en-US Tue, 22 Sep 2026 16:00:14 +0000 https://thehackernews.com/2026/09/ai-agents-are-rewriting-rules-of.html Tue, 22 Sep 2026 16:00:14 +0000 https://nvd.nist.gov/vuln/detail/CVE-2025-14486 Tue, 22 Sep 2026 12:00:06 +0000 https://huggingface.co/blog/transformers-llama-cpp-quants Tue, 22 Sep 2026 16:00:14 +0000 https://huggingface.co/blog/omlx Tue, 22 Sep 2026 16:00:14 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-94627 Tue, 22 Sep 2026 12:00:06 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-94626 Tue, 22 Sep 2026 12:00:06 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-94625 Tue, 22 Sep 2026 12:00:06 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-94624 Tue, 22 Sep 2026 12:00:06 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-94623 Tue, 22 Sep 2026 12:00:06 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-94622 Tue, 22 Sep 2026 12:00:06 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-77518 Tue, 22 Sep 2026 12:00:06 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-61647 Tue, 22 Sep 2026 12:00:06 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-61612 Tue, 22 Sep 2026 12:00:06 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-88978 Tue, 22 Sep 2026 12:00:06 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-84298 Tue, 22 Sep 2026 12:00:06 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-63342 Tue, 22 Sep 2026 12:00:06 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-61687 Tue, 22 Sep 2026 12:00:06 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-61681 Tue, 22 Sep 2026 12:00:06 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-55563 Tue, 22 Sep 2026 12:00:06 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-55071 Tue, 22 Sep 2026 12:00:06 +0000 https://thehackernews.com/2026/09/weekly-recap-cisco-0-day-ai-agent-rce.html Tue, 22 Sep 2026 16:00:14 +0000 https://huggingface.co/blog/MultiverseComputingCAI/pruning-llms-like-a-physicist-block-removal-as-an Tue, 22 Sep 2026 16:00:14 +0000 https://www.securityweek.com/google-confirms-gemini-ai-breached-three-firms/ Tue, 22 Sep 2026 02:00:01 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-94093 Mon, 21 Sep 2026 18:00:04 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-94111 Mon, 21 Sep 2026 06:00:01 +0000 https://www.bleepingcomputer.com/news/security/researchers-escape-openai-codex-sandbox-to-run-commands-on-host/ Tue, 22 Sep 2026 14:00:01 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-93993 Sun, 20 Sep 2026 18:00:01 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-93989 Sun, 20 Sep 2026 18:00:01 +0000 https://thehackernews.com/2026/09/claude-opus-5-helped-researchers-take.html Tue, 22 Sep 2026 16:00:14 +0000 https://www.bleepingcomputer.com/news/security/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions/ Tue, 22 Sep 2026 12:00:13 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-93982 Sun, 20 Sep 2026 12:00:01 +0000 https://thehackernews.com/2026/09/google-gemini-broke-into-real-company.html Tue, 22 Sep 2026 16:00:14 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-93841 Sat, 19 Sep 2026 18:00:02 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-93840 Sat, 19 Sep 2026 18:00:02 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-93838 Sat, 19 Sep 2026 18:00:02 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-33625 Sat, 19 Sep 2026 18:00:02 +0000 https://nvd.nist.gov/vuln/detail/CVE-2025-66455 Sat, 19 Sep 2026 18:00:02 +0000 https://github.com/advisories/GHSA-jgh3-fggc-mcpm Sat, 19 Sep 2026 01:00:02 +0000 https://github.com/advisories/GHSA-xwmw-prc4-v3cr Sat, 19 Sep 2026 01:00:02 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-77616 Sat, 19 Sep 2026 12:00:02 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-58197 Sat, 19 Sep 2026 12:00:02 +0000 https://github.com/advisories/GHSA-qg2g-g9w3-m5h8 Sat, 19 Sep 2026 01:00:02 +0000 https://github.com/advisories/GHSA-3hmm-rh5q-gwwr Sat, 19 Sep 2026 01:00:02 +0000 https://github.com/advisories/GHSA-2vh9-42vm-xmv2 = 0.9.2, < 0.16.0` The vulnerable P2P receiver was introduced in commit `b0b705f7`. ## Remediation The issue was fixed by replacing the pickle-based ZeroMQ protocol with JSON serialization: - `send_pyobj()` was replaced with `send_json()`. - `recv_pyobj()` was replaced with `recv_json()`. - Received objects are validated using the `DistServeCacheFreeRequest` Pydantic schema before use. - Invalid or off-schema messages are rejected without terminating the receive loop. Fix commit: https://github.com/InternLM/lmdeploy/commit/f05b4ad8bf2e2d84101a1d63b3c44fadd99223b2 The fix was released in LMDeploy 0.16.0. ## Workarounds Users who cannot upgrade immediately should: - Prevent untrusted clients from reaching `/distserve/*` endpoints. - Restrict the DistServe HTTP and ZeroMQ control planes to trusted cluster networks. - Configure API-key authentication. - Block arbitrary outbound ZeroMQ connections from serving nodes. These measures reduce exposure but do not make pickle deserialization safe. Upgrading to LMDeploy 0.16.0 or later is recommended.]]> Tue, 22 Sep 2026 01:00:01 +0000 https://github.com/advisories/GHSA-cx86-7xwp-w9wf Sat, 19 Sep 2026 01:00:02 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-93688 Sat, 19 Sep 2026 12:00:02 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-93592 Sat, 19 Sep 2026 12:00:02 +0000 https://www.securityweek.com/ai-built-exploit-and-sign-in-flaw-opened-path-to-internal-openai-code/ Mon, 21 Sep 2026 14:00:01 +0000 https://thehackernews.com/2026/09/plugin4shell-lets-repository-owners.html Tue, 22 Sep 2026 16:00:14 +0000 https://thehackernews.com/2026/09/claimed-bug-bounty-hunter-likely-used.html Tue, 22 Sep 2026 16:00:14 +0000