Smart search ranks by meaning as well as keywords (one row per story, last 45 days).
Metasploit Framework's automated pipeline refreshed its module metadata file, a routine repository maintenance commit introducing no new modules or exploits.
An automated Metasploit Framework commit updated module_metadata_base.json, the metadata database consumed by module tooling. The change is routine maintenance and contains no new exploit modules or vulnerability content.
Metasploit Framework automatically updates its module metadata JSON in routine maintenance commit.
The Metasploit Framework repository received an automatic update to module_metadata_base.json, the metadata file that tracks module information. No specific new vulnerability, exploit module, or feature is described in the commit message. This is routine repository maintenance rather than a notable security event.
Routine automated Metasploit Framework commit updates module_metadata_base.json with new module metadata.
The Metasploit Framework repository received an automated commit updating module_metadata_base.json, the file that tracks module metadata for the framework. This is routine maintenance accompanying new or updated exploit modules rather than a standalone disclosure. No vulnerability details, CVEs, or exploitation evidence are included.
Automated Metasploit Framework commit refreshes module_metadata_base.json with no new exploit content or vulnerability details.
An automated commit updated module_metadata_base.json in the Rapid7 Metasploit Framework repository. The change reflects routine metadata maintenance and introduces no new modules, exploits, or vulnerability information.
Automated Metasploit Framework commit updating module_metadata_base.json to reflect newly added or modified exploit modules.
An automated commit updated module_metadata_base.json in the rapid7/metasploit-framework repository. The routine maintenance change reflects newly added or modified Metasploit modules and carries no standalone security significance.
Routine automated Metasploit Framework commit updating module metadata, with no disclosed vulnerability or exploitation activity.
The Metasploit Framework repository received an automatic update to its module_metadata_base.json file. The commit text contains no vulnerability details, CVE references, or new exploit modules. This is routine maintenance activity on the open-source penetration testing framework.
Metasploit Framework pushed an automated update to its module_metadata_base.json module metadata file.
This repository commit is an automated update to the Metasploit Framework's module_metadata_base.json file. No new modules, vulnerabilities or exploit changes are described in the commit message.
A Metasploit Framework exploit module was updated to work reliably against several 12.4.3 software versions.
A commit to the Rapid7 Metasploit Framework repository adjusts an existing exploit module so it functions against several 12.4.3 version targets. The change is described as getting the module working against those versions, indicating reliability or compatibility improvements. The commit text does not describe a new vulnerability, exploitation campaign, or affected victims.
OpenClaw 2.0 migrates AI agent sessions to SQLite, adds guided credential setup, and flags shared-session controls as not a security boundary.
OpenClaw 2.0, described as the largest update in the project's history, migrates sessions and transcripts into SQLite and adds guided setup that detects existing AI credentials from Codex, ChatGPT, Claude CLI sign-ins, API keys, and local Ollama or LM Studio models. The release expands multiplayer sharing while explicitly stating its permission controls are not tenant isolation or a security boundary, and that revoked access can briefly remain usable. Startup JavaScript requests fell from 140 to 45 and startup time from about 1.6 seconds to 575 milliseconds in simulated tests against a mocked Gateway. Automation wrappers must now inspect reported health because requesting --json does not waive risk acknowledgement.
Canada's Cyber Centre warns Next.js 15.5 and 16.3 are affected by critical vulnerabilities; users should update to 15.5.24 and 16.3.3.
The Canadian Centre for Cyber Security (AV26-851) warns that Next.js versions 15.5 prior to 15.5.24 and 16.3 prior to 16.3.3 are affected by critical vulnerabilities. Administrators are urged to review the vendor advisory and apply the August 2026 security release updates. The bulletin provides no CVE ids or exploitation details.
Sixteen-week roundup finds package managers converging on release-age cooldowns, install-script blocking, malware scans, and recurring path-traversal and credential-leak fixes.
The author aggregates supply-chain security trends from sixteen weeks of This Week in Package Management, built from about 80 RSS feeds. Release-age cooldown gates shipped in Deno 2.8, Bundler, npm, Yarn, mise, Hex, Mamba, and Cargo, with Dependabot making a three-day cooldown default in August. npm 12 and Bun 1.4 now block lifecycle install scripts by default, and Composer 2.10 and uv added install/publish-time malware checks, while npm's registry began scanning at publish time. Path traversal on archive extraction was fixed in 14 of 16 weeks across tools including uv, pnpm, Docker, and Composer, and credential-misdirection bugs affected Cargo, ORAS, Composer, and Renovate.
Rapid7 updated a Metasploit auxiliary scanner module that detects XML external entity injection in Elasticsearch via Apache Tika.
A commit in the Metasploit Framework updated modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb, an auxiliary scanner module. The module targets XML external entity (XXE) injection in Elasticsearch through Apache Tika, and was co-authored by jheysel-r7. The terse commit message contains no additional details, CVE references, or exploitation notes.
Simon Willison released llm-openrouter 0.7.1, a performance fix for loading OpenRouter models in his LLM CLI plugin.
Version 0.7.1 of the llm-openrouter plugin addresses a performance problem when loading OpenRouter models in the LLM command-line tool. The fix was contributed by GitHub user waveplate. It is a minor maintenance release with no security implications noted.
Homebrew 7.0.0 ships a native brew vulns scanner, OSV-backed advisory database, stronger sandboxing, and fixes a sandbox-escape issue.
Homebrew 7.0.0 introduces a built-in 'brew vulns' command that scans installed formulae, dependencies, and Brewfiles against a new Homebrew-specific advisory database and OSV.dev data, distinguishing backported fixes from outdated versions. The release hardens sandboxing by blocking home-directory reads during builds, disabling network access at install time, and replacing Bubblewrap with Landlock on Linux. It also fixes moderate-severity GHSA-5263-whxq-77hp, where a malicious cask could execute code outside the macOS sandbox via LaunchServices, and drops macOS Catalina while moving Intel Macs to Tier 3.
Version 0.34 of Simon Willison's llm CLI adds response-duration metrics to log output, plus bug fixes and faster log querying.
The open-source llm command-line tool for interacting with large language models released version 0.34. The headline change adds response duration in milliseconds and human-readable form to llm logs --usage Markdown output, plus a new duration_ms field in llm logs --short. The release includes several contributed bug fixes and a significant performance improvement to llm logs, alongside the related llm-openrouter 0.7.1 release.
Rapid7's weekly Metasploit roundup highlights newly added exploit modules, payloads, and scanners in the Metasploit Framework.
Rapid7 published its weekly Metasploit Wrap Up summarizing community contributions to the Metasploit Framework, including new exploit modules, payloads, and scanners. No article text was available; the post serves as a routine digest for practitioners tracking newly packaged modules.
Canada's Cyber Centre warns Progress Telerik UI for ASP.NET AJAX before 2026.3.812 is affected by path traversal and upload tampering flaws, urging updates.
The Canadian Centre for Cyber Security issued advisory AV26-875 on September 2, 2026, covering vulnerabilities in Progress Software Telerik UI for ASP.NET AJAX prior to version 2026.3.812. Two flaws are listed: CVE-2026-18672, a path traversal in the Telerik Web Forms RadImageEditor, and CVE-2026-19219, a DialogHandler UploadPaths tampering vulnerability. Administrators are encouraged to review the provided links and apply available updates.
libxml2 2.15.4 patches two flaws including a heap buffer overflow in xmlDictAddQString tracked as CVE-2026-86137 and CVE-2026-86138.
libxml2 releases before 2.15.4 are affected by an integer overflow in xmlDictAddQString in dict.c that leads to a heap-based buffer overflow, tracked as CVE-2026-86137 and CVE-2026-86138. The oss-security post from Debian's Salvatore Bonaccorso flags the fixed release for downstream tracking. No exploitation is mentioned in the disclosure.
Unit 42 traces the pseudo-Darkleech campaign, which compromises websites to inject scripts redirecting visitors to exploit kits delivering ransomware.
Palo Alto Networks Unit 42 analyzed the evolution of the pseudo-Darkleech campaign, which injects malicious script into compromised Apache, IIS and WordPress sites to redirect visitors to exploit kits such as Angler and Neutrino. The original Darkleech Apache module infected thousands of servers starting in 2012 and delivered Blackhole EK until that kit disappeared after Paunch's 2013 arrest. From 2015 onward, pseudo-Darkleech delivered ransomware families like CryptoWall and TeslaCrypt, and by early 2016 its injected scripts added obfuscated numeric blocks with frequently changing separator characters. Unit 42 tracks these patterns to help defenders identify compromised websites.
Cisco Identity Services Engine's PatchUpdateListener has an authenticated directory traversal (CVE-2026-20148, CVSS 4.9) enabling sensitive information disclosure.
ZDI advisory ZDI-26-582 describes a directory traversal information disclosure vulnerability in the PatchUpdateListener component of Cisco Identity Services Engine. Remote attackers can disclose sensitive information, but valid authentication is required to exploit the flaw. ZDI assigned a CVSS rating of 4.9 and CVE-2026-20148.
A new benchmark shows LLMs reach 68.3-93% accuracy propagating local revisions across conversationally generated artifacts, with parallel-sample selection most cost-effective.
The paper introduces a benchmark for revision propagation: when users request a local change, LLMs must identify dependencies and update all affected parts of an artifact generated through conversation, where context lives in the chat history. Nine revision methods, including sequential reflection and parallel sampling variants, were evaluated on gpt-oss-20b/120b, gpt-5.4-mini, and qwen3.5-9b/27b/122b. Baselines scored 68.3-93% accuracy, and selecting among three parallel samples via LLM-based or medoid selection improved accuracy by 2.2-9.7% as the most cost-effective test-time compute strategy. Code and dataset are released.
libpcap 1.10.7 fixes seven vulnerabilities, including CVE-2026-31912 affecting the deprecated bpf_filter(), and all users are advised to update.
libpcap 1.10.7 was published on 2026-09-05 with its main focus being fixes for seven vulnerabilities. Maintainer Denis Ovsienko announced the release on the oss-security mailing list, noting that each CVE record contains detailed accounts and links to git commits with further explanation. For the CVE-2026-31912 fix to take effect, applications using the now deprecated bpf_filter() must update their usage. All users are advised to update; no exploitation in the wild is reported.
Unit 42 documents how the EITest campaign's gate URLs and infrastructure evolved since 2014 while still routing victims to Angler EK and diverse malware.
Unit 42 traced network traffic changes in the EITest campaign, which Malwarebytes identified in October 2014 across thousands of compromised websites. The campaign's injected script patterns have remained consistent, but its gate URLs changed repeatedly, and since January 2016 gates used the 85.93.0.0/24 IP block, often with .tk domains. The gate returns a Flash file that redirects victims to Angler EK, which delivered malware including Vawtrak, Tinba, TeslaCrypt, Bedep, Kovter, Ursnif, and Zeus variants from 2014 through 2016.
The Register critiques OpenClaw 2.0 for easing installation and revamping the interface while leaving most agent security decisions to users.
The Register reports that OpenClaw 2.0, a popular agent harness, makes installation easier and adds a new interface wrapper. However, the release leaves most security decisions to users, which the outlet argues could worsen the risk posture of a widely deployed tool. The piece frames the update as cosmetic improvement over a slow-burning security problem.
A controlled study finds agent memory portability varies sharply: fixed-schema knowledge graphs survive model swaps while compressed notes degrade.
The study compares preserving an agent's history as raw long context, RAG chunks, compressed natural-language notes, or fixed-schema knowledge graphs across model upgrades, using 48 synthetic histories and two open-weight sub-10B-parameter models. Fixed-schema KG accuracy changed by only +0.0004 ± 0.0020 after a writer swap, while compressed NOTES shifted asymmetrically by +9.91 or -13.28 percentage points depending on migration direction. Mixed 50/50 embedding migrations captured only 4.96 of an 11.90-point RAG re-embedding gain; 80% of the NOTES deficit came from information lost at construction, and 81% of the RAG deficit from retrieval failures. Store-only repair of NOTES failed to reach 90% recovery in all 48 cases, while retaining raw histories enabled recovery in 34 of 48 for one direction.
libxml2 2.15.4 fixes an out-of-bounds read in xmlregexp's NXT macro plus several integer overflow and parsing flaws.
libxml2 2.15.4 (released September 1, 2026) includes security fixes: an out-of-bounds read in the xmlregexp NXT macro, missing overflow checks in dict.c, uri.c, and valid.c, an integer overflow in xmlIO before the writecallback, and an overflow check in xmlXPtrEvalXPtrPart. The release also propagates parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree. No CVE identifiers, exploitation, or severity ratings are given in the announcement.
UnrealIRCd 6.2.7 hot-patch fixes a minor MITM command injection in STARTTLS S2S upgrade, flagged as LLM-reported.
Sam James points to an UnrealIRCd commit fixing a command injection during STARTTLS upgrade in server-to-server links, exploitable only via man-in-the-middle position. He characterizes it as uninteresting and cites it as an example of the typical shape of LLM-reported vulnerability findings.
GitLab patched a CVSS 10.0 path traversal (CVE-2026-85706) plus deserialization and buffer-overflow flaws, urging self-managed users to update immediately.
GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, fixing CVE-2026-85706 (CVSS 10.0), an unauthenticated path traversal in the repository commits API enabling arbitrary file reads on both Community and Enterprise Editions. CVE-2026-87719 (CVSS 9.9) is insecure deserialization in the EE GraphQL subscription serializer that can expose Advanced Search configurations and credentials, while CVE-2026-88765 (CVSS 8.5) allows authenticated RCE via crafted project exports. The update includes database migrations, so single-node deployments will experience downtime; GitLab.com is already patched.
Redis launches LangCache, a managed semantic cache matching LLM prompts by meaning, cutting API costs up to 90% and returning hits up to 15x faster.
Redis LangCache is a fully managed semantic caching service in public preview on Redis Cloud, accessed via a REST API with Python and JavaScript SDKs. It embeds incoming prompts, vector-searches stored entries, and returns a cached response when similarity clears a configured threshold, skipping the LLM call entirely. Redis claims up to 90% cost savings and up to 15x faster cache hits; a demo run showed 0.37 seconds versus 2.232 seconds direct inference (about 6x) with zero LLM tokens. Customer Mangoes.ai reports a 70% hit rate, 70% lower LLM spend, and 4x faster responses on a patient-care voice app.