Do Son Three Tornado security vulnerabilities (CVE-2026-49853, CVE-2026-49855, CVE-2026-49854) risk credential leaks and DoS. Update to Tornado 6.5.6 now.
Credential Leak
Apache Airflow patched two flaws leaking sensitive credentials in the UI. The Moderate bug exposes secrets in DAG tracebacks (kwargs). Also fixed: secrets visible in rendered templates. Update to v3.1.4.
A new Zero-Click NTLM leak bypasses Microsoft's LNK patch, allowing unauthenticated NTLM hash theft on patched systems. The PoC works by exploiting UNC paths and the default shell32.dll icon reference.
Trend Micro discovered that Axis Communications leaked hardcoded Azure SAS tokens in a signed DLL for its Autodesk Revit plugin, exposing three cloud storage accounts to unauthorized access.
A critical flaw (CVE-2025-59951) in the Termix Docker image's reverse proxy logic allows unauthenticated attackers to steal sensitive SSH host credentials. Update to v1.7.0 now.
Open database with 184M leaked credentials found—users urged to change exposed passwords and enable 2FA to protect accounts from future breaches.