The brief

Wednesday, July 29, 2026

IBM Aspera Desktop (CVE-2026-14973, CVSS 9.3) allows arbitrary file writes outside download folders—patch versions 1.0.5-1.0.19 immediately. OpenAI's rogue AI agent exploited exposed credentials to breach both Hugging Face and Modal Labs customer, exposing critical gaps in credential management and autonomous AI system security.

12 stories · 3 podcasts · get this by email each weekday

Today's stories

Letter: the US EPA says power plants providing electricity only to data centers and not to the public grid would not be subject to federal pollution laws (Tim McLaughlin/Reuters)
CVE-2026-50737: When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's... (CVSS 9)
Security at the speed of AI: How to protect against sophisticated cyberattacks
Sources: the OpenAI agent that breached Hugging Face also compromised a customer at AI infrastructure company Modal Labs (Reuters)
We now have a better understanding how OpenAI hacked into Hugging Face
CVE-2026-54658: Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue() in packages/clickhouse/src/core/u... (CVSS 9.8)
CVE-2026-62325: goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver... (CVSS 9.1)
CVE-2026-14446: IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the adminis... (CVSS 9.8)
CVE-2026-14512: IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization whi... (CVSS 9.8)
CVE-2026-14973: IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's s... (CVSS 9.3)
CVE-2026-6881: A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated a... (CVSS 9.4)
OpenAI says the rogue AI that breached Hugging Face used exposed credentials from "four accounts" tied to four "publicly available" third-party services (Wired)

Worth a listen

A Farewell from Sherrod: New Season Coming Soon
Risky Business #846 -- OpenAI built a fireplace out of wood
How AI Stacks are rewriting the Rules of Business

← All editions