Do Son Microsoft warns of critical flaw CVE-2026-25592 (CVSS 10.0) in Semantic Kernel SDK. AI agents can overwrite system files. Update to v1.70.0 now.
AI security
Critical vLLM bug CVE-2026-22778 (CVSS 9.8) lets attackers hijack servers using malicious videos. Affects video model deployments. Patch to v0.14.1 now.
VirusTotal warns of massive supply chain attack on OpenClaw. Hackers use fake "skills" to deploy malware like Atomic Stealer. Verify your agents.
PyTorch patches CVE-2026-24747 (CVSS 8.8). The "weights_only" safety flag failed, allowing RCE via malicious models. Update to v2.10.0 now.
New Android anti-theft updates use AI to detect "snatch-and-run" theft and instantly lock your screen. Identity Check adds biometric layers to stop thieves.
A critical flaw in Clawdbot’s auth logic allows hackers to bypass security via reverse proxies. Over 1,000 instances are already exposed—is yours one of them?
Researchers found a flaw in Google Gemini allowing "Indirect Prompt Injection" via calendar invites to steal private meeting data. The issue is now mitigated.
NVIDIA fixes high-severity code injection flaws in Nsight Graphics and Merlin (CVE-2025-33206/33). Update to v2025.5 immediately to prevent compromise.
Microsoft patches "Reprompt," a critical Copilot flaw. Attackers could steal sensitive data with just one click on a legitimate link.
Critical OpenCode flaws (CVE-2026-22813) allow drive-by RCE via malicious sites. Update to v1.0.216 immediately to stop unauthorized command execution.
Critical ServiceNow AI flaw (CVE-2025-12420) allows unauthenticated user impersonation. Self-hosted users: update Now Assist & Virtual Agent immediately.
CVE-2025-67732 unmasks a high-severity flaw in Dify that exposes plaintext API keys to frontend users. Upgrade to v1.11.0 to secure your AI quotas.
OpenAI patches a new class of prompt injection in ChatGPT Atlas. See how the Agent mode is being hardened against hidden hijacks on the open web.
NVIDIA patches critical 9.8 severity flaws in Isaac Launchable (CVE-2025-33222) that allow RCE via hard-coded credentials. Upgrade to v1.1 now!
A High-severity flaw (CVE-2025-63387) in Dify v1.9.1 allows unauthenticated users to access sensitive system configurations via an unprotected API.
NVIDIA issued a Critical (CVSS 9.0) patch for Isaac Lab and the NeMo Framework, fixing flaws that allow code execution and data tampering in AI models.
NVIDIA patched two high-severity DoS flaws in Triton Inference Server (CVE-2025-33211, CVE-2025-33201). Attackers can crash the server by sending malformed or excessively large payloads. Update to r25.10 immediately.
Bitsight TRACE exposes a massive calendar phishing network targeting 4M+ devices. Learn how "Promptware" exploits AI assistants via malicious calendar events.
Critical Ray AI flaw (CVE-2025-62593) allows RCE via DNS rebinding on Safari & Firefox. Chrome is immune. Update to Ray v2.52.0 immediately.
NVIDIA patches 14 flaws in DGX Spark, including a critical SROOT bug (CVSS 9.3) allowing total system takeover. Update to OTA0 immediately.
NVIDIA patched two High-severity flaws in its NeMo Framework. CVE-2025-23361 and CVE-2025-33178 allow local code injection and privilege escalation in AI training environments. Update to v2.5.0.
A Critical (CVSS 9.3) Auth Bypass flaw (CVE-2025-64513) in Milvus Proxy allows unauthenticated attackers to gain full administrative control over the vector database cluster. Update to v2.6.5.