Latest news
-
Vulnerabilities via oss-security
CVE-2026-94114: Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser
Posted by Gary D. Gregory on Oct 06 Severity: important CVSS 3.1: 5.9 (medium) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS 4.0: 8.2 (high)…
-
Vulnerabilities via Help Net Security
Even with OT network visibility, critical infrastructure operators struggle with legacy equipment
Large critical infrastructure operators run seven separate security tools on average, and most still cannot see every asset on their operational technology (OT)…
-
Vulnerabilities via oss-security
CVE-2026-12405: Foreman Remote Execution: command injection via effective_user (fixed in 16.6.6, 17.2.2, 18.0.1)
Posted by Ondrej Gajdusek on Oct 06 Hi, A security fix has been released in Foreman Remote Execution, an open-source plugin for Foreman, an open-source lifecycle…
-
AI Security via Simon Willison
Quoting Jake Boggan
I was a graph theory junkie long ago and even moved to Budapest for awhile to study among the greats. While I was there I started working on Barnette's Conjecture which…
-
Vulnerabilities via oss-security
CVE-2026-12423: Foreman: provisioning token validation flaw (fixed in 3.19.2, 5.0.1)
Posted by Ondrej Gajdusek on Oct 06 Hi, A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers…
-
Vulnerabilities via oss-security
CVE-2026-12540: Foreman: command injection in foreman-rake errors:fetch_log (fixed in 3.19.2, 5.0.1)
Posted by Ondrej Gajdusek on Oct 06 Hi, A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers…
-
AI Security via Help Net Security
Automation, AI agents or people? Sorting out who handles each security finding
Just over half of the 200 senior security and technology leaders polled for ArmorCode say their organizations will struggle to simplify their software security programs…
-
AI Security via arXiv cs.CR
DIBench: Benchmarking Decision Integrity of GUI-based Mobile Agents Under Deceptive Injections
arXiv:2610.06898v1 Announce Type: new Abstract: As GUI-based mobile agents rapidly progress, rigorous safety evaluation of their autonomous decision-making in realistic…
- Advertisement
-
AI Security via arXiv cs.CR
APEX: Active Protection at Execution Boundaries for LLM Agents
arXiv:2610.06966v1 Announce Type: new Abstract: Indirect prompt injection (IPI) hides adversarial instructions in content that large language model (LLM) agents read at…
-
Threat Intel via arXiv cs.CR
TARE: Weigh a Never-Poisoned Twin Before Reading Backdoor-Defense Costs
arXiv:2610.06994v1 Announce Type: new Abstract: Backdoor-defense leaderboards print a clean-accuracy drop and read it as removal cost.
-
AI Security via arXiv cs.CR
Which Image Property Carries the Jailbreak? A Controlled Dissection of Image-to-Text Jailbreaks
arXiv:2610.07009v1 Announce Type: new Abstract: Image-to-text jailbreaks place harmful intent in text, image content, or the relationship between them. We examine…
-
AI Security via arXiv cs.CR
Towards a Unified Misuse Monitoring Benchmark
arXiv:2610.07089v1 Announce Type: new Abstract: LLM agents increasingly act in multi-actor environments, exposing them to misuse from multiple sources: decomposition…
-
AI Security via arXiv cs.CR
Jailbreaking Open-Weight LLMs via Random Embedding Perturbations
arXiv:2610.07125v1 Announce Type: new Abstract: While open-weight models have enjoyed steady progress in capabilities and wide adoption across multiple domains, their…
-
AI Security via arXiv cs.CR
Efficient Auditing of Adversarial AI Agent Behavior from Agent Traces
arXiv:2610.07256v1 Announce Type: new Abstract: AI agents powered by large language models (LLMs) can perform complex tasks but may harm the systems they operate in…
-
AI Security via arXiv cs.CR
Lineage-Aware Memory Governance: A Derivation-Gated Framework for Privacy-Preserving Column-Level Access Control in Enterprise AI Agents
arXiv:2610.07258v1 Announce Type: new Abstract: Enterprise AI agents that share a memory store face two unaddressed risks: sensitive data can leak through legitimately…
-
Threat Intel via arXiv cs.CR
A Resilient Runtime-Verification Fabric for Security Monitoring of Critical Edge-IoT Infrastructure
arXiv:2610.07282v1 Announce Type: new Abstract: Protecting critical infrastructure increasingly depends on continuously verifying large IoT fleets against formal…
-
AI Security via arXiv cs.CR
Polar: LLM-Powered Synthesis of Real-World Cyber Evidence for Prioritization and Mitigation
arXiv:2610.07298v1 Announce Type: new Abstract: Cyber threat analysis increasingly depends on evidence distributed across vendor advisories, vulnerability databases, and…
-
Threat Intel via arXiv cs.CR
From Sandbox to Enforcement: Confidence-Qualified Threat Intelligence for Critical Infrastructure
arXiv:2610.07310v1 Announce Type: new Abstract: Security operations centres and national incident-response teams defending critical infrastructure collect abundant…
-
AI Security via arXiv cs.CR
Evaluating Behavioral Context for Interpretable IAM Policy Risk Scoring in Cloud Environments
arXiv:2610.07345v1 Announce Type: new Abstract: IAM policy analysis typically emphasizes the authorization capabilities encoded in a policy, but security analyst review…
-
AI Security via arXiv cs.CR
Simple Extremely Lossy Functions from Small-Exponent Hashing
arXiv:2610.07351v1 Announce Type: new Abstract: Extremely Lossy Functions (ELFs) are a standard model primitive that captures many useful properties of random oracles…