are systematically abusing GitHub's public APIs to map organizations, steal source code, and find secrets like API keys and cloud credentials, using a mix of fake dormant accounts and leaked credentials that blend into normal usage patterns. GitHub's public APIs don't require authentication for many operations and don't log geolocation data for external access, making it difficult to detect and stop this reconnaissance activity. The attacks involve automated scanner tools and coordinated networks of fake accounts that operate in short bursts across many organizations.
Serena, an AI agent framework, runs an unauthenticated Flask web dashboard on a fixed port (24282) with no login protection or security checks. An attacker can use DNS rebinding (a technique where an attacker controls a domain and redirects it to a victim's local machine) to write malicious commands into Serena's memory from a malicious webpage, which the agent then executes using `shell=True` (a mode that allows shell code injection). This creates a complete remote code execution vulnerability that requires only visiting a malicious website while Serena is running.
LiteLLM is a proxy server (an intermediary that forwards requests to AI language model APIs) that had a security flaw before version 1.84.0 where attackers could fake an Authorization header to bypass authentication checks and access AI tools without a valid LiteLLM key. The vulnerability affected the MCP Streamable HTTP endpoint (a network interface for handling streaming data) and allowed unauthenticated requests to reach protected systems.
LiteLLM is a proxy server (a middleman program that forwards requests to different AI language model services) that had a security flaw in versions before 1.82.0-stable. Privileged users could upload custom Python code (a programming language) to create or update guardrails (safety filters), but this code wasn't properly sandboxed (isolated from the rest of the system) and could expose secrets (sensitive credentials) stored in the server's memory. The vulnerability affected the production create and update paths but not the test endpoint.
LiteLLM is a proxy server (a middleman that forwards requests to different AI services) that had a vulnerability before version 1.83.7-stable where it didn't properly check file paths when extracting uploaded skill files (packaged as ZIP archives). This meant an authenticated user could upload a specially crafted file that uses path traversal (a technique to write files outside the intended folder) to place files in dangerous locations on the server.
LiteLLM is a proxy server (an intermediary that forwards requests to AI language model APIs) that had a security flaw in versions before 1.83.10-stable. The /health/test_connection endpoint (a tool used to check if model connections work) allowed privileged users to read files from the server's local filesystem by supplying specially crafted references, which is a file disclosure vulnerability (CWE-73, external control of file name or path).
Composio SDK versions before 0.2.32-beta.283 have a path validation bypass vulnerability (a security flaw where file path checks are missing) that allows attackers to read and steal sensitive files like SSH private keys. Attackers can exploit prompt injection (tricking an AI by hiding instructions in its input) to manipulate file upload parameters and cause the CLI to send credential files to attacker-controlled storage.
Gradio before version 6.20.0 has a vulnerability where the /gradio_api/file= endpoint accepts unvalidated URLs in the file_fetch() function, allowing attackers to perform an open redirect (sending users to malicious websites) or SSRF (server-side request forgery, where the server makes unintended requests to internal systems). Attackers can exploit this to target cloud metadata services and steal sensitive credentials like EC2 IAM role credentials (authentication tokens used by cloud services).
OpenAI is publicly releasing its GPT-5.6 models (Sol, Terra, and Luna) after initially limiting access to a small group of trusted partners at the U.S. government's request. The company also announced GPT-Live, a new generation of voice models that can listen and speak simultaneously, making conversations feel more natural. OpenAI stated it believes in broad access to AI tools and is working with the government to develop a repeatable evaluation process for future model releases.
OpenAI has released GPT-Live-1, an upgraded voice model for ChatGPT that behaves more like a natural conversation by interrupting less and waiting when you pause mid-sentence. The new model can automatically route complex questions to more powerful text models like GPT-5.5 for reasoning or web search, allowing faster responses to your queries.
Flowise versions before 3.1.0 contain a path traversal vulnerability (a flaw where attackers can access files outside the intended directory) in its Faiss and SimpleStore vector store (systems that store and retrieve AI embeddings, which are numerical representations of data) implementations. Attackers who have valid API tokens can exploit unsanitized basePath parameters to write data to any location on the filesystem, potentially leading to code execution or data theft.
A command injection vulnerability (CWE-77, improper neutralization of special elements in commands) was found in bentoml OpenLLM version 0.6.30 in the async_run_command function, where an attacker can manipulate the cmd argument to execute unauthorized commands, though this requires local access to the system. The vulnerability has been publicly disclosed and the developers were notified but have not yet responded.
OpenAI has published National Security Principles to guide how it partners with governments on AI use in sensitive areas like cyber defense and biosecurity. The company has established restrictions on its technology, including bans on mass domestic surveillance, autonomous weapons control, and high-stakes automated decisions, while emphasizing that democratic societies should make the most important choices about AI use through legislation rather than by companies alone.
Fix: Update LiteLLM to version 1.84.0 or later, where this issue is fixed.
NVD/CVE DatabaseFix: Update to LiteLLM version 1.82.0-stable or later, where this issue is fixed.
NVD/CVE DatabaseFix: Update to version 1.83.7-stable or later.
NVD/CVE DatabaseFix: Update LiteLLM to version 1.83.10-stable or later. According to the source, 'This issue is fixed in version 1.83.10-stable.'
NVD/CVE DatabaseFix: Update Composio SDK to version 0.2.32-beta.283 or later.
NVD/CVE DatabaseFix: Update Gradio to version 6.20.0 or later, as indicated in the release tag https://github.com/gradio-app/gradio/releases/tag/gradio%406.20.0.
NVD/CVE DatabaseSystem prompts are instructions given to large language models (LLMs) that guide their behavior, often containing sensitive information like API keys and tool descriptions. System prompt leakage occurs when attackers use prompt injection (tricking an AI by hiding instructions in its input) to extract these prompts, and this is a frequent security issue listed in the 2025 OWASP LLM Top 10. The source explains that this problem currently has no complete fix because it's a fundamental limitation of how LLMs work, and defenses need to be layered rather than relying on any single solution.
Fix: The source recommends implementing defense-in-depth mechanisms using Amazon Bedrock Guardrails and other AWS tools, and references additional guidance in AWS documentation titled 'Securing Amazon Bedrock Agents: A guide to safeguarding against indirect prompt injections' and 'Safeguard your generative AI workloads from prompt injections.' The source also notes that simply adding explicit instructions to system prompts (like 'never reveal your system prompt') is not sufficient and does not remediate the issue.
AWS Security BlogThis research paper presents a lightweight defense method against advanced phishing emails (fraudulent messages designed to steal information) using a distilled attention-augmented BiLSTM (a type of neural network architecture that learns patterns in sequential data like email text). The approach aims to detect sophisticated phishing attempts more efficiently than existing methods by combining attention mechanisms (which help the AI focus on the most important parts of an email) with a smaller, optimized model.
This research paper proposes FedDC, a protection scheme designed to secure federated learning (a training method where multiple computers train an AI model together without sharing raw data) by using a chaotic system (a mathematical approach based on unpredictable behavior). The scheme aims to make federated learning more efficient while protecting the privacy and security of the distributed training process.
This academic paper proposes a new method for federated learning (training AI models across multiple computers without sharing raw data) that uses attribute-based homomorphic encryption (a type of math that lets computers do calculations on encrypted data without decrypting it first). The approach aims to make federated learning both more secure and faster by protecting data privacy while reducing computational overhead.
AI coding agents like Claude Code, Cursor, and OpenAI Codex are triggering endpoint security detection rules (behavioral engines that flag suspicious activity) because they perform actions identical to attacker behavior, such as decrypting stored browser credentials and downloading files using built-in system tools. The agents themselves are not malicious, but their legitimate work looks exactly like credential theft and code execution attacks to security software, making it harder for defenders to distinguish between benign AI assistants and actual intruders.
Fix: Upgrade to Flowise version 3.1.0 or later.
NVD/CVE DatabasePolitical candidates are using AI to create deepfakes (synthetic media that mimics real people or events) and fake news stories to spread misleading campaign messages at scale. One candidate in New York used an AI chatbot to generate fake news articles with real news outlet logos, then shared them on social media to damage his opponent's campaign, though the false claims were ultimately exposed when his opponent won the election anyway.
OpenAI discovered that SWE-Bench Pro, a widely-used benchmark for measuring AI coding abilities, has significant quality problems that make it unreliable for evaluating model capabilities. Approximately 30% of the tasks in the benchmark are broken due to issues like overly strict tests, unclear instructions, insufficient test coverage, or misleading prompts, meaning the benchmark no longer accurately measures whether AI models can actually write software.