All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
Cybersecurity companies Palo Alto Networks and CrowdStrike have experienced record growth due to increased demand for AI-powered security defenses, driven by concerns about Mythos-class models (advanced AI systems that hackers could use to find software vulnerabilities and launch attacks). Both companies have positioned themselves as leaders by gaining early access to powerful AI tools and acquiring identity security technology to help protect businesses from AI-driven cyber threats.
IBM Langflow OSS versions 1.0.0 through 1.10.0 have a security flaw where stored credentials can be exposed because the software uses weak encryption at rest (encryption that protects data when it's not being actively used). The problem stems from using a poor key derivation mechanism, which is the process that converts a password into the actual encryption key.
IBM Langflow OSS (an open-source AI framework) versions 1.0.0 through 1.10.0 has a vulnerability that lets authenticated users (those with login access) run arbitrary OS commands (any instructions on the computer's operating system) and access sensitive files like credentials, potentially compromising the entire system and allowing attackers to move to other connected systems. This is classified as a code injection flaw (CVE-2026-7873), where attackers can trick the application into executing malicious code.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 have a security flaw where users who can access Redis (a data storage system) can execute arbitrary code (run commands they shouldn't be able to run) with full control over the application, potentially exposing all stored secrets, data, and system integrity.
IBM Langflow OSS (an open-source tool for building AI workflows) versions 1.0.0 through 1.10.0 has a security flaw where it doesn't properly check the data in flow nodes (building blocks of a workflow) when their component type fields are missing or empty, which could allow an attacker to run arbitrary code (any commands they want) on the system. The vulnerability is caused by improper input validation (failing to check whether incoming data is safe and correct before using it).
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.9.6 has a security flaw where attackers without login credentials can access protected project resources and perform operations through the Streamable MCP (model context protocol, a system for AI tools to communicate) transport endpoint because the software fails to properly check user permissions. This vulnerability affects the authorization layer, meaning the system doesn't adequately verify who is allowed to do what.
IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 have a critical security flaw where three code components (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) lack proper filtering when deserializing untrusted data, allowing attackers to execute arbitrary code (RCE, remote code execution) on the system. An attacker with login access or network proximity to the system's replication communication can exploit this vulnerability through specially crafted Java object chains.
IBM Langflow OSS versions 1.0.0 through 1.9.6 have a Server-Side Request Forgery vulnerability (SSRF, where an attacker tricks a server into making requests to unintended targets) in two components that make unvalidated HTTP requests to user-controlled URLs. An authenticated attacker can exploit this to access internal resources like cloud metadata services (systems that store sensitive configuration and credentials for AWS, Azure, or GCP) and potentially steal credentials or map internal networks, or trigger the attack through prompt injection (tricking an AI by hiding malicious instructions in its input) in agentic workflows.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.9.6 have a missing authentication vulnerability in the /api/v1/build_public_tmp/ endpoints, which allows attackers without credentials to read build event data or cancel jobs if they know the job identifier, leading to information disclosure (unauthorized data access) and denial of service (disrupting service availability). This vulnerability is caused by improper authentication (CWE-287, a weakness in verifying user identity).
IBM Langflow OSS versions 1.0.0 through 1.9.3 contain a Server-Side Request Forgery vulnerability (SSRF, a flaw where an attacker tricks a server into making requests to unintended locations) in the URL component. The vulnerability is caused by a TOCTOU race condition (a timing bug where a system checks something at one moment but uses it at another, allowing attackers to change it in between), which attackers can exploit through DNS rebinding (a technique where an attacker changes what a domain name points to after the server checks it).
IBM Langflow OSS versions 1.0.0 through 1.10.0 have a vulnerability in voice mode where API client credentials are improperly shared across different tenants (separate user accounts or organizations). An authenticated attacker can manipulate cached data to make requests from other users run under wrong API credentials, leading to incorrect billing charges and misattribution of actions to the wrong user.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.9.3 has a critical vulnerability that lets attackers read sensitive secrets (like passwords or API keys), modify flows (the workflows that connect AI components together), access the database, connect to internal systems, and create persistent backdoors by injecting malicious code into public flows.
IBM Langflow OSS versions 1.0.0 through 1.9.3 have a vulnerability where attackers can bypass SSRF protection (a security feature that prevents the server from making requests to internal systems). An authenticated user with basic permissions can enable a follow_redirects setting and use a public URL that redirects to internal addresses, allowing them to access sensitive internal services and data that should be blocked.
This is a film review of 'Citizen Vigilante,' not an AI/LLM-related item. The article critiques a low-budget action film starring Armie Hammer that depicts violent vigilante justice against Muslim characters and 'woke' targets in Zagreb, and notes the film was promoted online by Elon Musk.
Google announced two new AI models: Nano Banana 2 Lite, a fast and cheap image generation model that produces images in 4 seconds, and Gemini Omni Flash, a model for video generation and editing. These models are designed to help developers quickly experiment with and scale creative projects involving images and videos.
This research review examines how the metaverse (immersive virtual environments powered by AR, VR, and AI) is changing digital marketing while creating ethical concerns around privacy, transparency, authenticity, and fairness. The authors analyzed 50 academic reviews and found that addressing these ethical challenges requires coordination between marketers, platform companies, policymakers, and users.
Modern AI systems can now automatically discover software vulnerabilities and create working attacks, making the time between when a vulnerability is discovered and when it's exploited much shorter. Container base images (the foundational software packages that applications run on top of) are a major security risk, accounting for 39% of critical vulnerabilities in production containers. The source recommends using hardened, minimal base images that are continuously patched to reduce the amount of vulnerable code in your systems.
Fix: According to the source, WizOS container images provide hardened, continuously patched base images with SLAs (service level agreements, or guaranteed timelines) for patching: 7 days for critical CVEs and 14 days for high and medium severity ones. Organizations can adopt WizOS by setting up a pull-through cache or mirroring pipeline from the WizOS container registry to their own private artifact registry, then updating their manifest to reference new patched versions or triggering their CI pipeline daily to automate the process. WizOS also maintains a secured package repository allowing developers to customize images while maintaining security, builds images directly from source code in a hardened pipeline with strict security controls, and signs every daily build with cryptographic provenance for verification.
Wiz Research BlogMicrosoft researchers discovered that attackers can poison tool descriptions in MCP (Model Context Protocol, an open system that lets AI agents call outside tools) to trick AI agents into leaking company data without breaking any rules. The attack works by hiding malicious instructions inside the plain-text description of a tool, so when an agent reads the description to decide what to do, it follows the hidden orders along with legitimate ones, making the data theft look like normal activity.
Fix: Microsoft recommends: (1) Treat every connected tool as part of your supply chain and keep a list of approved tool publishers, turning off "allow all" and letting an agent use only specific tools it needs. (2) Treat a tool's description like a system prompt by reviewing changes to it the way you would review a code change and scanning the text for commands that have no business sitting in a help field. (3) Put a human in front of risky actions, particularly anything that moves money or shares data.
The Hacker NewsThe Trump administration's restrictions on U.S. AI companies like Anthropic and OpenAI are slowing their development, while Chinese AI companies like Zhipu are rapidly closing the gap with competitive models that cost less to run. According to researchers and industry experts, Zhipu's GLM 5.2 model now matches or beats some top U.S. AI models on certain benchmarks, suggesting that export controls intended to protect American AI leadership may inadvertently be helping China catch up.
As AI agents expand from simply reading and summarizing content to taking real-world actions like sending emails or updating records, they become targets for a new type of attack called MCP tool poisoning (where attackers modify the instructions embedded in tool descriptions to trick agents into unintended actions). Microsoft describes how attackers can silently alter the natural-language metadata that tells an agent how to use a tool, and if configuration doesn't require re-approval when descriptions change, the poisoned instructions go live in production without detection.