🕵️ RESEARCH & DEEP DIVES
Akana API Platform vulnerable to XXE flaw in XML-to-JSON processing
An XML external entity vulnerability affecting the Akana API Platform, including version 2026.1, was disclosed.- Applies to users of the Akana API Platform, with affected versions including 2026.1
- The flaw is an XML external entity (XXE) issue tracked as CVE-2026-89212
- XML references are improperly restricted during the platform's XML-to-JSON processing
Cloudflare CASB adds automatic remediation policies for SaaS risks
Cloudflare has introduced automatic remediation policies in its CASB product.- Applies to security teams using Cloudflare CASB to monitor SaaS application security
- Introduces policies, a native automation engine built directly on the Cloudflare developer platform, to remediate SaaS risks automatically
- Security teams can design event-driven logic, such as revoking risky file shares
- Policies can also send webhooks without manual intervention
How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface — BleepingComputer
In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review — SecurityWeek
Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack — SecurityWeek
‘We Did Not Invite You.’ Citizens Rage at Town Hall Over Proposed Nuclear AI Data Center — 404 Media
The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access, (Fri, Sep 11th) — SANS ISC
Your Critical Vulnerabilities Might Not Be Your Biggest Risk — The Hacker News
Keycloak-services: keycloak-services: confidential client secret disclosed to... — CVE ThreatInt
Argument Injection in TUBITAK BILGEM's Pardus PenImproper neutralization of a... — CVE ThreatInt
Privilege Escalation in Progress Chef AutomateA vulnerability in the Chef Aut... — CVE ThreatInt
A inclusion of sensitive information in source code vulnerability in Fortinet... — CVE ThreatInt
Russia-Aligned Hackers Use GuardBreaker Prompt Injection to Disrupt AI Malware Analysis — Cyber Security News
New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks — Cyber Security News
Hackers Impersonate CEOs in 1 Million Emails to Trick Employees Into $50,000 Payments — Cyber Security News
Windows 11 Security Update KB5124008 Breaks Always-On VPN Connections — Cyber Security News
Took this photo last night facing Manhattan of the twin beams of light in remembrance of today. — @zackwhittaker@mastodon.social
Metasploit Wrap Up: This One Goes to Sixteen! — rapid7.com (discovered)
The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment — rapid7.com (discovered)
The Next Agentic Security Failure May Begin With Permission — securityboulevard.com (discovered)
Anthropic Finds Fourth Claude Cyber Incident After Model Accessed Third-Party Computer — securityboulevard.com (discovered)
Top 10 Breaches of the Week — securityboulevard.com (discovered)
The SOC was Never Designed to See Everything — securityboulevard.com (discovered)
Business risks of denial-of-service attacks explained — securityboulevard.com (discovered)