🕵️ RESEARCH & DEEP DIVES
- OpenAI disrupts 'novel' model distillation attack, blames Moonshot AI-linked operators
OpenAI disrupted a coordinated campaign to extract reasoning capabilities from its models, attributing a core cluster to individuals linked to China's Moonshot AI.- Applies to OpenAI's AI models; the same vulnerability reportedly exists in other AI models, per OpenAI.
- Attackers copied encrypted reasoning data from one conversation and had the model decrypt and transcribe it in plain text in a separate conversation — no encryption was broken and no database was compromised.
- Activity began July 1, peaked with 16,000 prompts from 4,000 users on July 24–25, and grew to 15,000 suspicious users by July 28, when OpenAI fully disrupted the operation.
- OpenAI attributes a 'core cluster' to individuals working on behalf of China-based Moonshot AI, though its blog post cites no technical evidence for the claim.
- OpenAI banned offending accounts, fixed the cross-conversation decryption bug, and expanded signup, infrastructure, and network monitoring controls.
🔓 CVEs & KEV
CVE-2026-102149 — Kiteworks Email Protection Gateway — CVSS 9.4 — Kiteworks Email Protection Gateway Certificate Assignment Flaw Exposes Encrypted Mail and Account Access
CVE-2026-101283 — esnet iperf3 — CVSS 9.2 — iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt...
CVE-2026-101276 — esnet iperf3 — CVSS 9.2 — iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-f...
CVE-2026-102105 — Kiteworks Email Protection Gateway — CVSS 9.1 — Kiteworks Email Protection Gateway server-side request forgeryKiteworks Email...
CVE-2026-102106 — Kiteworks Email Protection Gateway — CVSS 9.1 — Kiteworks Email Protection Gateway improper authenticationImproper authentica...
CVE-2026-102108 — Kiteworks Email Protection Gateway — CVSS 7.2 — Kiteworks Email Protection Gateway deserialization of untrusted dataAn authen...
CVE-2026-102109 — Kiteworks Secure Data Forms — CVSS 7.1 — Kiteworks Secure Data Forms SQL injectionA SQL injection vulnerability existe...
CVE-2026-103001 — jpadilla pyjwt — CVSS 6.5 — PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-veri...