Search: “agent framework”

48 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 296 Malware 199 AI safety & security 131 Exploit / PoC 124 Policy & legal 111 Ransomware 109 Threat actor 102 Data breach 76 Industry 69 AI research 57 Phishing & fraud 56 AI tools & infra 29 AI industry 29 Model release 27

SeverityAll critical 499 high 287 medium 328 low 114 info 263

ZDI-26-706: (0Day) CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability

ZDI discloses unpatched unsafe reflection RCE vulnerability CVE-2026-92206 (CVSS 8.8) in the CrewAI agent framework.

Zero Day Initiative published ZDI-26-706, an unsafe reflection remote code execution vulnerability in the CrewAI framework, tracked as CVE-2026-92206 with a CVSS score of 8.8. Exploitation requires user interaction: the target must load a malicious agent configuration from the repository. As a 0day advisory, no patch is indicated at publication.

ZDI Published Advisories05:00 UTC · 12h agoVulnerability CVE-2026-92206

$1 Million Sandbox Challenge Uncovers Linux Kernel Flaws

Vercel's $1M sandbox challenge surfaced two Linux kernel networking defects—one leaking host kernel memory, one crashing hosts—with CVEs pending.

Vercel ran a two-week, $1 million sandbox escape challenge (Aug 18–Sep 1) on its Firecracker-based microVM sandbox, receiving 1,285 reports and committing ~$325k in payouts (1 Critical, 7 High, 15 Medium, 49 Low validated so far). No attacker accessed real customer data. The most important filing found two independent Linux kernel networking stack defects—one leaks host kernel memory, the other deterministically crashes the host—with wide implications for cloud providers isolating workloads via the same kernel layer. Fixes are under private review with CVEs pending; Vercel also plans to open-source its agentic report-triage agent built on the Eve framework running Kimi K3.

SecurityWeekSep 15, 16:00 UTC · 1d agoVulnerability1

Straiker enables visibility and runtime protection for enterprise AI agents

Help Net SecurityMar 25, 13:17 UTC · Mar 25, 2026Vulnerability1

Friday Squid Blogging: Squid Washing Up on Cape Cod Beach

Schneier on SecurityJul 17, 21:01 UTC · Jul 17, 2026Vulnerability

LLMs are everywhere in your stack and every layer brings new risk

Help Net SecurityDec 10, 00:00 UTC · Dec 10, 2025Vulnerability

ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket

The Hacker NewsMar 2, 06:01 UTC · Mar 2, 2026Vulnerability CVE-2026-25593 CVE-2026-24763 CVE-2026-25157+4 CVEs

Half the defense base still builds security around compliance

Help Net SecurityJul 7, 05:44 UTC · Jul 7, 2026Vulnerability

Paper Werewolf Deploys PowerModul Implant in Targeted Cyberattacks on Russian Sectors

The Hacker NewsApr 12, 05:17 UTC · Apr 12, 2025Vulnerability

AI went from assistant to autonomous actor and security never caught up

Help Net SecurityMar 3, 00:00 UTC · Mar 3, 2026Vulnerability

PraisonAI CVE-2026-44338 Auth Bypass Targeted Within Hours of Disclosure

The Hacker NewsMay 15, 00:00 UTC · May 15, 2026Vulnerability in the wildCVE-2026-44338

Agentic AI’s OODA Loop Problem

Schneier on SecurityOct 20, 11:00 UTC · Oct 20, 2025Vulnerability

Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations

The Hacker NewsJul 6, 18:34 UTC · Jul 6, 2026Vulnerability CVE-2025-52691 CVE-2025-68613 CVE-2025-9316+2 CVEs

PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian Networks

The Hacker NewsApr 27, 14:07 UTC · Apr 27, 2026Vulnerability

Hackers Backdoor Unpatched Microsoft SQL Database Servers with Cobalt Strike

The Hacker NewsFeb 22, 07:22 UTC · Feb 22, 2022Vulnerability

Google Introduces Unique AI Agent Identities in New Gemini Enterprise

Infosecurity MagazineApr 23, 12:00 UTC · Apr 23, 2026Vulnerability

Microsoft's August 2026 Patch Tuesday addresses 398 CVEs (CVE-2026-68820)

Tenable reports Microsoft's August 2026 Patch Tuesday addresses 398 CVEs including three zero-days, one exploited in the wild (CVE-2026-68820).

Microsoft patched 398 CVEs in its August 2026 Patch Tuesday release, with 42 rated critical, 355 important, and one moderate, and three zero-days among them. One zero-day is confirmed as exploited in the wild. The release covers components including .NET, .NET Framework, Active Directory Certificate Services (AD CS), Azure services, and Windows. Tenable's count omits two CVEs assigned by MITRE, CVE-2026-6726 and CVE-2026-6727.

Tenable BlogAug 11, 18:04 UTC · Aug 11, 2026Vulnerability in the wildCVE-2026-68820 CVE-2026-6726 CVE-2026-67271

Aikido Infinite introduces continuous, self-remediating AI penetration testing

Help Net SecurityFeb 24, 00:00 UTC · Feb 24, 2026Vulnerability

Phylum adds OPA and continuous reporting to its policy engine

Help Net SecurityApr 19, 00:00 UTC · Apr 19, 2023Vulnerability

Terra Security introduces continuous exploitability validation for CTEM programs

Help Net SecurityDec 1, 00:00 UTC · Dec 1, 2025Vulnerability

TensorFlow CI/CD Flaw Exposed Supply Chain to Poisoning Attacks

The Hacker NewsJan 19, 02:51 UTC · Jan 19, 2024Vulnerability

Iranian Peach Sandstorm group behind recent password spray attacks

Security AffairsSep 16, 13:36 UTC · Sep 16, 2023Vulnerability CVE-2022-47966 CVE-2022-26134

AI-Powered Villager Pen Testing Tool Hits 11,000 PyPI Downloads Amid Abuse Concerns

The Hacker NewsSep 15, 00:00 UTC · Sep 15, 2025Vulnerability in the wild1

Cytex AICenturion protects against data exfiltration

Help Net SecurityMar 19, 00:00 UTC · Mar 19, 2025Vulnerability

Does CVSS 4.0 solve the exploitability problem?

Help Net SecurityJan 31, 00:00 UTC · Jan 31, 2024Vulnerability CVE-2023-34103 CVE-2023-22523 CVE-2023-3282

Rockwell Automation fixes multiple DoS flaws in Stratix Switch introduced by Cisco Software

Security AffairsApr 7, 12:01 UTC · Apr 7, 2019Vulnerability

The vulnpocalypse rains iBugs down on Apple with record-setting number of patches

Apple's record patch cycle fixes 260+ CVEs across iOS 27 and macOS 27, including CUPS remote code execution, with no active exploitation reported.

Apple patched more than 260 CVEs across its operating systems and software, its largest single patch cycle ever, with iOS 27 fixing 122 flaws and macOS 27 Golden Gate fixing 204. Notable bugs include CVE-2026-43692, a CUPS validation issue allowing remote code execution, and CVE-2026-43689, an iOS privilege-escalation flaw granting root access. Ten CVEs were credited to AI-assisted bug hunting, including CVE-2026-65410 and CVE-2026-65409 found by Calif with Claude and Anthropic Research. None of the vulnerabilities are listed as actively exploited.

The Register · SecuritySep 15, 21:38 UTC · 19h agoVulnerability CVE-2026-65410 CVE-2026-65409 CVE-2026-43689+10 CVEs