blog

An autonomous AI agent chained two bugs in Hugging Face's dataset-processing pipeline, stole cloud credentials and moved laterally through production. What it means for your ML pipelines and agents.

CISA added CVE-2026-72529 (missing auth, CVSS 9.3) and CVE-2026-72530 (code injection, CVSS 9.0) to KEV. The Head Mare group is swapping the client installer for a backdoor. Breakdown and defense.

274 Zimbra servers already compromised via CVE-2026-73570 — an SNMP-component command injection giving unauthenticated RCE. The exact preconditions, why patching isn't enough, and what to do.

CloudSEK's exposed-server analysis shows a Russian-speaking Aurora affiliate using the agentic assistant Cursor to plan intrusions and Active Directory escalation. Two defender lessons and what to do about them.

On 27-28 Aug 2026 PaperCut confirmed active exploitation of a zero-day in NG/MF (all versions affected) and shipped an emergency patch. We break down why print servers are prime targets, the IOCs, and a…

SharePoint auth-bypass CVE-2026-55040 was exploited on-prem within hours — part of an August 2026 Patch Tuesday of 421 CVEs and an active zero-day.

Agentjacking hijacks AI coding agents via MCP injection — 2,388 orgs, 85% success across Claude Code, Cursor and Codex. How it works and how to defend.