Wazuh adds AI Analyst reports and LLM integrations for SOC workflows
Wazuh Cloud's AI Analyst uses Amazon Bedrock and Claude to email scheduled posture reports, while self-hosted Llama 3 or Claude 3.5 Haiku options support threat hunting.
25
Product
Ollama
- Mentions · 7d2
- Mentions · 30d10
- All mentions28
- First seenAug 21, 2026
- Last mentioned2d ago
Timeline
28 articles · newest firstEngineer runs OpenCode offline with local Qwen3.5 9B via Ollama
The walkthrough uses OpenCode 1.19.4, blocks web tools, and cites published Qwen scores rather than measurements from the laptop.
22
Fine-tune of Qwen3-4B cuts AI writing tics, released for Ollama
On 40 held-out prompts the author's slop score fell from 121 to 12.5 per 1,000 words, with a 30-question quiz still correct.
36
Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules
Rapid7's Metasploit wrap-up adds 12 modules, including unauthenticated RCE for N-central, Langflow, LiteLLM, and dizqueTV.
52
Hackers Use GitHub-Hosted Poem to Control PoeLLM Malware Targeting AI Infrastructure
PoeLLM malware uses a GitHub poem to derive C2 addresses and mine cryptocurrency on more than 3,400 exposed AI servers.
78
PoeLLM Malware Hijacks 3,400+ Servers for Crypto Mining and Botnet Expansion
PoeLLM has compromised over 3,400 servers, mining cryptocurrency and spreading through exposed AI and web apps.
78
Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers
PoeLLM malware has infected over 3,000 servers since April, hiding command-and-control in a GitHub poem while mining cryptocurrency.
80
PoeLLM malware infects exposed AI servers in cryptomining attacks
PoeLLM cryptomining malware has compromised over 2,100 exposed AI servers, using GitHub poems for command-and-control.
76
PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem
PoeLLM malware has compromised over 3,400 servers, encoding its command-and-control address in a GitHub poem.
77
The vulnerabilities AI finds are the ones attackers want
GTIG says AI-found flaws skew toward remote code execution, and attackers hit BeyondTrust CVE-2026-1731 within four days.
80
Show HN: Parrot – Open-Source Smart Meeting Recorder with Co-Pilot on Mac
Parrot 0.24.2 is an open-source Mac meeting recorder that suggests answers from local documents during calls.
24
What I did at Recurse Center
A programmer recounts a Recurse Center summer of agent study, deep learning, and a DEFLATE reimplementation.
6
OllamaDrama: Designing and Deploying a Honeypot to Measure Attacks on Exposed LLM Infrastructure
An Ollama API honeypot logged 290,887 interactions, including RCE, mining, and prompt injection.
61
Portnox detects and removes unauthorized AI applications from managed devices
Portnox introduced a tool to automatically detect and remove unauthorized Shadow AI applications from managed devices to enforce security policies.
50
Measuring the Serving Stack Instead of the Model: Hidden Confounds in Local Tool-Use Evaluation
Local serving stacks can distort tool-use scores, including false 0% fidelity for rejected models.
43
Best Open-Source Agent Harnesses for Local LLMs in 2026
A 2026 guide ranks 11 open-source agent harnesses, including OpenCode, Goose, Cline, and OpenHands, by local-LLM support, licensing, and safety controls.
28
GPT4Free Privacy Risks Expose AI Prompts to Third-Party Servers and Hidden Logs
Gen Digital researchers found GPT4Free's hosted chat routes prompts through third-party servers, mislabels models, and logs IPs and conversations for up to 30 days.
48
The AI Supply Chain Has a Security Problem, and Much of It Is Sitting on the Open Internet
Researchers counted 36,769 publicly reachable self-hosted AI endpoints, only about 2% behind HTTP authentication, exposing Ollama, vLLM, and Flowise to abuse.
45
AI-Infra-Guard: Open-source security scanner for AI systems
Tencent's Zhuque Lab open-sourced AI-Infra-Guard, a scanner that fingerprints AI services, checks 1,600+ CVEs, and evaluates MCP skills.
35
Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution
CrowdStrike links previously unseen Slim Spider group to crypto custody secret theft at Brazilian financial institutions since March 2026.
75
ISTA-DASLab/Qwen3.8-Flash-Next-GSQ-RCO-GGUF — new model trending #30 on Hugging Face
ISTA-DASLab releases GSQ-RCO non-uniform GGUF quantizations of Qwen3.8-Flash-Next, a 512-expert multimodal MoE, at 2.4-3.0 bits per weight.
42
Open-source secrets scanning tool Sift hunts credentials in Microsoft 365, Slack, and Jira
Stratus Security open-sourced Sift, a CLI secrets scanner covering Active Directory, SharePoint, Teams, Slack, Jira, and Confluence, outperforming Snaffler in benchmarks.
28
The Coding-Agent Trap: When a "Free" LLM Endpoint Is the Adversary, (Mon, Aug 31st)
A SANS honeypot caught a real coding-agent session routed to a rogue "free" LLM endpoint, exposing a Windows user's transcript and tool outputs.
60
ISTA-DASLab/Qwen3.8-27B-GSQ-RCO-GGUF — new model trending #3 on Hugging Face
ISTA-DASLab releases GSQ-RCO non-uniform GGUF quantizations of Qwen3.8-27B down to 2.5 bpw, with task-lossless IQ3_S matching BF16 benchmark scores.
44
XHToken/Spark-X2.5-4B-GGUF — new model trending #30 on Hugging Face
XHToken released GGUF weights of Spark-X2.5-4B, a compact model with 1M-token context and 200+ language support, under Apache 2.0.
24
Finding Nemo(Claw): Networking Issue Allows for LLM Poisoning in OpenClaw
A networking flaw in Nvidia tooling lets attackers reach OpenClaw's local model server unauthenticated via the Ollama API, enabling persistent LLM poisoning.
48
A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw
Oasis Security found NVIDIA NemoClaw's Ollama binding to 0.0.0.0 enables DNS rebinding attacks that let attacker pages poison model chat templates with persistent hidden instructions.
55
Wazuh and AI For Enhanced SOC Workflows
Wazuh details AI-powered SOC workflows via its AI Analyst, self-hosted Llama 3 via Ollama, and Claude 3.5 Haiku integrations.
25
Related CVEs
by mentions- CVE-2026-4227191%8.7Command Injection in BerriAI LiteLLM AI Gateway Exploited in the Wild
- CVE-2025-3248100%9.8Unauthenticated RCE in Langflow /api/v1/validate/code
- CVE-2026-077063%9.8Unauthenticated Remote Code Execution in Langflow validate Endpoint
- CVE-2026-4871070%6.5HTTP Request Smuggling in Kludex Starlette (CVE-2026-48710)
- CVE-2026-4093312%9.9Flowise: Due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an…
- CVE-2024-58286<1%9.3dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through the FFMPEG Executable Path settings
- CVE-2026-43503<1%8.8Linux kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers…
- CVE-2026-502736%8.8Authenticated Path Traversal Arbitrary File Write in Langflow Files API
- CVE-2024-28224<1%6.6Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat…
- File and Print Sharing service in Windows 95, Windows 98, and Windows Me does not properly check the password for a file share, which allows remote attackers…
Appears with
- LiteLLMproduct · 7
- Giteaproduct · 5
- PoeLLMmalware · 5
- Gotenbergproduct · 5
- vLLMproduct · 5
- Googlevendor · 5
- Black Lotus Labsorganization · 5
- XMRigmalware · 4
- Anthropicvendor · 4
- Ivantivendor · 4
- Lumenorganization · 4
- LM Studioproduct · 4
- Ivanti Sentryproduct · 4
- Ollamavendor · 3
- Ironmalware · 3
- GitHuborganization · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.