Do Son A critical LiteLLM vulnerability (CVSS 10.0) lets an unauthenticated file read leak the master key on Enterprise proxies. Update to 1.106.5 now.
LLM
ReliaQuest details an AI agent attack that used one exposed endpoint and the Cairn platform to achieve a full server takeover in under 24 hours.
Debian's AI policy vote picked "Responsible Use of Generative AI": AI is neither banned nor endorsed, with full accountability left to contributors.
Kimsuky AI operations reveal a North Korea threat actor testing local LLMs. Suspected state hackers are building new capabilities to automate phishing.
Google releases Gemma 4 under the Apache 2.0 license. Featuring multimodal edge models and a 31B "Dense" system, it redefines AI digital sovereignty for 2026.
Anthropic's proprietary Claude Code logic and unreleased features leaked via an npm source map error. Explore the 46,000-line blueprint here.
CVE-2025-67732 unmasks a high-severity flaw in Dify that exposes plaintext API keys to frontend users. Upgrade to v1.11.0 to secure your AI quotas.
A High-severity flaw (CVE-2025-63387) in Dify v1.9.1 allows unauthenticated users to access sensitive system configurations via an unprotected API.
AWS launched the Nova 2 model family (Lite, Pro, Omni) and Nova Act, an agent platform achieving 90% reliability in web-browsing tasks, with Nova Forge for deep customization.
OpenAI released GPT-5.1 Instant/Thinking with "adaptive reasoning" for slower, deeper thinking. It also adds new chat styles like Professional, Candid, and Quirky.
Wikipedia launches a paid API for AI companies to stop web scraping and generate revenue after sophisticated AI crawlers caused an 8% drop in human traffic.
Microsoft revealed "Whisper Leak," a side-channel attack that infers AI chat topics from encrypted traffic (TLS) using packet size/timing patterns. High accuracy risk.
Google Translate rolled out a Gemini-powered "Advanced" mode that sacrifices speed for higher accuracy and contextual fluency. The feature is currently limited to select language pairs like English/French/Spanish.
OpenAI released the GPT-OSS-SafeGuard models under Apache 2.0, enabling developers to apply custom safety policies at inference time with a transparent reasoning trace.
A Critical (CVSS 9.7) DNS rebinding flaw (CVE-2025-59159) in the SillyTavern LLM interface allows remote attackers to seize full control of local AI instances and steal API keys.
Apple is internally testing a ChatGPT-like tool, codenamed "Veritas," to accelerate the development of a more capable, AI-driven Siri with personalized features.
NVIDIA released an urgent update for its Megatron-LM LLM framework, patching four high-severity code injection flaws that could allow attackers to compromise AI workflows.
Microsoft blocked a credential phishing campaign that used AI to generate complex, verbose code in an SVG file to obfuscate its payload and evade defenses.
Meta has open-sourced its MobileLLM-R1 series, a new family of models designed for on-device reasoning in math, coding, and science.
Google unveils VaultGemma, the first LLM trained with differential privacy. The open-source model achieves near non-private performance, setting a new standard for privacy-first AI.
A critical flaw in LangChainGo, a popular LLM framework, allows attackers to read sensitive files via server-side template injection. A patch has been released.
Switzerland launches Apertus, a fully open-source LLM. The model is built as public infrastructure, emphasizing transparency and compliance over commercial goals.