🕵️ RESEARCH & DEEP DIVES
Hackers hijack HBO Max Reddit account to push malware in ClickFix ads — BleepingComputer
Apple Updates Everything, (Mon, Sep 14th) — SANS ISC
Anthropic CEO: Time to Shift From Improving to Controlling AI — Dark Reading
New York Seizes 12 Celebrity Deepfake Websites — 404 Media
New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing — The Hacker News
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries — The Hacker News
WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution — The Hacker News
Five alleged leaders of Black Axe’s operations in South Africa extradited to US — CyberScoop
docx4j: Stack Overflow via Cyclic
w:basedOnStyle Chain leads to Denial of ... — CVE ThreatIntDjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView autho... — CVE ThreatInt
http4k: Unbounded gzip decompression in
ServerFilters.GZip/ `RequestFilter... — CVE ThreatIntMicrosoft Edge (Chromium-based) Elevation of Privilege VulnerabilityConcurren... — CVE ThreatInt
OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled serv... — CVE ThreatInt
flat-to-nested: Prototype pollution in flat-to-nested convert() via proto... — CVE ThreatInt
next-video: Unauthenticated arbitrary file read via /api/video request handle... — CVE ThreatInt
SpiceDBChecks involving relations with caveats can result in unconditional pe... — CVE ThreatInt
Allure: Stored XSS via unescaped ANSI helper in Allure report status message/... — CVE ThreatInt
Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Rea... — CVE ThreatInt
Windows Secure Kernel Mode Elevation of Privilege VulnerabilityDouble free in... — CVE ThreatInt
Stack-based out-of-bounds write in tdelete during tree rebalancingCalling tde... — CVE ThreatInt
containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Servic... — CVE ThreatInt
Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in nam... — CVE ThreatInt
October CMS: PHP Object Injection via Backend Widget Session StorageOctober S... — CVE ThreatInt
subhajitkhan online-clinic-management-system doctorlogin.php sql injectionA f... — CVE ThreatInt
pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook si... — CVE ThreatInt
Conform: parseSubmission vulnerable to CPU exhaustion when parsing many uniqu... — CVE ThreatInt
CVE-2026-91021Trilium Notes, version v0.103.0 and earlier, contains a stored ... — CVE ThreatInt
EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline... — CVE ThreatInt
A Vulnerability in GitLab Could Allow for Disclosure of Sensitive Data — CIS Advisories
AWS Security Reference Architecture: A deep dive into PCI DSS compliance — AWS Security Blog
Hackers Exploit FortiGate SSL-VPN Vulnerability to Attack Broadband Provider — Cyber Security News
UK Government Begins Moving 23 Million Users Away From Passwords — Cyber Security News
The POTUS says we're doomed. — @briankrebs@infosec.exchange
AI Agent Security Readiness: The Federal Standard You Should Get Ahead Of — securityboulevard.com (discovered)
Machine-Speed Attacks Are an Architecture Problem — securityboulevard.com (discovered)
Zero Data Retention: What Every AI Provider Actually Promises You — securityboulevard.com (discovered)
Common web application security risks every SME should understand — securityboulevard.com (discovered)