The brief

Monday, October 5, 2026

ZITADEL pre-3.4.14/4.16.2 has a hosted Login V1 auth bypass, and Xray-core has a certificate verification bypass that enables MITM on traffic. CISA warns internet-exposed OT is being hit by constant automated login/scanning, while GitAhead’s updater installs unsigned code and ignores TLS errors.

12 stories · 3 podcasts · get this by email each weekday

Today's stories

Sources: Apple and Google pitch state bills with self-attested age checks and no private lawsuits; Meta backs ones making app stores, not platforms, verify ages (Owen Dahlkamp/Politico)
The CISA Alert: Security Beyond Solitary Confinement
Xray-core concealed a certificate verification bypass vulnerability
A look at Sean Parker's resurrection of Stability AI following Emad Mostaque's ousting, and its new focus on AI for music professionals, backed by major labels (Abram Brown/The Information)
Google is shrinking your Gemini choices unless you pay more
CVE-2026-105231: CVE-2026-105231 kishor-23 food-waste-management-system Admin Registration signup.php sql injection (CVSS 7.5)
CVE-2026-105183: A weakness has been identified in itsourcecode Online Admission System 1.0. The affected element is an unknown function ... (CVSS 7.5)
CVE-2026-105295: GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or... (CVSS 7.7)
CVE-2026-105220: Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup fro... (CVSS 8.5)
CVE-2026-105219: Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser ... (CVSS 8.7)
CVE-2026-105086: WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders... (CVSS 9.3)
CVE-2026-105215: ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'ext... (CVSS 9.3)

Worth a listen

← All editions