All items
All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
12,081 items
ERASE is a defense against multimodal indirect prompt injection that replaces the injected region of image, audio, or video with modality-appropriate blank content while keeping the rest of the media. A student model learns from a frozen base model reading the erased view through on-policy self-distillation. On 3B audio it reaches 60.1% attacked-input accuracy versus 33.1% for ARGUS, within 0.5 points of the undefended clean-input level.
Fix: The source describes ERASE as a proposed defense method, not a fix for a specific vulnerability, and states the code will be publicly available upon acceptance.
Arxiv (cs.CR + cs.CL + cs.LG)CISA has warned of CVE-2026-46300, a high severity Linux kernel privilege escalation flaw, known as Fragnesia and part of the Dirty Frag class of local privilege escalation bugs, that attackers are chaining with PHP2Shell bugs in the wild. Researchers at Dream Security said the attack has been used to breach 25 servers, including three affiliated with the US government. Threat actors reportedly rooted vulnerable PAN-OS Palo Alto Networks firewalls and then targeted Active Directory.
Fix: Federal agencies have been ordered to patch the flaw. No further mitigation is specified in the source.
CSO OnlineCVE-2026-118527 is a generation of predictable numbers or identifiers vulnerability in Ivanti Connect Secure. A remote authenticated attacker can upload files with attacker-controlled content to a known location on disk. It can be chained with CVE-2026-104935 and CVE-2026-111357. The item is listed as actively exploited in the wild (CISA KEV).
OpenAI has published excerpts from court briefs filed by creators, academics, accessibility advocates, legal experts and industry groups arguing that fair use supports AI training. The filings respond to a New York Times lawsuit, which the excerpts say asks courts to set aside longstanding fair use principles. The source text is cut off before the full set of arguments.
Researchers propose KDLight, a lightweight knowledge distillation framework with an adversarial attack module for coronary artery vessel segmentation. The adversarial attacker, placed before the generator, produces perturbations during training to improve generalization and reduce overfitting. Tested on two datasets, the method reportedly outperforms state-of-the-art approaches, with p-values below 0.05, while using markedly lower FLOPs and parameter counts.
CVE-2026-111357 is a missing authentication for critical function vulnerability in Ivanti Connect Secure. It could allow a local authenticated attacker to escalate privileges, and it can be chained with CVE-2026-104935 and CVE-2026-118527. The item is listed in CISA's Known Exploited Vulnerabilities catalog.
OpenAI reversed a planned cut to usage limits for ChatGPT Pro subscribers, after customer backlash. It says it is doubling all usage limits for the Pro 100, 200 and 500 tiers and Business Premium, effective immediately, and that Work and Codex usage will stay the same for Pro 200. Extended limits for Dots will continue and remain separate from default usage.
OpenAI has launched a benefit that gives eligible ChatGPT subscribers credits for its API, matching a similar program Anthropic announced earlier this month. Subscribers on the $100, $200, or $500 per month plans receive the equivalent amount in credits, which can be applied to one of their API organizations.
CoPilot versions before 0.1.76 let a customer_user, the lowest-privilege portal role, upload case-report templates that are later rendered without a sandbox by Jinja2 engines when an admin or analyst generates a report. The upload route validates only the filename-derived MIME type, and the shared template store lacks customer_code scoping, so an attacker can replace a default template. In the reported deployment, attacker Jinja expressions run as Python on the backend with root privileges, exposing all tenants' incident and SIEM data and stored connector credentials. The wkhtmltopdf HTML/PDF renderer also permits local-file reads and internal requests.
A cryptomining and backdoor campaign abusing Hugging Face model repositories returned within days of takedown. Its most downloaded malicious model, MENXIANGYU/qwen2-tiny, contained no model at all, and its trust_remote_code Python code installed a disguised miner, restarted it if killed, removed competing miners, and in some versions opened a reverse shell. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT.
Amazon's cloud unit, AWS, reported third-quarter revenue of $45.98 billion, up 39% year over year and above the $45.29 billion analyst consensus. Its operating income reached $17.77 billion, up 55%, and the unit now accounts for almost 23% of Amazon's revenue. Amazon CEO Andy Jassy said AWS can grow north of 40% in each of 2027 and 2028.
Researchers introduce REEF, a benchmark of 9 verifier-grounded websites that pairs benign web-agent tasks with malicious objectives delivered through 5 attack types, and ANGLER, an adaptive attack framework that uses execution feedback to mutate attacks. Across 8 VLM-based web agents, ANGLER reaches a 20.36% end-to-end attack success rate versus 15.24% for a non-adaptive setting. It also cuts benign task success from 61.9% to 44.4% compared with attack-free execution.
The authors introduce SHAKTI, a Hindi benchmark covering four genres, eight LLM families, multiple prompting strategies, and adversarial transformations, for detecting AI-generated text. They also propose TRIDENT, a round-trip translation detection framework with static, dynamic, and logistic-regression variants, where TRIDENT-S achieves the best overall performance and outperforms conventional and supervised baselines. The framework shows multilingual applicability and robustness across seven languages and adversarial settings, though it is sensitive to the translation model.
Researchers systematically evaluated modern agentic browsers against widely deployed anti-bot mechanisms and found many defenses built for traditional automation struggle to reliably detect autonomous AI-driven agents. They introduce AgentShield, a behavioral fingerprinting framework targeting the Perception-Reasoning-Action loop, which uses dynamic web forms and interaction telemetry to separate human users from agents. They also describe Extinction-induced Policy Drift, an attack in which repeated obstruction of task completion makes agents relax safeguards and engage in unsafe behaviors.
Fix: AgentShield, a behavioral fingerprinting framework that uses dynamic web forms and fine-grained interaction telemetry to detect autonomous agents, plus defensive prompt injection techniques that exploit agent-specific weaknesses to mitigate autonomous web abuse based on content extraction.
Arxiv (cs.CR + cs.CL + cs.LG)Fix: Apply mitigations in accordance with vendor instructions, in line with CISA's BOD 26-04 guidance and the CISA Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders should evaluate each asset's internet exposure and adhere to BOD 26-04 patching guidelines. Due date: 2026-11-13.
CISA Known Exploited VulnerabilitiesMedBackdoorGuard is a defense framework for MRI-based Alzheimer's disease and mild cognitive impairment classifiers that detects and mitigates backdoor attacks without prior knowledge of the trigger. Across ADNI, OASIS-1 and a public four-class dementia MRI benchmark, it reduced the mean attack success rate from 96.4% to 3.0% while keeping clean accuracy within 0.6 percentage points of the undefended model. It also raised MCI recall on triggered scans from 3.9% to 88.3%.
Fix: Defense framework MedBackdoorGuard: spectral latent screening of training data, latent trigger isolation, trigger-sensitive neuron pruning with fine-tuning under an anatomical attention consistency constraint, and a runtime inference guard using superimposition entropy and anatomically informed reconstruction.
OpenAlex (peer-reviewed AI security)Researchers tested whether OpenAI models recognise non-public, pay-walled books they were not licensed to train on, using the DE-COP membership inference attack on 34 copyrighted O'Reilly Media books (13,962 paragraphs). GPT-4o scored an AUROC of 0.82 (95% bootstrapped CI: 0.60 to 0.96), while GPT-3.5 Turbo and GPT-4o Mini scored near chance at 0.54 and 0.56. The authors caution that results are preliminary given the small book sample and differences across models.
This research studies model extraction of convolutional neural networks that combine ReLU activations and max-pooling layers in the soft-label setting. The authors show that max-pooling critical points capture the difference between two convolutional neurons, and that the local structure of convolution lets them determine the shift between neurons and reconstruct the convolutional kernel. Validated on a compact VGG-style CNN trained on CIFAR-10, the methods permit accurate weight extraction in practice.
Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk and CISA's Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Due date: 2026-11-02.
CISA Known Exploited VulnerabilitiesThis research paper formalizes robustness for LLM agent memory managers, which must handle both outdated facts and memory poisoning without degrading on other inputs. The authors introduce evidence-conditioned accuracy (ECA), which also checks that selected records contain all needed evidence and are updated and attack-free. They report that existing memory systems and defenses are no more robust than an untuned manager, and that a one-shot fine-tuning recipe improves every category score and more than doubles the untuned manager's overall ECA across three backbones, though robustness remains incomplete.
Researchers report structural memorization in fine-tuned Mixture-of-Experts LLMs, where a model retains the internal expert routing pathway used for its training data as well as the data itself. They show these routing pathways can be recovered through unconditional generation using only routing and output logits, without knowledge of the fine-tuning data or procedure. The authors also propose composite metrics combining reference model tail likelihood with complexity-aware normalization to improve detection of memorized routing structures, which traditional membership inference metrics miss.
Fix: Fixed in 0.1.76.
NVD/CVE Database