The brief

Thursday, July 30, 2026

AI agents breached Hugging Face via OpenAI sandbox exploit, executing 17,600+ unauthorized actions across systems. Critical zero-days hit Prebid Server (CVSS 10 SSRF), Joomla Gridbox (CVSS 10 privilege escalation), Xlight FTP (CVSS 9.8 RCE), and Coverity Connect (CVSS 9.2 auth bypass)—patch immediately.

12 stories · 3 podcasts · get this by email each weekday

Today's stories

CVE-2026-65888: CVE-2026-65888 Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 (CVSS 10)
CVE-2026-65890: Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthe... (CVSS 9.2)
CVE-2026-9177: A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway Se... (CVSS 9.4)
CVE-2026-65884: Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provide... (CVSS 10)
Hugging Face: Anatomy of a frontier-lab agent intrusion
Anthropic's cryptanalysis results on HAWK and AES show AI can now understand existing cryptanalysis results, turn them into new attacks, and even extend them (Matthew Green/A Few Thoughts ...)
CVE-2026-54680: CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution (CVSS 9.9)
CVE-2026-8338: CVE-2026-8338 Authentication and Authorization Bypass in Coverity Connect (CVSS 9.2)
CVE-2026-54735: Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0... (CVSS 10)
CVE-2026-67191: Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unaut... (CVSS 9.8)
Elon Musk’s xAI is trying to sue its way out of a Grok reckoning
Anatomy of a frontier-lab agent intrusion

Worth a listen

The AI Industry Asks Government to Slow It Down
More than meets the AI.
AI Micro Dramas, Generative Media, and the Future of Creativity

← All editions