Public Linux kernel root exploit appears before a CVE or fix
Sysdig says six ZDI reports went to lists on October 20–21, and several still lack a released-kernel fix.
74
- Mentions · 7d1
- Mentions · 30d5
- All mentions16
- First seenSep 11, 2026
- Last mentioned4d ago
Timeline
16 articles · newest firstNew Proxyjacking Campaign Exploits Network Device Flaws to Build Stealthy Proxy Infrastructure
GreyNoise says attackers exploited NAS, NVR, and SAP flaws to install Pawns.app on 143 devices.
74
How Claude Code’s 256KB blind spot put developers’ secrets in the preview pane
Noma says Claude Code's HTML preview could run malicious JavaScript and steal developer secrets; Anthropic patched it.
74
Zammad Zero-Day Chain Lets AI Agent Hijack Sessions, Execute Code and Escalate to Root
An AI agent chained Zammad zero-days CVE-2026-102489 and CVE-2026-102490 to breach DIVD, reaching root in seconds and stealing volunteer emails.
75
Autonomous AI Agent Chains Two Zammad Zero-Days in Machine-Speed Cyberattack
An autonomous AI agent chained two Zammad zero-days to root Dutch DIVD and steal volunteer contacts.
80
Hackers Use Compromised Service Principals to Delete Azure Storage and Steal Cloud Credentials
Microsoft links destructive Azure Storage deletions and storage key theft by Storm-3168 (JADEPUFFER) to compromised service principals with credentials leaked on GitHub.
66
JadePuffer crims hijacked Azure identities and used them to blow up cloud resources
Microsoft attributes Azure cloud destruction attacks to Storm-3168, the actor behind JadePuffer agentic ransomware, after hijacked service principals deleted 100+ storage accounts.
68
JadePuffer agentic AI attacks target Azure, destroy cloud resources
JadePuffer, tracked as Storm-3168, used AI-driven attacks to wipe Azure storage and other cloud resources.
78
Autonomous agents attack Azure using compromised identities and destroying resources
Microsoft says Storm-3168, or Jadepuffer, used compromised Azure service principals to delete cloud resources and collect credentials.
82
Storm-3168, Linked to JADEPUFFER, Abused Stolen Azure Identities
Microsoft details Storm-3168 (JADEPUFFER) using two stolen Azure service principals to rapidly delete 100+ storage accounts and harvest keys for extortion.
72
JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources
JADEPUFFER-linked Storm-3168 deleted Azure storage, databases, and recovery resources with stolen service principals.
78
11 Best GCP Security Tools Compared (2026): Features & Pricing
A 2026 buyer's guide ranks 11 GCP security tools, leading with Security Command Center and Wiz.
20
Storm-3168: Agentic-driven cloud attacks using compromised service principals
Microsoft details Storm-3168 (JADEPUFFER) destroying Azure resources via compromised service principals in the first documented agentic ransomware operation's Azure activity.
78
CISA Urges Critical Infrastructure to Plant Decoys Inside Networks
CISA's first decoy guidance tells critical infrastructure to deploy honeytokens and tripwires inside networks, mapped via MITRE ATT&CK and Engage, to speed detection.
50
The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access, (Fri, Sep 11th)
An autonomous coding agent harvested LLM API access from poorly secured gateways and aggregated stolen inference capacity behind a self-hosted gateway
68
Top 10 Best Cloud Workload Protection (CWPP) Solutions in 2026
Editorial scorecard ranks 2026 cloud workload protection platforms, placing Prisma Cloud first, Sysdig second, and CrowdStrike third on detection quality.
12
Related CVEs
by mentions- CVE-2026-10249011%9.4Local privilege escalation to root in all Zammad versions
- CVE-2026-10248922%9.4Session hijack to RCE in Zammad
- CVE-2021-44228100%10.0JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)
- CVE-2025-3132499%9.8Unauthenticated File Upload RCE in SAP NetWeaver Visual Composer
- CVE-2024-3273100%9.8Command Injection in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L NAS Devices
- CVE-2024-327298%9.8Hard-Coded Backdoor Credentials in End-of-Life D-Link NAS Devices
- CVE-2025-3248100%9.8Unauthenticated RCE in Langflow /api/v1/validate/code
Appears with
- Microsoftorganization · 9
- Storm-3168threat actor · 7
- Microsoftvendor · 4
- JadePufferorganization · 4
- Azureorganization · 3
- Jadepufferthreat actor · 3
- Microsoft Azureproduct · 3
- Sysdigvendor · 3
- Wizvendor · 2
- Wizorganization · 2
- Falcoproduct · 2
- Azure Key Vaultproduct · 2
- Azure Storageproduct · 2
- Azure SQLproduct · 2
- Palo Alto Networksvendor · 2
- Zammadorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.