AI Sandbox Escapes: Why Forensic Readiness Matters More Than Containment
GitLab Email Token Lets Attackers Push Code to Main and Execute CI/CD Jobs
6 sources 4 min
With the Rise of AI Agents, SOC 2 Should Adapt or Risk Irrelevance
8 min
Fixing Flock: The controls needed now that misuse patterns are clear
14 min
CVE-2026-95811: Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it
CVE-2026-97636: Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key
CVE-2026-57590: Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations
VU#676317: Norwegian Cruise Line door access controller contains an improper authentication vulnerability
2 min
Beyond Centralized Policy Decision Points: Decentralized Sticky Policy Authorization through Evidence Quorums
Physalia: Redistribution-Resistant Content Protection for Decentralized Storage
Relays Are Masking Chinese Access to Frontier AI Models in the US
Meta’s AI agent has been blocked from using Amazon.com
Teams meeting audio and roster data remain accessible via ACS Call Automation connectCall after a participant is removed from the meeting
From Alignment to Access Control: A Framework for GenAI Policy Enforcement
CVE-2026-93710: Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks
LeaseGuard: Incumbent-Preserving Admission Control for Privileged LLM Agents
Structured Decomposition for Reliable LLM-Generated Access Control Policies
CVE-2026-75157: Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)
Test environment let anyone access live customer data
2 min