All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
A vulnerability in Firebase Studio (Google's backend service for building apps) allowed authenticated users to access and download source code and list storage buckets belonging to other users' projects. The vulnerability has already been fixed and deployed to the backend service.
Fix: No action is required as the fix has been deployed. As a precautionary measure, users who stored sensitive information such as API keys (secret codes that grant access to services) in their Firebase Studio workspace may choose to rotate these keys by following instructions in the Firebase Studio troubleshooting guide.
Google Cloud Security BulletinsThe article explains that while casual prompt testing (trying unusual inputs to see if an AI refuses them) is accessible to anyone, it is insufficient for enterprise AI systems. Enterprise AI is more complex because it includes policies, retrieval pipelines (systems that fetch information from databases), APIs (interfaces allowing programs to communicate), tools, permissions, workflows, and data sources, requiring more rigorous testing approaches.
Warp is an agentic development environment (a tool that helps developers write code with AI assistance) that contained a command injection vulnerability (a flaw where specially crafted input can trick a system into running unintended commands) in its branch selector feature. An attacker who could publish a malicious Git branch name to a repository could cause that branch name to be executed as a shell command (instructions sent directly to the operating system) when a victim selected it from Warp's user interface.
Docling is a tool that converts documents in different formats and connects them with AI systems. Between versions 2.73.0 and 2.91.0, it had a security flaw in how it processed LaTeX files (a document formatting language), where attackers could use path traversal (a technique to access files outside intended directories) to read sensitive files like credentials or configuration data from a system.
Docling is a tool that reads different document formats and connects them to AI systems. Versions 2.13.0 through 2.74.0 had a security flaw in how they read USPTO patent XML files (XML, a format for storing structured data): they didn't protect against XXE attacks (XML External Entity attacks, where specially crafted files trick the parser into reading files from the server or making unwanted network requests). An attacker could use this flaw to steal files, perform SSRF attacks (server-side request forgery, making the server request data it shouldn't), or crash the system.
Docling is a tool that processes documents in different formats and connects with AI systems. Before version 2.91.0, it had a security flaw where it downloaded AI models (EasyOCR) and extracted compressed files (ZIP archives) without checking if the file paths were safe, allowing a Zip Slip attack (a technique where specially crafted archive files extract to unintended locations). If an attacker could intercept or compromise the model download, they could write malicious files anywhere on the system, potentially taking complete control of it.
Docling is a tool that processes different document formats and connects them to AI systems. In versions 2.82.0 through 2.90.0, if HTML rendering was turned on, an attacker could create malicious HTML documents that run unauthorized JavaScript code or access internal network services, potentially leading to SSRF attacks (where the server makes unintended requests to internal systems), data theft, or RCE (remote code execution, where attackers run commands on a system they don't own).
This article discusses Broadcom's stock performance and mentions a new AI chip called Jalapeno that was co-designed with OpenAI. The article suggests this chip development could be a significant business opportunity for Broadcom.
Two members of Scattered Spider, a cybercrime collective, were convicted for attacking Transport for London's network in September 2024, which disrupted services, exposed personal data of 10 million people, and caused £29 million in damages. Thalha Jubair and Owen Flowers used social engineering and help-desk impersonation tactics to compromise TfL systems. The group is known for targeting IT support providers to bypass multi-factor authentication (security that requires multiple verification methods) and gain unauthorized access to networks.
A $27 million political campaign between AI companies Anthropic and OpenAI, fought through a super PAC (a political organization that can raise unlimited funds), ended without a clear winner when Alex Bores, a New York politician who had authored AI safety legislation, narrowly lost a Democratic primary election. Bores had previously passed the RAISE Act, which added safety requirements for advanced AI companies, but this legislation upset the pro-AI super PAC that opposed him.
A memory leak (wasted memory that isn't returned to the system) was found in the Linux kernel's amd-pstate driver, specifically in the amd_pstate_epp_cpu_init() function. When the function fails to set the epp (energy performance preference, a CPU power setting), it exits without freeing the cpudata object (a block of memory storing CPU information) that was created at the start.
A bug in the Linux kernel's dm cache (device mapper cache, a storage layer that speeds up disk access) caused write operations to hang when the cache was in passthrough mode (a mode where the cache temporarily stops caching data). The problem occurred because the invalidate_remove() function wasn't properly handling write requests after cache data was cleared, causing these requests to be dropped instead of completed.
A crafted filesystem can crash the Linux kernel's OCFS2 file system driver when a user runs a specific diagnostic command (OCFS2_IOC_INFO with OCFS2_INFO_FL_NON_COHERENT flag), causing it to read memory beyond a data structure's boundaries. The bug happens because the code trusts an on-disk value (bg_bits, a bitmap size field) without validating it first, unlike the safer code path that does validate this value.
A data loss vulnerability exists in the Linux kernel's f2fs (flash-friendly filesystem) when fsync (a command that forces data to be written to disk) is performed on a newly created file at the same time as a checkpoint (a periodic save of filesystem state) is running. The bug occurs because the system incorrectly assumes a checkpoint has finished based on certain flags (IS_CHECKPOINTED and HAS_LAST_FSYNC) before the checkpoint actually completes, causing the new file's data to be lost.
A use-after-free vulnerability (UAF, where code tries to access memory that has already been freed) was found in the Linux kernel's rtl8150 USB network driver in the rtl8150_start_xmit() function. The bug occurred because the code was reading skb->len (a data packet's length) after the packet had already been freed by the USB completion handler on another CPU, causing a memory safety violation.
A vulnerability in the Linux kernel's futex (fast userspace mutex, a synchronization mechanism for threads) system was found where the code incorrectly required CLONE_THREAD (a flag that clones thread properties) when allocating hash tables, causing memory safety bugs when processes shared memory in other ways. The fix loosens this requirement to allow any CLONE_VM clone (memory sharing between processes) except vfork() (a process creation method), which prevents the memory corruption issue while avoiding unnecessary overhead.
OpenClaw, an AI skills marketplace called ClawHub, discovered and removed five malicious packages that had bypassed security checks despite containing infostealers (malware that steals information like passwords and data). This incident demonstrates that threats can slip through marketplace defenses and compromise the AI supply chain (the network of tools and components used to build AI systems).
Figma announced new AI-powered design features at its Config conference, including AI-generated motion graphics (animations created by describing them to an AI chatbot) and coding layers that let developers edit code without leaving the design canvas. These updates aim to help creative teams automate repetitive tasks and work more efficiently in one integrated workspace.
Fix: This vulnerability is fixed in version 0.2026.05.06.15.42.stable_01. Users should update Warp to this version or later.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 2.91.0.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 2.74.0.
NVD/CVE DatabaseFix: Update to Docling version 2.91.0 or later. The vulnerability is fixed in 2.91.0.
NVD/CVE DatabaseFix: Upgrade to version 2.91.0, where the vulnerability is fixed.
NVD/CVE DatabaseAI agents that can autonomously access websites, emails, and files are vulnerable to 'traps' - maliciously designed information that tricks them into wrong actions. These traps include content injection (hiding malicious instructions in webpage code or metadata), semantic manipulation (using repetition and emotional language to guide decisions), and cognitive state attacks (poisoning databases that agents rely on for memory), with research showing such attacks succeed 57-90% of the time depending on the type.
Fix: Ensure that the cpudata object is freed before returning from the function.
NVD/CVE DatabaseFix: The fix adds a new invalidate_committed() continuation function that submits remapped writes to the cache origin after metadata commit completes, while using the overwrite_endio hook to ensure proper completion sequencing. Additionally, error handling in invalidate_complete() was improved to preserve the original error status instead of unconditionally using bio_io_error().
NVD/CVE DatabaseFix: Compute the bitmap capacity from the filesystem format with ocfs2_group_bitmap_size(), report descriptors whose bg_bits exceeds that limit, and clamp the scan to the computed capacity.
NVD/CVE DatabaseFix: This patch modifies f2fs_need_inode_block_update() to acquire the sbi->node_write lock before reading the nat_entry flags, ensuring that once IS_CHECKPOINTED and HAS_LAST_FSYNC are observed to be set, the checkpoint operation has already completed.
NVD/CVE DatabaseFix: Fix it by caching skb->len before submitting the URB (USB Request Block, a request to send data over USB) and using the cached value when updating the tx_bytes counter instead of reading skb->len after the URB submission.
NVD/CVE DatabaseFix: Loosen the check to cover any CLONE_VM clone, except vfork(). Excluding vfork keeps the existing paths untouched (no overhead), and the vulnerability cannot occur because either the parent is suspended and the child runs alone, or mm->futex_ref is already allocated from an earlier CLONE_VM.
NVD/CVE DatabaseGoogle has added computer use, a capability that allows AI agents to see and interact with computer screens to perform tasks, directly into Gemini 3.5 Flash (an AI model). This feature enables developers to build agents that can automate work across browsers, phones, and desktops, such as testing software or handling business tasks.
Fix: To mitigate prompt injection risks (attacks where malicious instructions are hidden in user inputs), Google uses targeted adversarial training for computer use in Gemini 3.5 Flash. The company also released two optional enterprise safeguard systems: one that requires explicit user confirmation for sensitive or irreversible actions, and another that automatically stops tasks if an indirect prompt injection is identified. The source recommends combining these features with secure sandboxing, human-in-the-loop verification (having humans review AI decisions), and strict access controls.
DeepMind Safety Research