Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

CVE-2026-63414

In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify

来源摘录 · GitHub Advisory

New Cisco firewall zero-day exploited to crash SSL VPN devices

Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat De

来源摘录 · BleepingComputer

Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls

CVE-2026-76418

Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA)

来源摘录 · The Hacker News

CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL)

CVE-2026-109618 · CVE-2026-109619

CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Produ

来源摘录 · Palo Alto Security Advisories

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)

CVE-2026-109618 · CVE-2026-109619

CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web serv

来源摘录 · Palo Alto Unit 42

GitLab Patch Release and Security Update: 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11, 18.11.14

CVE-2026-111943

We have released versions 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11, 18.11.14 for GitLab Community Edition (CE)

来源摘录 · GitLab Security Releases

cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials

CVE-2026-62290

## Summary `Challenge` resources under `acme.cert-manager.io` can be created directly by namespace users. On create, ce

来源摘录 · GitHub Advisory

@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy

## Unauthenticated Danswer API Confused Deputy Proxy in @eeacms/volto-chatbot ### Summary `@eeacms/volto-chatbot` expo

来源摘录 · GitHub Advisory

Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

CVE-2026-62160

### Summary Daptin's `LanguageMiddleware` (registered as a global gin middleware) calls `golang.org/x/text/language.Par

来源摘录 · GitHub Advisory

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by send...

CVE-2024-8517

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacke

来源摘录 · NVD

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and lea...

CVE-2026-109618

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some co

来源摘录 · NVD

Tracking AI adoption in North Korean threat actor tradecraft

As Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed and effici

来源摘录 · Microsoft Threat Intelligence

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

CVE-2026-20127

A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, a

来源摘录 · BleepingComputer

The Privacy and Security Risks of Edge LLM Optimization

Edge deployment of Large Language Models requires optimization techniques that reduce memory, computation, and energy co

来源摘录 · arXiv cs.CR

Surprise Alone Learns Lies: Evidence-Gated Continual Learning for LLMs from Streaming Claims

Continual learning methods for large language models increasingly decide what to learn by surprise, keeping the inputs t

来源摘录 · arXiv cs.CR

InferD: A Honeypot Framework for AI Inference Infrastructure

Large language model serving stacks, commercial inference APIs, vector databases, and agent orchestration gateways are n

来源摘录 · arXiv cs.CR

Judging Before Propagation: Task-Graph Contextual Integrity for Multi-Agent Privacy

Multi-agent LLM systems increasingly rely on persistent memory and inter-agent communication. These capabilities create

来源摘录 · arXiv cs.CR

Where You Inject Matters: The Trust Region Effect in LLM Agents

LLM agents are increasingly adopted in long-horizon tasks and interact with diverse external environments. Despite their

来源摘录 · arXiv cs.CR

Answer-Only Disclosure: Private-Context LLM Assistance over Web APIs with a Leakage Ledger

Web assistants increasingly answer questions about a user's private documents by pairing a small on-device model with a

来源摘录 · arXiv cs.CR

ICALL-BENCH: Benchmarking LLM Interprocedural Reasoning in Binary Programs

Recent benchmarks show that LLMs achieve strong performance in both function-level binary understanding and end-to-end b

来源摘录 · arXiv cs.CR