🕵️ RESEARCH & DEEP DIVES
Podcast: Library Futures director on censorship, AI, and the future of libraries
404 Media's podcast features an interview with Library Futures executive director Jennie Rose Halperin on censorship, AI, and the role of librarians amid crumbling public institutions.- 404 Media's Emanuel Maiberg interviews Jennie Rose Halperin, executive director of Library Futures, a nonprofit advocating for a fair digital future for libraries and their communities.
- Discussion topics include censorship, AI, and the role of librarians in a country with crumbling public institutions.
- The episode stems from conversations Maiberg has had with Halperin for 404 Media's library coverage, much of which never made it into published articles.
- The episode is available on Apple Podcasts, Spotify, and YouTube; paid subscribers get early access plus an extended video version.
Security Boulevard highlights ten cybersecurity job opportunities in weekly jobs report
Security Boulevard has published a weekly cybersecurity jobs report highlighting ten open opportunities for security professionals.- Geared toward cybersecurity professionals seeking to advance their careers
- Weekly series highlights ten current cybersecurity job openings
- Launched to make career advancement easier amid challenging economic conditions
Russian-linked attacker used AI agents to exploit PaperCut flaws across 48 countries
A likely Russian attacker used hundreds of AI agents to exploit two PaperCut vulnerabilities against hundreds of companies in 48 countries.- Hundreds of companies across 48 countries running PaperCut software were targeted in the campaign.
- Two vulnerabilities in PaperCut software were exploited in the attacks.
- A likely Russian bad actor used multiple AI tools and hundreds of AI agents to carry out the intrusions.
- The operation is cited as an example of adversaries' growing maturity in using AI for attacks.
🕵️ RESEARCH & DEEP DIVES • Using AI for Weapons Development (5) — Schneier on Security
🕵️ RESEARCH & DEEP DIVES • Security teams increasingly outflanked by AI agents (5) — Cybersecurity Dive
🕵️ RESEARCH & DEEP DIVES • Malicious actors already using critical GitLab flaw, CISA and others warn (5) — Cybersecurity Dive
🕵️ RESEARCH & DEEP DIVES • Hackers target exposed Vite dev servers to steal AWS, Azure secrets (5) — BleepingComputer
🕵️ RESEARCH & DEEP DIVES • Beijing Hits Back at Anthropic CEO’s Call to Curb China’s AI Development (5) — SecurityWeek
🕵️ RESEARCH & DEEP DIVES • ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits (5) — The Hacker News
🕵️ RESEARCH & DEEP DIVES • Cops Search Thousands of Flock Cameras for Reasons of ‘LMAO,’ ‘IDK,’ ‘Hehe,’ and ‘asdfg’ (5) — 404 Media
🕵️ RESEARCH & DEEP DIVES • Inside ‘Project Lily’: The Humans Reading Your ChatGPT Chats (5) — 404 Media
🕵️ RESEARCH & DEEP DIVES • gix-sec safe.directory protections absent for elevated administratorsgitoxide... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • PraisonAI: Arbitrary File Read/Write via
multieditTool Without Path Valida... (5) — CVE ThreatInt🕵️ RESEARCH & DEEP DIVES • PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally ... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • praisonai: Jobs API exposes agent-execution endpoints with no authenticationP... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • PraisonAI UI MCP connect endpoint allows unauthenticated local command execut... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • PraisonAI: Webhook signature verification skipped (fail-open) when secret uns... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • praisonai: recipe serve auth middleware silently disables itself when no secr... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • PraisonAI Code agent tools fail open without a workspace boundaryPraisonAI is... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jo... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • PraisonAI: Arbitrary File Read via
@file:Mention Path TraversalPraisonAI i... (5) — CVE ThreatInt🕵️ RESEARCH & DEEP DIVES • praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • PraisonAI: execute_code sandbox bypass: str.format C-level attribute access r... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • Android ZCC denial of serviceOn affected versions of Zscaler client connector... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Orig... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • Android ZCC VPN API method privilege escalationAn improper input validation v... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • Nintendo Switch Vulnerability Allows Attackers to Run Unauthorized Code on Your Console (5) — Cyber Security News
🕵️ RESEARCH & DEEP DIVES • Microsoft Offers Up to $30,000 for Critical AI Flaws in Dynamics 365 and Power Platform (5) — Cyber Security News
🕵️ RESEARCH & DEEP DIVES • AWS Systems Manager Agent Vulnerability Allows Attackers to Bypass Port-Forwarding Restrictions (5) — Cyber Security News
🕵️ RESEARCH & DEEP DIVES • Rapid7 Named Among Notable Vendors in Forrester MDR Landscape: Why the Future is Exposure-informed, Preemptive MDR (5) — rapid7.com (discovered)
🕵️ RESEARCH & DEEP DIVES • Ask the Agent Nicely: Two Authorization Bypasses in n8n AI Agents (5) — r/netsec
🕵️ RESEARCH & DEEP DIVES • Claude Code vs. AWS Kiro vs. GitHub Copilot: Should Every Developer Use the Same AI Coding Tool? (5) — securityboulevard.com (discovered)
🕵️ RESEARCH & DEEP DIVES • Jacob Coxon, the former Anthropic researcher who suddenly resigned and kicked off the crisis, is on the NYT Daily today. (5) — <https://