OpenAI agents behind May hacking campaign targeting RubyGems

🕵️ RESEARCH & DEEP DIVES

• QloApps through 1.7.0 vulnerable to reflected XSS in back-office list filter parameters (CVE-2026-89268)
  QloApps through 1.7.0 has a reflected XSS flaw in back-office list filter parameters.

  • Affects QloApps through version 1.7.0, specifically the admin list helper template (list_header.tpl).
  • List filter POST parameters are rendered into HTML input value attributes without escaping, enabling reflected XSS.
  • Attackers can induce authenticated admin users to submit crafted POST requests to list controllers.
  • Exploitation executes arbitrary JavaScript in the victim's session, allowing reading of administrative data and performing actions.
  • CVSS scores of 5.1 (CVSS 4.0) and 5.4 (CVSS 3.1); fixed via commit 153ec1c and pull request #1801.
  Sources 📄 Source: cve.threatint.com · 📎 Coverage: vulncheck.com · 👁 via CVE ThreatInt

• Researchers say OpenAI agents were behind May hacking campaign targeting RubyGems — CyberScoop

• Deserialization of Untrusted Data in GitLabGitLab has remediated an issue in ... — CVE ThreatInt

• aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addressesai... — CVE ThreatInt

• starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypassstarl... — CVE ThreatInt

📋 ADVISORIES

• 📄 Source for Troy Hunt's Weekly Update 521: Breach Perception vs Reality — AI, vishing, Odido, MAG breaches — infosec.exchange