All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
This academic paper presents a taxonomy, or classification system, of different economic models used in cybersecurity. Rather than discussing a specific vulnerability or threat, it organizes and categorizes the various ways that security costs, risks, and incentives work in the real world.
Version 0.33 of the llm tool upgraded to OpenAI's Python library version 3.x and changed its HTTP client dependency from httpx to httpx2, providing a more comprehensive fix following a quick 0.32.1 patch. New features include support for the --key parameter in embedding commands, the ability to repeat the --template flag to combine multiple templates together, and a new reasoning_summary option for reasoning-capable response models.
A vulnerability exists in the Linux kernel's fbdev (framebuffer device) subsystem where the bit_cursor() function can read out-of-bounds memory when processing glyph (character) indices. The problem occurs because the function doesn't validate that a character index from the screen buffer is within the current font's available glyphs, which can happen when fonts are switched or when arbitrary values are written to /dev/vcsa (a device file for virtual console access).
A vulnerability in the Linux kernel's IPv6 code allows a freed object to be revived and used after it should have been destroyed. The problem occurs when in6_dev_get() reads a pointer and increments its reference counter (a count of how many parts of the system are using an object), but device shutdown can delete that pointer and drop the last reference between these two steps, causing the object to be resurrected after its memory has been queued for cleanup by RCU (read-copy-update, a synchronization mechanism that defers memory freeing).
The Tutor LMS WordPress plugin before version 4.0.6 has a security flaw where it doesn't check file paths before using them to stream media files, allowing instructors to read any file on the server, including sensitive files like the WordPress configuration file that contains database passwords and authentication keys (secret codes used to verify user sessions).
The Tutor LMS WordPress plugin before version 4.0.6 has a security flaw where it doesn't properly check whether a user owns the content they're trying to access. This means any instructor can read private courses that belong to other instructors, even though they shouldn't have permission to do so.
This article is about neon flying squid, not artificial intelligence or cybersecurity. It describes how researchers photographed a group of about 100 neon flying squid gliding above the Pacific Ocean near Tokyo, the first documented evidence of this behavior. The squid achieve this flight by using the hyponome (a funnel-like muscular organ that shoots water out to propel the body), and they spread their arms as they glide.
Hydra's `instantiate()` function (which constructs objects and calls functions based on configuration files) can execute arbitrary code if an attacker controls the `_target_` field in untrusted config. This means if your application loads config from an untrusted source and passes it to `instantiate()`, an attacker can trick it into running malicious code.
Xinference, an AI deployment tool, has a critical vulnerability where it uses Python's unsafe `eval()` function to parse tool-call output from Llama3 models. An attacker can craft prompts that trick the model into returning malicious Python code, which then gets executed on the server, allowing remote code execution (the ability to run arbitrary commands on a system you don't control) without needing authentication.
Infracost, a tool that calculates cloud costs for engineering teams and AI systems, had a vulnerability before version 0.10.45 where it could accidentally send secret authentication tokens (credentials that prove who you are to Terraform Cloud services) to the wrong server. If an attacker controlled the Terraform configuration files being scanned, they could trick Infracost into sending the token to their own server instead of the legitimate one, allowing them to steal it. This happens in CI/CD pipelines (automated build and deployment systems) when a token is provided during scanning.
Infracost (a tool that calculates cloud costs) had a vulnerability before version 0.10.45 where certain file-reading functions didn't properly handle symlinks (shortcuts that point to other locations). An attacker could create a symlink in a repository that points outside the checked-out code, allowing the tool to read sensitive files that the system running Infracost could access, potentially exposing repository secrets through dashboards or pull request comments.
CRISP is a system designed to help enterprises comply with the Right to Be Forgotten (RTBF, a legal right allowing people to request deletion of their personal data) using permissioned blockchains (distributed ledgers where only authorized participants can access and modify records). The research addresses how organizations can securely delete or remove personal information from blockchain systems while maintaining the integrity and immutability that blockchains are designed to provide.
This academic paper from December 2026 examines the effectiveness of a cybersecurity training program based on threat avoidance theory (a psychological framework that explains how people decide whether to protect themselves from risks). The researchers conducted an experimental evaluation to test whether this theory-based training approach helps people better understand and respond to cybersecurity threats.
This research paper examines how the design of consent interfaces and user cynicism influence the privacy choices people make when interacting with AI systems and software. The study suggests that not all user agreements are equally meaningful, and factors like interface design and user skepticism significantly shape whether people actually protect their privacy or just accept default settings.
This research article examines security issues in BLE (Bluetooth Low Energy, a wireless communication standard used in IoT devices) pairing mechanisms within the context of modern regulations. The study uses BLE pairing as a case study to understand how Internet of Things (IoT) devices establish secure connections and the regulatory frameworks that govern their security.
This academic paper examines CAS (computer-aided services, systems that help automate tasks), particularly in AI contexts, and analyzes what happens when the service providers running these systems act maliciously or cannot be fully trusted. The research provides formal analysis (mathematical proof of security properties) to help organizations understand the risks and design safer deployments when they cannot completely trust the service provider.
PRISM-SE is a framework for measuring and assessing the risk of social engineering attacks (attempts to manipulate people into revealing secrets or performing unsafe actions) in a more accurate way by using non-circular proxies (measurable factors that don't depend on each other in a circular way). The research, published in December 2026, proposes a calibrated approach to better understand and quantify how vulnerable an organization or individual might be to social engineering threats.
This research examines how phishing detectors (AI systems trained to identify fraudulent emails and messages) perform when they encounter new types of attacks generated by generative AI (AI models that create text and content). The study looks at whether these detectors remain reliable and whether humans can understand how they make their decisions when facing AI-generated phishing attempts that differ from their training data.
Fix: Apply a bounds check to clamp the glyph index to vc_font.charcount in the bit_cursor() function, similar to existing checks already implemented in bit_putcs_aligned() and bit_putcs_unaligned(). This involves extracting the attribute and masking the value, then clamping the index before using it to access fontdata. The fix completes bounds checking from commit 18c4ef4e765a and prevents the out-of-bounds read by using index 0 as a fallback when clamping is needed, without affecting cursor behavior.
NVD/CVE DatabaseFix: Use refcount_inc_not_zero() (a function that only increments a reference counter if it is greater than zero) instead of unconditionally incrementing the refcount, and return NULL when the object has already reached zero. This ensures RCU keeps the memory accessible during the reference acquisition attempt, and a successful increment pins the object for the caller.
NVD/CVE DatabaseFix: Update the Tutor LMS WordPress plugin to version 4.0.6 or later.
NVD/CVE DatabaseHollywood creatives, including award-winning writers, directors, and producers, are taking temporary jobs training AI models to perform tasks like screenwriting and production scheduling, earning $12 to $200 per hour. These workers are motivated by a jobs slump and shrinking earnings, though some view the work as helping AI replace their own profession.
Anthropic, an AI company, is preparing to go public (sell shares to the general public for the first time) and will disclose public opposition to AI data centers as a risk factor in its IPO filing. According to a Gallup survey, roughly 70% of Americans oppose building AI data centers in their area, and politicians on both sides are pushing back against data center development, which could slow Anthropic's growth since the company's revenue depends directly on computing power.
Fix: Upgrade to Hydra 1.3.4 or newer, which adds a blacklist of dangerous targets. For applications handling untrusted config, validate `_target_` values against a trusted allowlist (a list of approved values) before calling `instantiate()`. The unreleased Hydra 1.4 uses an allowlist-based model that fully addresses this vulnerability.
GitHub Advisory DatabaseFix: Upgrade to Infracost version 0.10.45 or later, where this issue is fixed.
NVD/CVE DatabaseFix: Update Infracost to version 0.10.45 or later. The issue is fixed in version 0.10.45.
NVD/CVE Database