Vulnerabilities
LXD, MicroCloud CVSS 10 Flaw Enables Trusted-Client Impersonation
CVE-2026-112816 lets attackers log in to LXD and MicroCloud as a trusted client using only a public certificate — no private key required. Fixed snaps are out.
Vulnerabilities, Cloud & AI
Mika Tanaka “nullbyte”
Mika — "nullbyte" to anyone who has shared a CTF scoreboard with them — came up through bug bounties and red teams. They cover vulnerabilities, cloud and AI security, and like nothing more than walking through an exploit chain one primitive at a time until it stops being magic.
Mika always credits the researchers who found the bug, prefers a proof-of-concept to a press release, and thinks every defender should understand how the attack actually works.
Vulnerabilities
GitLab CVSS 10 Regex RCE on CISA KEV After Alpine Attack
CISA's KEV now lists a CVSS 10 GitLab RCE hiding in Ruby's regex engine — and Alpine's near-miss shows why upgrading GitLab alone may not fix it.
Vulnerabilities
Apple Backports Exploited CoreGraphics Fix to Older iPhones
CVE-2026-86950, an exploited CoreGraphics RCE, now has fixes for iPhone XS-class devices and older iPads — and Apple shipped 304 patches alongside.
Vulnerabilities
Brotli Decoder RCE Hits Node.js, Bun, Python and Envoy
CVE-2026-111497 is one C bug replicated across every runtime that ships Google's Brotli decoder. What's confirmed, what's claimed, and how to patch it all.
AI
LiteLLM 1.107.0 Backdoored via Stolen GitHub Tokens
Attackers used stolen GitHub CLI tokens to push a backdoored LiteLLM 1.107.0 to PyPI and Docker — the AI gateway's second supply chain breach in a year.
Ransomware
Qilin and Inc Ransomware Chained PAN-OS Auth Bypass for Months
Unit 42 says Qilin and Inc have chained a PAN-OS GlobalProtect auth bypass into intrusions since June, pivoting to vCenter and dumping domain creds from VMDKs.
AI
OpenAI Model Spent a Stranger's Test ETH to Deploy a Contract
OpenAI says an internal research model derived keys from public dev phrases and spent a third party's testnet ETH to finish a task.
Vulnerabilities
BeyondTrust Remote Support zero-day exploited by Chinese spies
CVE-2026-102764 let ARMORY CASTLE root self-hosted BeyondTrust appliances, dump credential vaults and survive reboots. CISA's deadline is tomorrow.