All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
Oracle released 245 security patches addressing vulnerabilities across multiple products like PeopleSoft, Fusion Middleware, and MySQL, all rated high-priority. The most concerning flaws are those that allow remote code execution (running commands on a system without owning it) without requiring authentication (login credentials), particularly in widely-used components like WebLogic Server and Oracle Coherence that other systems depend on.
AutoJack is an exploit that lets a malicious webpage take over an AI browsing agent (a system that can visit websites on your behalf) and run arbitrary commands on the host machine where the agent runs. The attack works by exploiting three weaknesses: trust in localhost (the local computer itself), missing authentication checks, and unsafe handling of user inputs, which allow attackers to trigger code execution through AutoGen Studio's MCP WebSocket (a communication protocol that connects different AI components). This research shows that when AI agents can visit untrusted websites and connect to local services, normal security boundaries break down.
AgenticMail has a security flaw where unauthenticated external emails can trigger a privileged Claude Code session with `permissionMode: 'bypassPermissions'` (a mode that removes safety restrictions). The email's sender address, subject, and preview are embedded directly into the AI's prompt without verification that the sender is the actual operator, allowing prompt injection (tricking the AI by hiding instructions in its input) that could lead to arbitrary code execution and file access under the operator's identity. A similar handler in the same codebase properly authenticates the sender, but the bridge-wake path does not.
OpenAI introduced new usage analytics and spend controls for ChatGPT Enterprise, allowing company administrators to track how AI credits (a unit of payment for AI usage) are being used across their organization. The Global Admin Console now shows detailed breakdowns of credit consumption by user, product, and model, while updated spend controls let admins set credit limits for teams and individual employees, helping organizations manage AI costs and deployment more effectively.
Companies are leaving AI agents (automated tools that run independently) active even after employees who created them leave, giving these tools permanent access to sensitive data and code without proper oversight. Traditional security tools miss this risk because they monitor AI like regular software and don't know which human authorized each AI action, making it hard to track whether an AI's data access is legitimate. The article describes this as a significant security problem but focuses mainly on identifying where these orphaned agents exist rather than fixing them.
This bulletin covers multiple cybersecurity threats including malicious browser extensions that hijack search results and route them through hidden monetization layers, a fileless macOS attack using fake system dialogs to steal credentials, and threat actors abusing Claude's legitimate chat-sharing feature to deliver malware. The common theme is attackers exploiting user trust in legitimate tools and services to conduct fraud, steal data, and distribute malware.
Pipecat's development runner has an unauthenticated WebSocket endpoint (`/ws`) that accepts telephony connections without verifying who is connecting. An attacker can send a fake Twilio handshake message with a call ID they choose, and the server will use its own Twilio credentials to hang up that call, potentially terminating calls on the victim's account. The same vulnerability exists for Telnyx and Plivo telephony providers.
The githubreceiver component in opentelemetry-collector-contrib has a security flaw where it validates the `required_headers` configuration at startup but never actually checks these headers on incoming webhook requests. This means an attacker can send fake data to the webhook endpoint by bypassing the authentication headers that operators thought were protecting it, especially when the `secret` field is left empty (which skips HMAC validation entirely).
The Sentry exporter in opentelemetry-collector-contrib has a path traversal vulnerability (a type of attack where an attacker manipulates file paths to access unintended locations) because it builds Sentry API URLs by directly inserting the service.name attribute, which remote attackers can control, without checking if it's valid. Since the operator's bearer token (a credential that proves the operator's identity) is automatically added to every request, an attacker can craft a malicious service.name to reach privileged Sentry admin and organization endpoints that they shouldn't have access to.
PraisonAI's search tools contain a Server-Side Request Forgery (SSRF) vulnerability, where an attacker can trick the AI into making HTTP requests to arbitrary internal URLs by controlling the `searxng_url` parameter. Because this parameter is exposed to the language model as a tool option and search tools are enabled by default, an attacker can inject malicious instructions through web pages or files to make the server access internal services, read sensitive data, or in cloud environments reach the instance metadata endpoint (169.254.169.254) to potentially steal credentials.
The `multiedit` tool in PraisonAI allows an AI agent to read and write any file on the system without checking file paths or boundaries, because it passes the filepath directly to the `open()` function without validation. An attacker who can control what the agent does, such as through crafted prompts or malicious workflow configurations, could steal sensitive files like SSH keys and credentials, or overwrite important files to take control of the system.
The US government imposed export controls on Anthropic's Fable 5 AI model and its underlying Mythos model, restricting access even for foreign nationals working at Anthropic in the US. Anthropic then took both models offline because the company said it couldn't reasonably comply with the restrictions while keeping the models publicly available. This incident raises broader questions about how the US government should regulate AI and whether its approach will be a genuine safety framework or a political tool.
California expects a major tax windfall from upcoming IPOs of tech companies like SpaceX, OpenAI, and Anthropic, but the actual revenue may be lower than previous tech IPOs because modern employees have access to tax-reduction strategies (like donating pre-IPO stock to donor-advised funds, which are charitable giving accounts) and because these companies structure their stock compensation differently than older tech firms did.
Fix: The source describes features already implemented rather than a fix for a problem. The solution is the new Global Admin Console, which provides credit usage analytics and granular spend controls, allowing admins to track usage by user/product/model, set default workspace limits, configure limits for specific groups, create individual overrides, and enable employees to request additional credits with context for admin review.
OpenAI BlogFix: Microsoft has announced that DNS-over-HTTPS (DoH, encrypted DNS queries sent as HTTPS requests) is now generally available on Windows Server 2025, allowing organizations to 'deploy encrypted and authenticated client-to-resolver DNS traffic directly within their existing on-premises DNS infrastructure' to help improve privacy, reduce spoofing risk, and advance Zero Trust DNS (a security model that verifies every access request rather than trusting the network by default) without requiring a new resolver architecture.
The Hacker NewsFix: Add RequiredHeaders enforcement to `handleReq()` in `receiver/githubreceiver/trace_receiver.go`, matching the pattern used in gitlabreceiver at `receiver/gitlabreceiver/traces_receiver.go:266-270`, which validates each required header by checking if the incoming request's header value matches the configured value.
GitHub Advisory DatabaseRetrieval-augmented generation (RAG, a technique where AI systems pull in external documents to answer questions) enhances large language models but introduces a new security risk: external data extraction attacks (EDEAs), where attackers can trick the system into revealing sensitive or copyrighted information from its knowledge base. Researchers developed an attack called Secret that uses AI-optimized prompts and adaptive strategies to extract data from RAG systems, successfully extracting data from commercial models where previous attacks failed.
This research paper proposes a post-quantum secure semantic communication (PQSC) framework that protects data transmission against both eavesdropping and future quantum computing threats. The framework combines learning with errors (LWE, a type of encryption believed to resist quantum attacks) with VQ-VAE (a neural network compression technique) to send information efficiently while keeping it secure. Experiments show this approach works better than existing methods across different network conditions and data types.
This paper addresses security weaknesses in unified frameworks for private set operations (PSO, which are techniques that let multiple parties perform computations on their private data sets without revealing the data itself). Previous frameworks had vulnerabilities to inference attacks because they leaked information about the size of set intersections during operations like union and intersection-sum. The authors propose an improved unified framework that eliminates these leakages by introducing a new building block called permuted batched private membership test sharing, achieving stronger security with acceptable performance trade-offs.
Fix: The source proposes a new unified framework with stronger security that: (1) supports PSI-Sum/SS without cardinality leakage (removing information leaks about set sizes), (2) includes an enhanced PSU without during-execution leakage (preventing attackers from gaining information while the operation runs), and (3) uses a new central building block called permuted batched private membership test sharing with instantiation alternatives for both balanced and unbalanced scenarios. The paper provides experimental results showing PSI-Sum/SS achieves 0% leakages with performance costs of approximately 3.3x higher communication for balanced sets and less than 2x overhead for unbalanced sets, while the enhanced PSU achieves up to 1.6x to 60.5x lower communication and 1.4x to 15.6x faster execution compared to prior work.
IEEE Xplore (Security & AI Journals)This research proposes GCLC (Graph-based Contrastive Learning and Clustering), a framework for classifying encrypted network traffic (data sent over networks in coded form) in open-world scenarios where unknown traffic types may appear. The system uses Graph Neural Networks (machine learning models that work with interconnected data) and special learning techniques to identify traffic patterns even when data is imbalanced or new, achieving 95% accuracy at recognizing previously unseen traffic classes.
PUFs (Physical Unclonable Functions, hardware devices that generate unique digital fingerprints) are vulnerable to machine learning attacks that can predict their responses if attackers obtain leaked challenge-response pairs (CRPs, inputs and outputs used to test PUFs). This paper presents the TEASE algorithm, which selects CRPs more strategically instead of randomly so that even if attackers leak them, the algorithm forces machine learning models to achieve only about 50% accuracy, comparable to random guessing, while resisting multiple rounds of leaks and powerful attacks.
Fix: The TEASE algorithm addresses the vulnerability by using bilevel programming (an optimization technique that optimizes one problem while considering another problem inside it) to carefully select which challenge-response pairs to allow in circulation. According to the source, TEASE 'forces ML attacks to be content with a prediction accuracy of around 50% on non-leaked CRPs, comparable to random guessing' and 'can gracefully tolerate multiple rounds of CRP leaks' while maintaining 'lower hardware overhead than existing countermeasures.'
IEEE Xplore (Security & AI Journals)TabHGIF is a framework for machine unlearning (removing a model's memory of specific training data) on tabular data, which is faster than retraining from scratch but traditionally struggles to preserve both privacy and model accuracy. The method represents tabular data as a hypergraph (a graph structure that captures relationships between multiple features at once) and uses a Hypergraph Influence Function to predict how deleting data will affect the model without needing to access the original data again. In experiments, TabHGIF achieved speedups of 2.18–7.67 times compared to full retraining while maintaining accuracy close to a fully retrained model.
Backdoor attacks compromise AI models by injecting hidden triggers into training data that cause the model to misclassify inputs containing those triggers. This paper introduces Double-Blind Cleanser (DBC), a method that removes backdoors without needing access to clean data or knowing what the triggers look like, using two techniques: catastrophic forgetting (making the model forget the backdoor behavior) and Sharpness-Aware Minimization (SAM, which smooths the model's decision boundaries to restore normal functionality).
Fix: The paper describes DBC's approach: "It first leverages catastrophic forgetting to eliminate the backdoor behavior. It then applies Sharpness-Aware Minimization (SAM) to flatten the loss landscape, improving generalization and restoring legitimate functionality without requiring prior knowledge of triggers or poisoned samples. To further enhance the flatness of the loss landscape, DBC employs an importance sampling strategy that prioritizes samples most sensitive to weight perturbations, effectively reducing the impact of poisoned instances."
IEEE Xplore (Security & AI Journals)