The brief

Tuesday, September 29, 2026

Netcore NR289-GE routers have two CVSS 10 bugs—CVE-2026-101072 and CVE-2026-101077—enabling command execution and auth bypass; Canonical LXD’s CVE-2026-85185 adds btrfs path traversal risk. AI-led attacks are accelerating: Carbonato hits Docker hosts for AI keys, JadePuffer wipes Azure tenants, and TDengine zero-day can crash OT servers.

12 stories · 3 podcasts · get this by email each weekday

Today's stories

OpenAI Pauses Training Its Most Powerful Models After Rogue Agents Target Government
Florida AG James Uthmeier files for an emergency injunction against OpenAI and ChatGPT, asserting the company cannot adequately self-regulate its tech (Axios)
FBI reportedly declares ‘cyber security incident’ after hackers steal agents’ personal data
JadePuffer AI Actor Compromises Azure Tenant in Destructive Cloud Attack
Android Auto's Gemini has a major problem when it comes to calling 911
Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts
One Packet Can Crash OT Servers in Industrial Sectors
CVE-2026-12342: This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the Id... (CVSS 9.6)
CVE-2026-101077: A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function process_request of the component boa_temp ... (CVSS 10)
CVE-2026-101072: A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /ap_ip.c... (CVSS 10)
CVE-2026-85185: Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 an... (CVSS 9.6)
CVE-2026-19759: An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prio... (CVSS 9.4)

Worth a listen

← All editions