%term

Why Do AI Coding Agents Keep Getting the Same RCE Vulnerability?

Jul 27, 2026 By AppSentinels In AppSentinels

An agent reads a file, approves its own next action, and the change survives the session. That one design choice, repeated across nearly every AI coding tool built in the last eighteen months, is the reason this keeps happening.

Read Post

AppSentinels

Read more about Why Do AI Coding Agents Keep Getting the Same RCE Vulnerability?

Emerging Threat: (CVE-2026-10818) WPForms Pro Arbitrary File Upload Leading to Remote Code Execution

Jul 27, 2026 By Igal Zeifman In CyCognito

CVE-2026-10818 is an arbitrary file upload vulnerability in WPForms Pro, the paid edition of a widely deployed WordPress form builder plugin. It was published on July 25, 2026, with Wordfence as the assigning CNA. The flaw sits in the ajax_chunk_upload_finalize function, which handles the final step of a chunked file upload. File type validation runs after the chunk metadata and the file contents have already been written to disk, and the assembled file is not deleted when that validation fails.

Read Post

CyCognito

Read more about Emerging Threat: (CVE-2026-10818) WPForms Pro Arbitrary File Upload Leading to Remote Code Execution

What Is AI Pentesting and How Does It Works?

Jul 27, 2026 By Snyk Team In Snyk

AI pentesting (AI penetration testing) is the use of reasoning-capable AI models to autonomously find, exploit, and validate security vulnerabilities in running applications — especially the context-dependent flaws, such as broken authorization and business-logic abuse, that traditional scanners cannot detect.

Read Post

Snyk

Read more about What Is AI Pentesting and How Does It Works?

Securing Your Data Pipeline from Internal Threats

Jul 27, 2026 By SecuritySenses In SecuritySenses

When organisations design security strategies, they often focus on building a fortress to keep external threats out. However, some of the biggest risks to data integrity don't come from outside; they start within. Securing a data pipeline, the complex system that moves information from source to destination, needs strong defences against internal threats, whether they're intentional or accidental.

Read Post

SecuritySenses

Read more about Securing Your Data Pipeline from Internal Threats

CVE-2026-6875: ServiceNow Sandbox Escape Leads to Pre-Auth RCE in AI Platform

Jul 23, 2026 By Bhargavi Pallati In Indusface

ServiceNow AI Platform (the enterprise PaaS formerly branded in the Now Platform) contains a critical, unauthenticated remote code execution vulnerability tracked as CVE-2026-6875. The vulnerability allows a remote attacker to escape ServiceNow’s JavaScript execution sandbox. No credentials or user interaction are required, and the attacker achieves full code execution on the underlying instance.

Read Post

Indusface

Read more about CVE-2026-6875: ServiceNow Sandbox Escape Leads to Pre-Auth RCE in AI Platform

Bad Things Also Come in Small Packages: A 38-byte DoS in fflate (CVE-2026-45820)

Jul 23, 2026 By Ben Bader In Seal Security

We discovered this new vulnerability as part of our abandoned-packages research. Despite what seems like a 2-year hiatus, fflate is one of the few popular npm packages that released a fix for the vulnerabilities we found merely using Sonnet-4.6, giving its 50M+ users a chance to upgrade to a safe version.

Read Post

Seal Security

Read more about Bad Things Also Come in Small Packages: A 38-byte DoS in fflate (CVE-2026-45820)

Build the Zero-Day Playbook Before the Next Crisis

Jul 23, 2026 By Forescout Technologies In Forescout

In this video, Daniel dos Santos, VP of Research, explains why organizations should establish a zero-day containment playbook before a crisis occurs. A well-defined playbook connects response actions to assets, critical services, and business functions while outlining decision-making, impact validation, and crisis communication processes. When a real-world zero-day strikes, there is no time to create a plan from scratch. Preparation helps teams respond faster, align stakeholders, and reduce uncertainty during high-pressure situations.

View Video

Forescout

Read more about Build the Zero-Day Playbook Before the Next Crisis

Mythos Can Find Vulnerabilities At Scale. Can Your Organization Act on Them?

Jul 23, 2026 By Nucleus Security In Nucleus

Artificial intelligence is transforming cybersecurity at an unprecedented pace, but is it making organizations safer or simply exposing more vulnerabilities?

View Video

Nucleus

Read more about Mythos Can Find Vulnerabilities At Scale. Can Your Organization Act on Them?

How Anthropic's Claude Mythos Escaped a Secure Environment and What It Means for SMBs

Jul 23, 2026 By SecuritySenses In SecuritySenses

SecuritySenses and BCA, an IT services company in Spokane, team together to help small and midsize businesses turn frontier-AI security news into controls they can actually implement. During an internal evaluation, Anthropic gave Claude Mythos Preview access to a restricted computer and instructed it to find a way out. The model discovered a weakness, bypassed its technical restrictions and contacted the researcher overseeing the test.

Read Post

SecuritySenses

Read more about How Anthropic's Claude Mythos Escaped a Secure Environment and What It Means for SMBs

Finding eight high-severity vulnerabilities in NodeBB in six hours

Jul 22, 2026 By Jorian Woltjer In Aikido

TL;DR While improving our AI Pentest, we ran a whitebox assessment on NodeBB, a forum software powered by NodeJS. The result? Eight high-severity vulnerabilities that would all be exploitable on default instances of NodeBB. This includes Cross-Site Scripting (XSS), two of which require interaction with a custom Federation server that the AI agent had to set up itself. Another affects practically every input on NodeBB due to a template injection.

Read Post