Permify: Open-source authorization as a service
Permify is an open-source authorization service that answers access questions at run time: can user X view document Y, which posts can members of team…
Month: September 2026
DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval
A flaw in DeepSeek Harness, DeepSeek’s open-source tool for running AI coding agents on a developer’s machine, let a sandboxed agent turn off its own…
Cyber Risk in the Mythos Era – Where do we begin?
Cybersecurity experts Paul Hossack and Alex Ward from Security Centric are joining Angie Fung, VITG, on a deep dive webinar on this topic. Register here. …
Conti Hacker Who Built Malware and Attacked Victims Gets Four-Year Sentence
Conti Hacker Who Built Malware and Attacked Victims Gets Four-Year Sentence Pierluigi Paganini September 13, 2026 Ukrainian lawyer and Conti malware developer Oleksii Lytvynenko was…
XSS vulns galore (plus a cool shirt!) — Jon Bottarini
When the adult website PornHub launched their public bug bounty program, I was pretty sure that most of the low hanging fruits of vulnerabilities would…
CVE-2024-3094: Critical RCE Vulnerability Found in XZ Utils
A backdoor has been identified in versions 5.6.0 and 5.6.1 of XZ Utils (assigned CVE-2024-3094), which under some conditions may allow RCE via SSH authentication in specific versions of…
Microsoft Management Console for initial access and evasion
Overview After Microsoft disabled office macros by default for internet-sourced documents, other infection vectors like JavaScript, MSI files, LNK objects, and ISOs have surged in…
Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6
Anthropic on Wednesday disclosed a fourth incident in which its artificial intelligence (AI) model broke into real third-party systems, marking the latest in a growing…
AEC’s election donation system build more than doubles to $70m
Key points The AEC’s outsourced build of an election donation system has more than doubled in cost to $70 million since January, with more parts…
Security Affairs newsletter Round 594 by Pierluigi Paganini – INTERNATIONAL EDITION
Security Affairs newsletter Round 594 by Pierluigi Paganini – INTERNATIONAL EDITION Pierluigi Paganini September 13, 2026 A new round of the weekly Security Affairs newsletter…
Inspect Element leads to Stripe Account Lockout Authentication Bypass — Jon Bottarini
A common thing I see happening with many popular applications is that a developer will disable an HTML element through the “class” attribute. It usually…
Top security talks from KubeCon Europe 2024
KubeCon + CloudNativeCon Europe 2024 took place last week in Paris Expo de Versailles with over 12,000 attendees. All the conference’s videos have been promptly…