Vulnerabilitymedium
Hacker Runs Hermes AI Agent Unattended for Post
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-4034 | Out-of-Bounds Read/Write Local Privilege Escalation in polkit pkexec (PwnKit) | 7.8 | 95% | KEVRansomwarePoC ×4 | KEV |
| CVE-2026-31431 | Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface | 7.8 | 98% | KEVPoC ×12 | KEV |
| CVE-2026-43284 | Linux kernel ESP-in-UDP decrypts in place over shared splice pages (CWE-123) | 8.8 | 94% | PoC | |
| CVE-2026-43500 | Out-of-bounds write in Linux kernel AF_RXRPC decryption enables root access | 7.8 | 93% | ||
| CVE-2026-43503 | Linux kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers… | 8.8 | <1% |
From the original article
5 min read at thehackernews.com
Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand's Ministry of Finance, which runs the country's treasury and tax collection.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.